Subject: [core] RawPublicKeys

From: Alper Yegin <[email-masked]>
Date: Thu, 17 Nov 2011 17:22:50 +0200

D.2.  Provisioning

   The RawPublicKey mode was designed to be easily provisioned in M2M
   deployments.  It is assumed that each device has an appropriate
   asymmetric public key pair installed, and the identity of that public
   key has been calculated as described in Appendix D.1.  During
   provisioning, the identity of each node is collected, for example by
   reading a barcode on the outside of the device or by obtaining a pre-
   compiled list of the identities.  These identities are then installed
   in the corresponding end-point, for example an M2M data collection
   server.  The identity is used for two purposes, to associate the end-
   point with further device information and to perform access control.
   During provisioning, an access control list of identities the device
   may start DTLS sessions with SHOULD also be installed.

The above text explains how the network node authenticates/authorizes the device.
But, how does the device authenticate/authorize the network node? For that, the "identity" of the network node's public key needs to be known to the device. But how?

Alper

---

From: Rene Struik <[email-masked]>
Date: Thu, 17 Nov 2011 10:50:40 -0500

Dear colleagues:

Alper's question definitely has merit. I have another one, though:

Having public-key derived identities printed on a device presumes that a
device's public key will never change over its lifecycle. Moreover, it
assumes that the public key is available prior to printing the bar code.

Could you please explain how this would work from a lifecycle
perspective? (chip production, module manuacturing, public key
"registration", "certification", "revocation", etc.)
[Note - even if public keys are not certified by a CA using a
certificate, one should still consider
registration/certification/revocation, aspects]

These devices are assumed to have no trusted platform on board. What if
someone else clones a device, produces a million copies, and pollutes
the market place this way (one of the scenarios described in
draft-garcia-core-security-03 (Section 3.1)). It seems that one is just
out of luck then.

>From the text in Appendix D.1 it seems one just hashes bare public keys,
without any policy oriented info or time validity period. How does this
relate to security policies? What are those policies?

Rene

On 17/11/2011 10:22 AM, Alper Yegin wrote:
>    key has been calculated as described in Appendix D.1 <http://tools.ietf.org/html/draft-ietf-core-coap-08#appendix-D.1>.  During
> But, how does the device authenticate/authorize the network node? For
> that, the "identity" of the network node's public key needs to be
> known to the device. But how?
>
> Alper
>
>
> _______________________________________________
> core mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/core

-- 
email: [email-masked]
Skype: rstruik
cell: +1 (647) 867-5658
USA Google voice: +1 (415) 690-7363

---

From: Carsten Bormann <[email-masked]>
Date: Fri, 18 Nov 2011 01:15:37 +0800

> But, how does the device authenticate/authorize the network node? For that, the "identity" of the network node's public key needs to be known to the device. But how?

Hi Alper,

what is a "network node" in the context of CoAP?
(I read "device" to include both the client and server roles, so from the point of CoAP, there is nothing else.  But maybe I'm missing something here.)

Grüße, Carsten

---

From: Alper Yegin <[email-masked]>
Date: Fri, 18 Nov 2011 03:21:34 +0200

Hi Carsten,

> (I read "device" to include both the client and server roles, so from the point of CoAP, there is nothing else.  But maybe I'm missing something here.)

In the context of a "home deployment" for example, the network node is the home gateway that one needs to configure when bringing in a new device to home. ACL on the home gateway needs to be updated with the device ID for access control. But this is just one side of the story. The other side is, how does the new device identify the network (the home gateway)?