Subject: [Iotops] Fwd: New Version Notification for draft-sweet-iot-acme-01.txt

From: Michael Sweet <[email-masked]>
Date: Thu, 14 Apr 2022 11:34:55 -0400

Updated to use DHCP Option 30 (Vendor-Identifying Vendor Class Option) for prototyping.

> Begin forwarded message:
> 
> From: [email-masked]
> Subject: New Version Notification for draft-sweet-iot-acme-01.txt
> Date: April 14, 2022 at 11:31:08 AM EDT
> To: "Michael Sweet" <[email-masked]>
> 
> 
> A new version of I-D, draft-sweet-iot-acme-01.txt
> has been successfully submitted by Michael Sweet and posted to the
> IETF repository.
> 
> Name:		draft-sweet-iot-acme
> Revision:	01
> Title:		ACME-Based Provisioning of IoT Devices
> Document date:	2022-04-14
> Group:		Individual Submission
> Pages:		10
> URL:            https://www.ietf.org/archive/id/draft-sweet-iot-acme-01.txt
> Status:         https://datatracker.ietf.org/doc/draft-sweet-iot-acme/
> Html:           https://www.ietf.org/archive/id/draft-sweet-iot-acme-01.html
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-sweet-iot-acme
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-sweet-iot-acme-01
> 
> Abstract:
>   This document extends the Automatic Certificate Management
>   Environment (ACME) [RFC8555] to provision X.509 certificates for
>   local Internet of Things (IoT) devices that are accepted by existing
>   web browsers and other software running on End User client devices.
> 
> 
> 
> 
> The IETF Secretariat
> 
> 

________________________
Michael Sweet

---

From: Behcet Sarikaya <[email-masked]>
Date: Fri, 15 Apr 2022 10:13:59 -0500

Hi Michael,

I don't understand why wireless cable modem is an IoT device but lights,
appliances at home are not IoT devices and ACME doesn't seem to apply to
them?

Behcet

On Thu, Apr 14, 2022 at 10:35 AM Michael Sweet <msweet=
[email-masked]> wrote:

> *From: [email-masked]
> *Subject: **New Version Notification for draft-sweet-iot-acme-01.txt*
> *Date: *April 14, 2022 at 11:31:08 AM EDT
> *To: *"Michael Sweet" <[email-masked]>
>
>
> URL:
> https://www.ietf.org/archive/id/draft-sweet-iot-acme-01.txt
> Html:
> https://www.ietf.org/archive/id/draft-sweet-iot-acme-01.html
> --
> Iotops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/iotops
>

---

From: Michael Sweet <[email-masked]>
Date: Fri, 15 Apr 2022 12:50:52 -0400

Behcet,

> On Apr 15, 2022, at 11:13 AM, Behcet Sarikaya <[email-masked]> wrote:
> 
> Hi Michael,
> 
> I don't understand why wireless cable modem is an IoT device but lights, appliances at home are not IoT devices and ACME doesn't seem to apply to them?

Sorry, did I say that?

I do know that the CoRE WG is working on supporting constrained environments (lights, switches, etc.) which might not have the resources for ACME, but nothing in my draft would exclude them.  Most appliances I have experience with manage their own Internet connection (typically setup via a mobile app) that can do ACME.  Switches and lights typically use the Zigbee protocol and depend on a bridge device to provide Internet access, and the bridge device can do ACME.

The focus of my draft is just to define the requirements for a local ACME server, how to discover it, and how to use it to provide a higher level of trust for IoT devices.

________________________
Michael Sweet

---

From: Behcet Sarikaya <[email-masked]>
Date: Mon, 18 Apr 2022 09:47:56 -0500

On Fri, Apr 15, 2022 at 11:50 AM Michael Sweet <[email-masked]> wrote:

> I do know that the CoRE WG is working on supporting constrained
> environments (lights, switches, etc.) which might not have the resources
> for ACME, but nothing in my draft would exclude them.  Most appliances I
> have experience with manage their own Internet connection (typically setup
> via a mobile app) that can do ACME.  Switches and lights typically use the
> Zigbee protocol and depend on a bridge device to provide Internet access,
> and the bridge device can do ACME.
>
> The focus of my draft is just to define the requirements for a local ACME
> server, how to discover it, and how to use it to provide a higher level of
> trust for IoT devices.
>
>
Yes, this is what I understood. But I think the example or use case you
chose defeats it.
Why would I need a certificate of the wireless cable model. just get the IP
address and use it.
So my suggestion is to revise the draft to better keep the focus like you
said above and explain it with a better example.

Behcet