Subject: [Dots] Questions about draft-moskowitz-dots-identities-00

From: "Roman D. Danyliw" <[email-masked]>
Date: Fri, 11 Nov 2016 04:29:33 +0000

Hello Bob, Frank, Daniel and Andrew!

Thanks for producing and submitting this draft!

(chair hat off)

The document lays out the a strong case in Section 1 about why in the abstract human readable names have problems.  Section 1.1 and 1.2 highlight alternatives.  However, I'm having difficulty linking these approaches with specific applications in a particular DOTS protocol draft.  Can you share a bit more of what you had in mind in applying 802.1AR or RFC7401?

Thanks,
Roman

---

From: Robert Moskowitz <[email-masked]>
Date: Fri, 11 Nov 2016 13:41:46 +0900

I had limited time and thought organization to 'get it all down' and 
still working.

Almost regardless of the security mechanism used for DOTS transport(s), 
identities are crucial and called out in the requirements draft for 
'mutual authentication'  (I would have to pull up the draft.  I will add 
a section on this on identities-01). So what are the identities used for 
mutual authentication?

X.509 certs are often used for this, but how does a machine acquire its 
cert?  A very involved and painful human controlled process or something 
better?  IEEE 802.1AR lays the groundwork for device identities.  ANIMA 
and NETCONF are working on leveraging this.  I have spoken with Max and 
others, and have my thoughts on how to do close to a 'zerotouch' for 
certificates in DOTS agents.

As to RawPublicKeys, it again comes down to the security protocol. DTLS 
with CoAP particularly uses RawPublicKeys.  Or there is HIP/ESP or other 
work I am doing where HITs can fit the bill.

So I am laying out here how identities are setup.  I will send you my 
transport thoughts that have been going between Frank, Sue Hares, and me 
shortly.

On 11/11/2016 01:29 PM, Roman D. Danyliw wrote:
> The document lays out the a strong case in Section 1 about why in the 
> abstract human readable names have problems.  Section 1.1 and 1.2 
> highlight alternatives.  However, I’m having difficulty linking these 
> approaches with specific applications in a particular DOTS protocol 
> draft. Can you share a bit more of what you had in mind in applying 
> 802.1AR or RFC7401?
>
> Thanks,
>
> Roman
>