Subject: [Ace] EST over CoAP in ACE wg

From: "Kumar, Sandeep" <[email-masked]>
Date: Mon, 21 Nov 2016 14:00:19 +0000

Dear ACE members

Peter van Stok gave a short overview during the ACE f2f meeting on the work related to EST (RFC 7030) over DTLS secured CoAP (draft-vanderstok-core-coap-est-00<https://tools.ietf.org/html/draft-vanderstok-core-coap-est-00>). In the meeting there was general interest among the audience for the work and ACE as the preferred WG for this item. There are additional drafts and work on the same topic like the draft-pritikin-coap-bootstrap-01<https://tools.ietf.org/html/draft-pritikin-coap-bootstrap-01> and the email from Shahid https://www.ietf.org/mail-archive/web/ace/current/msg02029.html
The idea is to merge these into a single draft (already discussed among us).

We would like to get feedback on the mailing list if indeed ACE would be a right place to continue this work as was perceived during the f2f meeting. Please respond if you support (or not) the activity going forward in ACE wg.

Kind Regards
Sandeep

________________________________
The information contained in this message may be confidential and legally protected under applicable law. The message is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and destroy all copies of the original message.

---

From: Somaraju Abhinav <[email-masked]>
Date: Mon, 21 Nov 2016 14:51:04 +0000

Hi Sandeep,
I think this is a good idea and will fully support the adoption of this in ACE.
Abhinav

From: Ace [mailto:[email-masked]] On Behalf Of Kumar, Sandeep
Sent: Montag, 21. November 2016 15:00
To: [email-masked]
Cc: Shahid Raza <[email-masked]>; Panos Kampanakis (pkampana) <[email-masked]>; [email-masked]' <[email-masked]>
Subject: [Ace] EST over CoAP in ACE wg

Dear ACE members

Kind Regards
Sandeep

________________________________
The information contained in this message may be confidential and legally protected under applicable law. The message is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and destroy all copies of the original message.
________________________________________________________ The contents of this e-mail and any attachments are confidential to the intended recipient. They may not be disclosed to or used by or copied in any way by anyone other than the intended recipient. If this e-mail is received in error, please immediately notify the sender and delete the e-mail and attached documents. Please note that neither the sender nor the sender's company accept any responsibility for viruses and it is your responsibility to scan or otherwise check this e-mail and any attachments.

---

From: Eliot Lear <[email-masked]>
Date: Mon, 21 Nov 2016 16:20:59 +0100

I think this is a good idea.

Eliot

On 11/21/16 3:00 PM, Kumar, Sandeep wrote:
> _______________________________________________
> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Mon, 21 Nov 2016 15:32:56 +0000

+1 on ACE taking up this work.

From: Kumar, Sandeep [mailto:[email-masked]]
Sent: Monday, November 21, 2016 9:00 AM
To: [email-masked]
Cc: [email-masked]' <[email-masked]>; Panos Kampanakis (pkampana) <[email-masked]>; Shahid Raza <[email-masked]>
Subject: EST over CoAP in ACE wg

Dear ACE members

Kind Regards
Sandeep

---

From: Samuel Erdtman <[email-masked]>
Date: Mon, 21 Nov 2016 17:30:49 +0100

Hi All,

To run EST over DTLS and CoAP to address more constrained devices is not
new to me, this was part of conversations that neXus (my previous employer)
and SICS had about one and a half year ago.

I would support this work. I think certificates makes sense for ACE because
of the connection to existing security infrastructure.

At neXus we did SCEP and CMP enrollment but when moving to more constrained
devices it would make sense to move to use EST over CoAP and DTLS.
In addition to being quite simple compared to SCEP and CMP, EST also
support server side generated keys which could be a benefit for constrained
devices. Not because the devices could not generate the key but in some
case keys needs to be generated in trusted and certified hardware (FIPS, CC
etc.) to "know" that keys are of good quality.

