Subject: Re: [Iotops] Secure IoT Bootstrapping: A Survey

From: Carsten Bormann <[email-masked]>
Date: Tue, 30 Mar 2021 13:13:51 +0200

On 2021-02-19, at 16:38, Eliot Lear <[email-masked]> wrote:
> 
> Very well timed.  I look forward to discussing this.

Thanks!

Now would be a good time to get some initial feedback — we plan to adopt it as an RG document on April 6th.

Grüße, Carsten

> 
> Eliot
> 
>> On 19 Feb 2021, at 16:24, Ari Keränen <ari.keranen=[email-masked]> wrote:
>> 
>> Hi IoTOPS folks,
>> 
>> At T2TRG the "Secure IoT Bootstrapping: A Survey" draft has been updated:
>> https://datatracker.ietf.org/doc/draft-sarikaya-t2trg-sbootstrapping/
>> 
>> The draft has been discussed and developed quite some time in the T2TRG and we chairs think it's now getting close to ready for adoption. We would like to hear views on this from the IoT operational community. In particular we'd like to hear if the technologies considered important for security setup and bootstrapping by this group are covered in the document.
>> 
>> 
>> Thanks,
>> Ari & Carsten
>> 
>> --
>> Iotops mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/iotops

---

From: Wouter van der Beek <[email-masked]>
Date: Tue, 30 Mar 2021 12:29:10 +0100

Hi All,

who wrote the OCF section?

Kind Regards,

Wouter

-- 

Wouter van der Beek

Principal Engineer
Cascoda Ltd

*Southampton Office:* 	*Taipei Office:*
  Threefield House
  Threefield Lane
  Southampton
  SO14 3LP
  UK
	 Rm.918, 9F, No.96, Chia Hsin Bldg.
  Sec.2, Zhongshan N.Rd.
  Zhongshan Dist.
  Taipei
  Taiwan
  Tel: +353 852448780 	

_<https://www.cascoda.com><https://twitter.com/cascoda><https://www.linkedin.com/company/cascoda-ltd/><https://www.youtube.com/channel/UCi9zbpSBLnWJ4Xf79NnES4Q>

*Registered Office:* 12-14 Carlton Place, Southampton SO15 2EA, UK
*Registered in England and Wales:* 6174299

*Confidentiality:* This e-mail transmission is strictly confidential and 
intended solely for the addressee. It may contain privileged and 
confidential information and if you are not the intended recipient, you 
must not copy or distribute it. If you have received this e-mail in 
error, please notify the sender and delete the e-mail transmission 
immediately.
*Viruses:* Although we have taken steps to ensure that this e-mail and 
attachments are free from any virus, we advise that in keeping with good 
computing practice the recipient should ensure they are actually virus free.
*Security Warning:* Please note that this e-mail has been created in the 
knowledge that internet e-mail is not a 100% secure communications 
medium. We advise that you understand this lack of security and take any 
necessary measures when e-mailing us.

---

From: Eliot Lear <[email-masked]>
Date: Tue, 30 Mar 2021 13:39:01 +0200

Carsten,

It would be good if the draft incorporated the comparison chart that we developed in our side meetings.  For one thing, there are several key distinctions for comparison:

Network versus Application onboarding
Many of the mechanisms assume network access prior to onboarding.  That’s not good over any wireless method.
Zero-touch versus one-touch deployment
Ownership transfer versus proof of knowledge
First use versus subsequent uses

There are other aspects.

Also, NIST has done a lot of work in this space as of late.  Have a look at this:

https://www.nccoe.nist.gov/projects/building-blocks/iot-network-layer-onboarding <https://www.nccoe.nist.gov/projects/building-blocks/iot-network-layer-onboarding>

Susan Symington (CC’d) is the primary author and has done great work in this space.  It may make sense to use that taxonomy and apply it to the various solutions.

Eliot

> On 30 Mar 2021, at 13:13, Carsten Bormann <[email-masked]> wrote:
>

---

From: Behcet Sarikaya <[email-masked]>
Date: Tue, 30 Mar 2021 10:12:14 -0500

> who wrote the OCF section?

It was introduced in Rev. 08.
I think Mohit wrote it.
Why did you ask?

Behcet

> On 2021-02-19, at 16:38, Eliot Lear <[email-masked]> <[email-masked]> wrote:
>
> On 19 Feb 2021, at 16:24, Ari Keränen <ari.keranen=[email-masked]> <ari.keranen=[email-masked]> wrote:
>
> Hi IoTOPS folks,
>
> At T2TRG the "Secure IoT Bootstrapping: A Survey" draft has been updated:https://datatracker.ietf.org/doc/draft-sarikaya-t2trg-sbootstrapping/
>
> Iotops mailing [email-masked]://www.ietf.org/mailman/listinfo/iotops
>
> --
>
> Wouter van der Beek
>
> Principal Engineer
> Cascoda Ltd
>
> <https://www.cascoda.com> <https://twitter.com/cascoda>
> <https://www.linkedin.com/company/cascoda-ltd/>
> <https://www.youtube.com/channel/UCi9zbpSBLnWJ4Xf79NnES4Q>
>
> must not copy or distribute it. If you have received this e-mail in error,
> please notify the sender and delete the e-mail transmission immediately.
> knowledge that internet e-mail is not a 100% secure communications medium.
> We advise that you understand this lack of security and take any necessary
> measures when e-mailing us.
>

---

From: Wouter van der Beek <[email-masked]>
Date: Tue, 30 Mar 2021 16:21:38 +0100

Frankly, as author I would have reached out to OCF.

