Subject: Re: [6lo] FW: I-D Action: draft-ietf-6lo-plc-03.txt

From: "Liubing (Remy)" <[email-masked]>
Date: Mon, 8 Jun 2020 03:51:20 +0000

Hello Michael,

Thank you for helping us improving the draft, especially the security considerations.

Best regards.
Remy

-----邮件原件-----
发件人: Michael Richardson [mailto:[email-masked]] 
发送时间: 2020年6月7日 7:16
收件人: Liubing (Remy) <[email-masked]>
抄送: [email-masked]; Carles Gomez Montenegro <[email-masked]>
主题: Re: 答复: 答复: [6lo] FW: I-D Action: draft-ietf-6lo-plc-03.txt

Liubing (Remy) <[email-masked]> wrote:
    > Thank you for your suggestion. I prefer not to include
    > [I-D.ietf-anima-bootstrapping-keyinfra], since it is not as directly
    > related to PLC as [I-D.ietf-6tisch-dtsecurity-zerotouch-join]. How
    > about make a very brief explanation just like you made for
    > [I-D.ietf-6tisch-minimal-security]?

    > I post the second paragraph of the security considerations
    > below. Please tell me your opinion. Thank you.

I like it, thank you.

    > Malicious PLC devices could paralyze the whole network via DOS attacks,
    > e.g., keep joining and leaving the network frequently, or multicast
    > routing messages containing fake metrics. A device may also join a
    > wrong or even malicious network, exposing its data to illegal
    > users. Mutual authentication of network and new device can be conducted
    > during the onboarding process of the new device. Methods include
    > protocols such as [RFC7925] (exchanging pre-installed certificates over
    > DTLS), [I-D.ietf-6tisch-minimal-security] (which uses pre-shared keys),
    > and [I-D.ietf-6tisch-dtsecurity-zerotouch-join] (which uses IDevID and
    > MASA service). It is also possible to use EAP methods such as
    > [I-D.ietf-emu-eap-noob] via transports like PANA [RFC5191]. No specific
    > mechanism is specified by this document as an appropriate mechanism
    > will depend upon deployment circumstances. The network encryption key
    > appropriate for the layer-2 can also be acquired during the onboarding
    > process.

--
Michael Richardson <[email-masked]>, Sandelman Software Works  -= IPv6 IoT consulting =-