Subject: [Lwip] Fwd: New Version Notification for draft-aks-lwig-crypto-sensors-00.txt

From: Mohit Sethi <[email-masked]>
Date: Mon, 12 Oct 2015 08:52:42 +0300

Folks.

Here is a submission documenting our implementation experiences of 
public-key cryptography on 8-bit micro-controllers. The informational 
document also provides design patterns and guidelines for ensuring 
integrity protection and freshness of messages that might be helpful 
when deploying such devices in practice.

We look forward to your feedback. Lets try to keep the group active./

/--Mohit

-------- Forwarded Message --------
Subject: 	New Version Notification for draft-aks-lwig-crypto-sensors-00.txt
Date: 	Wed, 7 Oct 2015 03:28:46 -0700
From: 	[email-masked]
To: 	Jari Arkko <[email-masked]>, Heidi-Maria Back 
<[email-masked]>, Heidi-Maria Back 
<[email-masked]>, Ari Keranen <[email-masked]>, 
Mohit Sethi <[email-masked]>, Jari Arkko 
<[email-masked]>, Mohit Sethi <[email-masked]>, Ari 
Keranen <[email-masked]>

A new version of I-D, draft-aks-lwig-crypto-sensors-00.txt
has been successfully submitted by Ari Keranen and posted to the
IETF repository.

Name:		draft-aks-lwig-crypto-sensors
Revision:	00
Title:		Practical Considerations and Implementation Experiences in Securing Smart Object Networks
Document date:	2015-10-07
Group:		Individual Submission
Pages:		30
URL:            https://www.ietf.org/internet-drafts/draft-aks-lwig-crypto-sensors-00.txt
Status:         https://datatracker.ietf.org/doc/draft-aks-lwig-crypto-sensors/
Htmlized:       https://tools.ietf.org/html/draft-aks-lwig-crypto-sensors-00

Abstract:
    This memo describes challenges associated with securing smart object
    devices in constrained implementations and environments.  The memo
    describes a possible deployment model suitable for these
    environments, discusses the availability of cryptographic libraries
    for small devices, presents some preliminary experiences in
    implementing small devices using those libraries, and discusses
    trade-offs involving different types of approaches.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Carsten Bormann <[email-masked]>
Date: Mon, 12 Oct 2015 12:28:22 +0200

Hi Mohit,

the draft contains a lot of information, thank you for that.

I'm just not so sure what to do with it in LWIG.

There is some information about a potential security architecture.
I would expect to discuss this in ACE, as it's not particularly about
implementation.

There is some information about crypto libraries for constrained
devices.  Some of it is about RSA, some of it for older ECC curves.
I didn't find anything about P-256 (CoAP's current MTI curve) or the
25519 curves, which are the more likely ones to be used going forward.

So I'm wondering a bit what an implementer of IETF IoT protocols can
take home specifically here.

Grüße, Carsten

Mohit Sethi wrote:
> URL:           
> https://www.ietf.org/internet-drafts/draft-aks-lwig-crypto-sensors-00.txt
> Status:        
> https://datatracker.ietf.org/doc/draft-aks-lwig-crypto-sensors/
> Htmlized:      
> https://tools.ietf.org/html/draft-aks-lwig-crypto-sensors-00
> 
> 
> Abstract:
> _______________________________________________
> Lwip mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/lwip
>

---

From: Mohit Sethi <[email-masked]>
Date: Mon, 12 Oct 2015 17:27:46 +0300

Hi Carsten

Thanks for the quick comment. If you notice, this draft has a lot of 
text that was written even before ACE was formed. The idea is not to 
suggest a new authorization architecture to ACE but rather show what 
implementers can already do today with existing libraries. It also talks 
about provisioning and message freshness that are not really in scope of 
ACE.

You are right about the curves though. The point was to show that the 
asymmetric crypto is possible on resource-constrained devices. The 
numbers of-course vary with the curve and platform chosen. I would like 
to include more numbers for some modern curves on similar platforms, 
such as those from Dull et al. (https://eprint.iacr.org/2015/343.pdf) in 
the next version.
But I was hoping that this would serve as a placeholder for others in 
LWIP to contribute with their numbers so that we and others in the 
community can learn from our experiences.

I hope this answers your concerns to some extent and look forward to a 
more detailed feedback.

/--Mohit

---

From: Carsten Bormann <[email-masked]>
Date: Mon, 12 Oct 2015 18:22:10 +0200

Hi Mohit,

thanks -- now that I see it as a work in progress and call for
additional input, this makes a lot sense.

Grüße, Carsten