Subject: [Ace] Integrating AAA and CoAP

From: Rafa Marin Lopez <[email-masked]>
Date: Wed, 9 Apr 2014 20:18:38 +0200

Dear all

As promised, we have written the following (and modest) I-D to explain our ongoing work about an EAP-based authentication service for CoAP that involves an AAA infrastructure. 

http://tools.ietf.org/html/draft-marin-ace-wg-coap-eap-00

Hope this helps somehow to ACE.

Best Regards.

-------------------------------------------------------
Rafael Marin Lopez, PhD
Dept. Information and Communications Engineering (DIIC)
Faculty of Computer Science-University of Murcia
30100 Murcia - Spain
Telf: +34868888501 Fax: +34868884151 e-mail: [email-masked]
-------------------------------------------------------

---

From: Behcet Sarikaya <[email-masked]>
Date: Wed, 9 Apr 2014 13:58:04 -0500

Hi Rafa,

I was reading your draft. I think using COAP as EAP transport is an
interesting idea.

However, I could not see anywhere in your document what is the problem you
are trying to solve.

Hopefully you can related the problem with the problem ace is trying to
solve.

Regards,

Behcet

On Wed, Apr 9, 2014 at 1:18 PM, Rafa Marin Lopez <[email-masked]> wrote:

> Dear all
>
> As promised, we have written the following (and modest) I-D to explain our
> ongoing work about an EAP-based authentication service for CoAP that
> involves an AAA infrastructure.
>
> _______________________________________________
> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace
>

---

From: Rafa Marin Lopez <[email-masked]>
Date: Thu, 10 Apr 2014 14:10:27 +0200

Hi Behcet:

First of all, thanks for reading the draft. Please see my comments inline.

El 09/04/2014, a las 20:58, Behcet Sarikaya <[email-masked]> escribió:

> Hi Rafa,
> 
> I was reading your draft. I think using COAP as EAP transport is an interesting idea.

Many thanks for your time.

> 
> However, I could not see anywhere in your document what is the problem you are trying to solve.
> 
> Hopefully you can related the problem with the problem ace is trying to solve.

As I mentioned in the previous e-mail, the idea of doing EAP over CoAP is previous to ACE. Initially, it was conceived to allow
only authenticated and authorized constrained nodes (EAP peer) to send/receive through the EAP authenticator (like a pure network access control model where the EAP authenticator was a gateway). 

Then, it also evolved to a service that allows a controller (EAP authenticator) to authenticate and authorize constrained nodes assuming a backend AAA infrastructure and to bootstrap a security association between two CoAP endpoints. When somebody deploys the constrained device, the controller needs to be authenticated and authorized to send, for example, temperature measurements. Also, the constrained node only allows the controller to enforce, for example, some configuration information. 

In any case, I agree with you on this. In fact, that is something we are discussing internally in order to relate our work with the uses cases I-D and the context of ACE. We hope to reflect our analysis in a next version of our document.

Best Regards.