Subject: [Ace] Review/comments on draft-ietf-ace-actors-03

From: Robin Wilton <[email-masked]>
Date: Tue, 8 Mar 2016 19:17:43 +0000

Hi everyone,

As promised in Yokohama (and thank you to Hannes for the nudge) here are some comments on this ID (attached in Microsoft proprietary and .txt format; I hope that the revision markings and comments survive in at least one of those formats, but let me know if not.

A couple of over-all remarks: I think this is a really good draft and a useful piece of work. It sets out a clear conceptual model, and should make it easier to design systems that do a better job of delivering effective, manageable security mechanisms to constrained devices. That’s not to say the problems in doing so will be small, by the way ;^)  .

In terms of document structure, I note that sections 7 and 8 really give the high level problem statement and requirements… so the detailed technical architecture comes first, which is interesting. Not necessarily a problem, but it does mean readers are somewhat thrown in at the deep end.

I have made some “editorial” (as opposed to technical) changes, but these are mostly just for style and clarity. Generally I found the document to be very clear and readable… certainly immeasurably better than anything I would be able to achieve in German or Swedish.

I also made some technical comments (particularly about PKI and key management implications). While at Gartner I did some research into PKI deployments, and much of that had to do with constrained devices (including where the constraint is simply that the device is bolted to a telegraph pole, 500 kilometres from anything else, in the middle of Saskatchewan…). In general, our finding was that PKIs work best when they are kept away from the user. However, in insulating them from user interference, you introduce a requirement for much better remote management, which most deployments either don’t provide, or do badly. I think ACE has an opportunity to lay the foundations for better solutions to that set of problems.

If you have any questions or meta-comments about my comments, please just let me know.

Best wishes,

Robin

Robin Wilton
Technical Outreach Director - Identity and Privacy
Internet Society

email: [email-masked]
Phone: +44 705 005 2931
Twitter: @futureidentity