Subject: [Ace] greevenbosch-ace-comparison comments

From: Alper Yegin <[email-masked]>
Date: Fri, 13 Mar 2015 19:47:57 +0200

Hello,

I've read  draft-greevenbosch-ace-comparison-01. I'd like to thank the authors for putting this document together and share my following comments:

   An Authentication, Authorization and Accounting (AAA) server may be
   deployed.  Such AAA server is mentioned in [RFC3748], and both RADIUS
   [RFC2865] and Diameter [RFC6733] define AAA servers.  However, the
   authorization in RADIUS and Diameter is not fine grained, it is a
   simple all or nothing question.  Thus, RADIUS and/or Diameter would
   need adaptation to cater for CoAP specific requirements, or a new AAA
   protocol may need to be defined.

Actually, it's a just a matter of defining new attributes/AVPs. Relatively easy. New AAA protocol is not necessary.

   The authentication allows the exchange of cryptographic material.
   After authentication, this material is referred to using the new
   "AUTH" CoAP option.  This AUTH option is only used for integrity
   protection of the related message, encryption is yet to be defined.

We have some (expired) work related to that, FYI:
https://tools.ietf.org/html/draft-yegin-coap-security-options-00 

   The X.509 certificates are authenticated by a certificate authority,
   either net-wide or domain-wide.

This has an administrative issue: Provisioning the public key of the right root CA(s) on the devices.

Regarding greevenbosch-ace-pull-model:

It looks like the Client is not really authenticated. It does send its "ID", but it does not provide any cryptographic proof that it owns that ID. Am I missing something?

Alper