Subject: [core] Comments on Bootstrapping

From: Robert Moskowitz <[email-masked]>
Date: Wed, 28 Jul 2010 11:27:00 +0200

I suspect we will NOT have time to comment on Bootstrapping, so I will 
put SOME comments here.

I HAVE read draft-oflynn-core-bootstrapping-01; during the beginning of 
this session :)

Organization:

talk about MAC and IPv6 bootstapping, or IPv6 only.  Perhaps a nod to 
OTHERS like USB.

Security:

Well I have opinions and contributions here.

One thing is that Security is NOT state-free, unless you are willing to 
pay the price for Public Key operations on EVERY packet.  But then there 
ARE other pieces of state below the application, like wireless 
Association, so perhaps this is 'understood'.

I was asked in my 6lowpan presentation on HIP-DEX if it could work 
within TLS.  I got 2 minutes of Rescorla's time this morning and 
confirmed a few things I figured out.  A quick approach is via RFC 4279 
with pre-shared keys for TLS, there are a few things to specify like how 
to know if there is HIP SA already in place and to get the Pair-wise SA 
information, and how to trigger a HIP rekey when needed, or learn that 
HIP WAS rekeyed under you.

For 802.15.4 devices (and 802.11 and some others), there is a need to 
define an AES-CCM cipher for TLS, including the size of the MAC (and any 
AAD).

The last part would be a HIP Parameter similar to ESP_TRANSFORM in RFC 
5202; perhaps like TLS_TRANSFORM.

There are other aspects of security within bootstrap that I can help frame.

---

From: Paul Duffy <[email-masked]>
Date: Wed, 28 Jul 2010 12:24:22 -0400

> define an AES-CCM cipher for TLS, including the size of the MAC (and 
> any AAD).

FYI already in progress ...  
http://tools.ietf.org/html/draft-mcgrew-tls-aes-ccm-00

---

From: Robert Moskowitz <[email-masked]>
Date: Wed, 28 Jul 2010 20:56:19 +0200

> http://tools.ietf.org/html/draft-mcgrew-tls-aes-ccm-00

Yes, I just found this out from the security ADs this evening.  Come to 
the TLS meeting, the same time as ROLL, and put in words for support.

Of course this is ccm, NOT ccm*.  How much of an issue will that be?