I never saw a request in OCF for a review of this text.

for starters current version of specs of OCF is v2.2.2 version 1.0 is a 
long long time ago.

one can also reference the ISO/IEC version 
(https://www.iso.org/standard/74239.html ) that is also way better than 
the v1.0.0 version referenced.

Also the Fairhair spec is not listed in this draft RFC. This document is 
regarded in the building industry as a guiding document.

https://openconnectivity.org/wp-content/uploads/2019/11/fairhair-specification-version-10_approved_april-2019.pdf

Kind Regard,

Wouter

On 30/03/2021 16:12, Behcet Sarikaya wrote:
>
>
> On Tue, Mar 30, 2021 at 6:29 AM Wouter van der Beek 
> <[email-masked] <mailto:[email-masked]>> wrote:
>
>     Hi All,
>
>>     On 2021-02-19, at 16:38, Eliot Lear<[email-masked]>  <mailto:[email-masked]>  wrote:
>>>>     On 19 Feb 2021, at 16:24, Ari Keränen<ari.keranen=[email-masked]>  <mailto:ari.keranen=[email-masked]>  wrote:
>>>>
>>>>     Hi IoTOPS folks,
>>>>
>>>>     https://datatracker.ietf.org/doc/draft-sarikaya-t2trg-sbootstrapping/  <https://datatracker.ietf.org/doc/draft-sarikaya-t2trg-sbootstrapping/>
>>>>
>>>>     [email-masked]  <mailto:[email-masked]>
>>>>     https://www.ietf.org/mailman/listinfo/iotops  <https://www.ietf.org/mailman/listinfo/iotops>
>     -- 
>
>     Wouter van der Beek
>
>     Principal Engineer
>     Cascoda Ltd
>
>     *Confidentiality:* This e-mail transmission is strictly
>     confidential and intended solely for the addressee. It may contain
>     privileged and confidential information and if you are not the
>     intended recipient, you must not copy or distribute it. If you
>     have received this e-mail in error, please notify the sender and
>     delete the e-mail transmission immediately.
>     *Viruses:* Although we have taken steps to ensure that this e-mail
>     and attachments are free from any virus, we advise that in keeping
>     with good computing practice the recipient should ensure they are
>     actually virus free.
>     *Security Warning:* Please note that this e-mail has been created
>     in the knowledge that internet e-mail is not a 100% secure
>     communications medium. We advise that you understand this lack of
>     security and take any necessary measures when e-mailing us.
>
-- 

Wouter van der Beek

Principal Engineer
Cascoda Ltd

---

From: Michael Richardson <[email-masked]>
Date: Tue, 30 Mar 2021 14:39:11 -0400

> adopt it as an RG document on April 6th.

I wonder if having it adopted in IOTOPS might make more sense.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Mohit Sethi M <[email-masked]>
Date: Tue, 30 Mar 2021 19:51:39 +0000

Hi Wouter,

Thank you for the feedback. We will update the reference and the corresponding text for OCF in the next version of the draft.

There are many specifications out there and it may not be possible to cover all of them in a single document. However, I think your pointer to the Fairhair specification is very relevant because of its use of ANIMA and we will add it in the next version of the draft.

Based on your feedback, I have opened 2 issues on the github repository for this draft: https://github.com/t2trg/sbootstrapping/issues.

Perhaps you already know this but I would like to highlight that the research group is currently considering if this draft should be adopted. Adoption does not mean publication. Drafts normally undergo many revisions and reviews before considering publication as an RFC.

--Mohit

On 3/30/21 6:21 PM, Wouter van der Beek wrote:

for starters current version of specs of OCF is v2.2.2 version 1.0 is a long long time ago.

one can also reference the ISO/IEC version (https://www.iso.org/standard/74239.html ) that is also way better than the v1.0.0 version referenced.

Also the Fairhair spec is not listed in this draft RFC. This document is regarded in the building industry as a guiding document.

Kind Regard,

Wouter

On Tue, Mar 30, 2021 at 6:29 AM Wouter van der Beek <[email-masked]<mailto:[email-masked]>> wrote:

Hi All,

Behcet

Kind Regards,

Wouter

On 2021-02-19, at 16:38, Eliot Lear <[email-masked]><mailto:[email-masked]> wrote:

Thanks!

