Subject: Re: [lp-wan] WGLC on LPWAN Overview draft

From: Russ Housley <[email-masked]>
Date: Wed, 21 Jun 2017 17:40:28 -0400

Section 2.1.2 talks about three symmetric keys that are used with AES.  The text explains how the keys are used, but it would be helpful to add this to the tables:
  NwkSKey : 128-bit network session key used with AES-CMAC
  AppSKey : 128-bit application session key used with AES-CTR
  AppKey  : 128-bit long term application key used with AES-ECB

Section 2.2.2 tells us that the Packet Data Convergence Protocol (PDCP) provides ciphering and integrity protection.Unlike the earlier section, we do not learn anything about the source of the keys for these cryptographic operations or the modes that are used.  A quick look at the 3GPP document tells me that PDCP is configured by upper layers, which leads to more documents.  So, these answers are not trivial to find, but if they are known it would be useful to include them here.

Section 2.3.2 does not talk about encryption, so I assume that the messages are always in the clear.  However, the section does talk about a message authentication code.  The section does not say anything about the source of the authentication keys or the authentication algorithm.  If they are known it would be useful to include them here.

Section 2.4.2 tells us that security is based on 802.1X and 802.11i.  Does the Wi-SUN Alliance require a particular public key algorithm for use with EAP-TLS?  Does 802.11i mean that AES-CCM is used for encryption and integrity?

Section 4.1 observes that "cryptographic protocols such as IPsec and TLS, in addition to the round-trips required for secure session establishment, cryptographic operations can require padding and addition of authenticators that are problematic when considering LPWAN lower layers.”  However,  the Wi-SUN Alliance seems to use 802.1X with EAP-TLS.  This is quite different than the other three example LP WANs.  How does the gap analysis address this situation?

Nits

Section 2.1.2:
  s/described below../described below./
  s/AEs-encrypt operation/AES-encrypt operation/

> Date: Mon, 19 Jun 2017 21:29:05 +0200
> From: Alexander Pelov <[email-masked]>
> To: [email-masked]
> Subject: [lp-wan] WGLC on LPWAN Overview draft
> 
> Dear all,
> 
> As discussed during the last interim, we are starting a WGLC on the 
> LPWAN Overview document:
> 
> https://tools.ietf.org/html/draft-ietf-lpwan-overview-04
> 
> 
> There should be no issues with the document at this stage, but please, 
> DO review the document now and DO provide your comments and remarks if 
> you see any issues.
> 
> The WGCL will end in two weeks, on July 3rd, 2017, 23h55 CEST.
> 
> Best,
> Pascal and Alexander

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 21 Jun 2017 23:15:35 +0100

Thanks Russ, good questions. I'm fine with making the change in 2.1.2
(as I contributed that text). For the others, I hope folks who know
those technologies will chime in. (If not, I'll chase 'em but I hope
they do:-)

Cheers,
S.

On 21/06/17 22:40, Russ Housley wrote:
> _______________________________________________
> lp-wan mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/lp-wan
>

---

From: Paul Duffy <[email-masked]>
Date: Wed, 21 Jun 2017 18:18:55 -0400

On 6/21/2017 5:40 PM, Russ Housley wrote:
> Section 2.4.2 tells us that security is based on 802.1X and 802.11i.  Does the Wi-SUN Alliance require a particular public key algorithm for use with EAP-TLS?

TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 is required

>   Does 802.11i mean that AES-CCM is used for encryption and integrity?

Not quite

Frame security is implemented as AES-CCM* as spec-ed in IEEE 802.15.4

---

From: Paul Duffy <[email-masked]>
Date: Wed, 21 Jun 2017 18:21:19 -0400

On 6/21/2017 5:40 PM, Russ Housley wrote:
> However,  the Wi-SUN Alliance seems to use 802.1X with EAP-TLS.  This is quite different than the other three example LP WANs.  How does the gap analysis address this situation?

Mains powered Wi-SUN mesh router nodes will typically be more resource 
capable than the other LPWAN techs discussed.