//Samuel

On Mon, Nov 21, 2016 at 3:00 PM, Kumar, Sandeep <[email-masked]>
wrote:

> Dear ACE members
>
>
>
> Peter van Stok gave a short overview during the ACE f2f meeting on the
> work related to EST (RFC 7030) over DTLS secured CoAP (
> draft-vanderstok-core-coap-est-00
> <https://tools.ietf.org/html/draft-vanderstok-core-coap-est-00>). In the
> meeting there was general interest among the audience for the work and ACE
> as the preferred WG for this item. There are additional drafts and work on
> the same topic like the draft-pritikin-coap-bootstrap-01
> <https://tools.ietf.org/html/draft-pritikin-coap-bootstrap-01> and the
> email from Shahid https://www.ietf.org/mail-archive/web/ace/current/
> msg02029.html
>
> We would like to get feedback on the mailing list if indeed ACE would be a
> right place to continue this work as was perceived during the f2f meeting.
> Please respond if you support (or not) the activity going forward in ACE wg.
>
>
>
> Kind Regards
>
> Sandeep
>
>
>
>
>
> ------------------------------
> The information contained in this message may be confidential and legally
> protected under applicable law. The message is intended solely for the
> addressee(s). If you are not the intended recipient, you are hereby
> notified that any use, forwarding, dissemination, or reproduction of this
> message is strictly prohibited and may be unlawful. If you are not the
> intended recipient, please contact the sender by return e-mail and destroy
> all copies of the original message.
>

---

From: Shahid Raza <[email-masked]>
Date: Mon, 21 Nov 2016 20:06:54 +0100

Hi,

Thanks for the initiative Sandeep. I fully support this. 
As Samuel mentioned, SICS has been working with neXus on this solution for more than a year now. We would be glad to bring in our experience and would be happy to share our Contiki side and the SICSthSense side (sense.sics.se <http://sense.sics.se/>) implementations. 

Regards,
Shahid

> On 21 Nov 2016, at 17:30, Samuel Erdtman <[email-masked]> wrote:
> 
> Hi All,
> 
> To run EST over DTLS and CoAP to address more constrained devices is not new to me, this was part of conversations that neXus (my previous employer) and SICS had about one and a half year ago.
> 
> I would support this work. I think certificates makes sense for ACE because of the connection to existing security infrastructure.
> 
> At neXus we did SCEP and CMP enrollment but when moving to more constrained devices it would make sense to move to use EST over CoAP and DTLS. 
> In addition to being quite simple compared to SCEP and CMP, EST also support server side generated keys which could be a benefit for constrained devices. Not because the devices could not generate the key but in some case keys needs to be generated in trusted and certified hardware (FIPS, CC etc.) to "know" that keys are of good quality.
> 
> //Samuel
> 
> 
> 
> 
> 
> 
> On Mon, Nov 21, 2016 at 3:00 PM, Kumar, Sandeep <[email-masked] <mailto:[email-masked]>> wrote:
> Dear ACE members
> 
>  
> 
> Peter van Stok gave a short overview during the ACE f2f meeting on the work related to EST (RFC 7030) over DTLS secured CoAP (draft-vanderstok-core-coap-est-00 <https://tools.ietf.org/html/draft-vanderstok-core-coap-est-00>). In the meeting there was general interest among the audience for the work and ACE as the preferred WG for this item. There are additional drafts and work on the same topic like the draft-pritikin-coap-bootstrap-01 <https://tools.ietf.org/html/draft-pritikin-coap-bootstrap-01> and the email from Shahid https://www.ietf.org/mail-archive/web/ace/current/msg02029.html <https://www.ietf.org/mail-archive/web/ace/current/msg02029.html>
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/ace <https://www.ietf.org/mailman/listinfo/ace>
> 
>

---

From: "Brian Weis (bew)" <[email-masked]>
Date: Tue, 22 Nov 2016 18:45:51 +0000

I support this work and it being done in ACE.

Thanks,
Brian

On Nov 21, 2016, at 6:00 AM, Kumar, Sandeep <[email-masked]<mailto:[email-masked]>> wrote:

Dear ACE members

Peter van Stok gave a short overview during the ACE f2f meeting on the work related to EST (RFC 7030) over DTLS secured CoAP (draft-vanderstok-core-coap-est-00<https://tools.ietf.org/html/draft-vanderstok-core-coap-est-00>). In the meeting there was general interest among the audience for the work and ACE as the preferred WG for this item. There are additional drafts and work on the same topic like the draft-pritikin-coap-bootstrap-01<https://tools.ietf.org/html/draft-pritikin-coap-bootstrap-01> and the email from Shahidhttps://www.ietf.org/mail-archive/web/ace/current/msg02029.html
The idea is to merge these into a single draft (already discussed among us).

Kind Regards
Sandeep

[email-masked]<mailto:[email-masked]>

--
Brian Weis
Security, CSG, Cisco Systems
Telephone: +1 408 526 4796
Email: [email-masked]<mailto:[email-masked]>