Grüße, Carsten

Eliot

On 19 Feb 2021, at 16:24, Ari Keränen <ari.keranen=[email-masked]><mailto:ari.keranen=[email-masked]> wrote:

Hi IoTOPS folks,

Thanks,
Ari & Carsten

--
Iotops mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/iotops

--

Wouter van der Beek

Principal Engineer
Cascoda Ltd

Southampton Office:     Taipei Office:
 Threefield House
 Threefield Lane
 Southampton
 SO14 3LP
 UK
 Rm.918, 9F, No.96, Chia Hsin Bldg.
 Sec.2, Zhongshan N.Rd.
 Zhongshan Dist.
 Taipei
 Taiwan
 Tel: +353 852448780

[https://www.cascoda.com/wp-content/uploads/2019/03/wordpress_32x32.png]<https://www.cascoda.com>[https://www.cascoda.com/wp-content/uploads/2019/03/twitter_32x32.png]<https://twitter.com/cascoda>[https://www.cascoda.com/wp-content/uploads/2019/03/linkedin_32x32.png]<https://www.linkedin.com/company/cascoda-ltd/>[https://www.cascoda.com/wp-content/uploads/2019/03/youtube_32x32.png]<https://www.youtube.com/channel/UCi9zbpSBLnWJ4Xf79NnES4Q>

Registered Office: 12-14 Carlton Place, Southampton SO15 2EA, UK
Registered in England and Wales: 6174299

Confidentiality: This e-mail transmission is strictly confidential and intended solely for the addressee. It may contain privileged and confidential information and if you are not the intended recipient, you must not copy or distribute it. If you have received this e-mail in error, please notify the sender and delete the e-mail transmission immediately.
Viruses: Although we have taken steps to ensure that this e-mail and attachments are free from any virus, we advise that in keeping with good computing practice the recipient should ensure they are actually virus free.
Security Warning: Please note that this e-mail has been created in the knowledge that internet e-mail is not a 100% secure communications medium. We advise that you understand this lack of security and take any necessary measures when e-mailing us.

--

Wouter van der Beek

Principal Engineer
Cascoda Ltd

Southampton Office:     Taipei Office:
 Threefield House
 Threefield Lane
 Southampton
 SO14 3LP
 UK
 Rm.918, 9F, No.96, Chia Hsin Bldg.
 Sec.2, Zhongshan N.Rd.
 Zhongshan Dist.
 Taipei
 Taiwan
 Tel: +353 852448780

[https://www.cascoda.com/wp-content/uploads/2019/03/wordpress_32x32.png]<https://www.cascoda.com>[https://www.cascoda.com/wp-content/uploads/2019/03/twitter_32x32.png]<https://twitter.com/cascoda>[https://www.cascoda.com/wp-content/uploads/2019/03/linkedin_32x32.png]<https://www.linkedin.com/company/cascoda-ltd/>[https://www.cascoda.com/wp-content/uploads/2019/03/youtube_32x32.png]<https://www.youtube.com/channel/UCi9zbpSBLnWJ4Xf79NnES4Q>

Registered Office: 12-14 Carlton Place, Southampton SO15 2EA, UK
Registered in England and Wales: 6174299

Confidentiality: This e-mail transmission is strictly confidential and intended solely for the addressee. It may contain privileged and confidential information and if you are not the intended recipient, you must not copy or distribute it. If you have received this e-mail in error, please notify the sender and delete the e-mail transmission immediately.
Viruses: Although we have taken steps to ensure that this e-mail and attachments are free from any virus, we advise that in keeping with good computing practice the recipient should ensure they are actually virus free.
Security Warning: Please note that this e-mail has been created in the knowledge that internet e-mail is not a 100% secure communications medium. We advise that you understand this lack of security and take any necessary measures when e-mailing us.

_______________________________________________
T2TRG mailing list
[email-masked]<mailto:[email-masked]>
https://www.irtf.org/mailman/listinfo/t2trg

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 30 Mar 2021 22:11:46 +0200

> I wonder if having it adopted in IOTOPS might make more sense.

Certainly — addressing that might be part of that feedback.
It appears to me that the document would be covered by its charter, even if "Taking input and discussing issues” is not that well-defined an activity.
It is not clear to me whether working on this in the WG would give the document a new spin, beyond its current approach as a survey, and whether that would actually be a welcome change to the authors and consumers of that document.
Input from WG members and leadership could help understand this.

Grüße, Carsten

---

From: Mohit Sethi M <[email-masked]>
Date: Tue, 30 Mar 2021 20:54:01 +0000

Dear Carsten, Michael,

> Input from WG members and leadership could help understand this.

Speaking for myself: I feel that such a survey document is better-suited 
for a research group (RG) rather than a working group (WG). It would be 
in line with the previous security document from T2TRG: "Internet of 
Things (IoT) Security: State of the Art and Challenges" 
(https://tools.ietf.org/html/rfc8576). I am not fundamentally opposed to 
pursuing this in IoTops but I feel that perhaps an evolution of this 
document (Carsten writes about a new spin) in the near future would be 
more suitable for IoTops. I am of course interested in contributing to 
that potential future document as well.

--Mohit