Subject: [core] IETF82 CoRE agenda

From: Carsten Bormann <[email-masked]>
Date: Tue, 1 Nov 2011 23:48:48 +0100

I have uploaded a drafty agenda at:

	http://www.ietf.org/proceedings/82/agenda/core.txt

I mainly tried to cover the drafts we should be looking at -- did I miss any?
The resulting shopping list is still short on objectives for most agenda items.

Those who want to achieve progress on specific drafts -- please send me the objectives for the slot I have put your draft under, and please tell me who will be presenting/leading the discussion.

The agenda is way too full, and I probably even missed a lot of things we also need to do, so we won't keep slots that don't have very specific, credible objectives for this meeting.

I plan to have a v2 agenda out 24 h from now.

Grüße, Carsten

---

From: Kerry Lynn <[email-masked]>
Date: Wed, 2 Nov 2011 19:22:37 -0400

Hi Carsten,

I will be presenting the slides for draft-vanderstok-core-bc-05 on Peter's
behalf and feel it would be better placed adjacent to the Naming and
Discovery discussions on Friday.

Thanks, -K-

On Tue, Nov 1, 2011 at 6:48 PM, Carsten Bormann <[email-masked]> wrote:

> Those who want to achieve progress on specific drafts -- please send me
> the objectives for the slot I have put your draft under, and please tell me
> who will be presenting/leading the discussion.
>
> The agenda is way too full, and I probably even missed a lot of things we
> also need to do, so we won't keep slots that don't have very specific,
> credible objectives for this meeting.
>
> _______________________________________________
> core mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/core
>

---

From: Alper Yegin <[email-masked]>
Date: Thu, 3 Nov 2011 15:49:40 +0200

Folks,

Please note the draft Zach and I produced for securing CoAP.

http://tools.ietf.org/html/draft-yegin-coap-security-options-00

Comments are very welcome.

Alper

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 3 Nov 2011 16:58:54 +0100

> I plan to have a v2 agenda out 24 h from now.

Updated with the info I received so far.

If your draft is listed, but there are no objectives and/or no presenter listed, please get that info to me now, because for v3 I'll have to clean up some drafts from the Friday to make that meeting a bit more realistic schedulewise.

Grüße, Carsten

---

From: "Rahman, Akbar" <[email-masked]>
Date: Mon, 7 Nov 2011 14:27:58 -0500

Hi Carsten,

Do you plan to have an update of the agenda soon?

Akbar

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Carsten Bormann
Sent: Thursday, November 03, 2011 11:59 AM
To: core WG
Subject: Re: [core] IETF82 CoRE agenda

Grüße, Carsten

---

From: "Keoh, Sye Loong" <[email-masked]>
Date: Tue, 8 Nov 2011 13:51:02 +0000

Dear Alper,

While reading your draft, I have the following questions:

1. Since CryptoInitiate Option is sent in clear while negotiating the security context, can the attacker exploit such a message to launch DoS attack? I do understand that even in DTLS, the handshake is performed in clear. Do you think we should consider mitigation strategy used in DTLS to include cookies to detect potential DoS attack?

2. Is my understanding correct that the secret-key used to encrypt the CoAP messages is the PSK itself? Is there any reason for not deriving a session key from the PSK? I am just thinking if the PSK is compromised, this means that all previous communication messages are compromised too.

3. I suggest that the CryptoTerminate Option is protected/MACed in order to ensure that it is originated from the client. Otherwise, any device in the network can spoof this message in order to delete the security context.

Cheers
Sye-Loong

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Alper Yegin
Sent: Thursday 3 November 2011 14:50
To: core WG
Subject: [core] draft-yegin-coap-security

Folks,

Alper

________________________________
The information contained in this message may be confidential and legally protected under applicable law. The message is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and destroy all copies of the original message.

---

From: Zhen Cao <[email-masked]>
Date: Thu, 10 Nov 2011 15:42:47 +0800

Hi Carsten,

The following drafts are related to the topic "mapping"; they are
about how to discover the HTTP-CoAP mapping function component.
	draft-cao-core-pd-00.txt
	draft-he-core-energy-aware-pd-00.txt
	draft-ma-core-dhcp-pd-00.txt

So could you move them to the mapping section? Thank you.

-- 
Best regards,
Zhen

---

From: Alper Yegin <[email-masked]>
Date: Fri, 11 Nov 2011 10:35:36 +0200

Hello Sye-Loong,

> While reading your draft, I have the following questions:

Thanks for the review and feedback.

> 1. Since CryptoInitiate Option is sent in clear while negotiating the security context, can the attacker exploit such a message to launch DoS attack? I do understand that even in DTLS, the handshak…

This sounds reasonable.
Maybe we should even authenticate the end-points at the time of CryptoInitiation. Gotta think about the overhead of doing that…

> 2. Is my understanding correct that the secret-key used to encrypt the CoAP messages is the PSK itself? Is there any reason for not deriving a session key from the PSK? I am just thinking if the PS…

Key management is not handled by this protocol. It's assumed to be handled by an out-of scope mechanism. The task you are raising is for the key management.

> 3. I suggest that the CryptoTerminate Option is protected/MACed in order to ensure that it is originated from the client. Otherwise, any device in the network can spoof this message in order to del…

Makes sense.

Thanks.

Alper

---

From: Behcet Sarikaya <[email-masked]>
Date: Fri, 11 Nov 2011 20:41:02 -0600

Hi Carsten,
  It seems that you forgot to include  the objective for secure
bootstrapping.

Hint. Look at the charter.

Regards,

Behcet

---

From: Carsten Bormann <[email-masked]>
Date: Sun, 13 Nov 2011 10:31:15 +0800

On Nov 12, 2011, at 10:41, Behcet Sarikaya wrote:

>   It seems that you forgot to include  the objective for secure bootstrapping.
> 

Sure, that is what the document is trying to address.

My request for an objective was about the meeting.
I see there are no changes from -02 to -03.
What is it that we want to spend meeting time on?
Please advise.

Grüße, Carsten

---

From: Behcet Sarikaya <[email-masked]>
Date: Sun, 13 Nov 2011 19:50:57 -0600

Hi Carsten,
Yes but it has been revised at lot since last presentation in Beijing a
year ago.
Please see my presentation attached.

Regards,

Behcet

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 15 Nov 2011 17:00:50 +0800

Those who plan to present and haven't sent me your slides -- please do by Wed 0000 UTC (that would 0800 Taipei time).  I want to have a slide set out on the meeting materials site > 24 h before the meeting so the non-native speakers can examine them in time. Thanks.

Grüße, Carsten