Subject: [core] Security use cases for CoRE

From: Ludwig Seitz <[email-masked]>
Date: Mon, 25 Nov 2013 12:28:41 +0100

Hello,

as those of you who attended IETF88 might remember, I am working on a 
draft on CoRE security use cases [1] with a group of interested people 
from this WG.

The current structure of the draft contains usecases for general 
communication security, DoS prevention, authentication as well as 
authorization.

In an offline discussion it has been suggested that the use cases for 
commSec and authentication are well understood by CoRE and mostly 
covered by the work of DICE. It was therefore suggested to focus on 
authorization use cases.

I'd like to solicit the opinion of the WG on this matter, especially 
since we aim to get this draft accepted as (informational) working group 
document at some point.

tl;dr : Should [1] be about authorization use cases only?

Regards,

Ludwig Seitz

[1] draft-seitz-core-sec-usecases-00

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: Sandeep Kumar <[email-masked]>
Date: Mon, 25 Nov 2013 13:37:25 +0100

Hi Ludwig

Maybe the goals you want to achieve with this document can help the
decision.

If the goal is to identify the missing pieces of the IoT security puzzle,
then capturing all different possible security use cases from the IoT makes
sense. Authorization being only one of the missing pieces.  CommSec and
authentication are not the missing pieces, the lifecycle management of
these protocols yes. So usecases that only provides a reaffirmation for
Section 9 of draft-ietf-core-coap or the DICE wg charter are not really
worthwhile.

However if the goal is to identify why authorization is indeed something
that needs to be solved and additionally why it needs to be solved in
core/ietf, then I would say focus on authorization usecases. From the
Berlin meeting, I remember that this was indeed the start of the "writing
down the usecases" discussion.

Even though I like the first goal, the focus in the second goal will help
get something done more useful with the authorization drafts in the short
term.

That's my two cents
Sandeep

On Mon, Nov 25, 2013 at 12:28 PM, Ludwig Seitz <[email-masked]> wrote:

> draft on CoRE security use cases [1] with a group of interested people from
> this WG.
>
> commSec and authentication are well understood by CoRE and mostly covered
> by the work of DICE. It was therefore suggested to focus on authorization
> use cases.
>
> I'd like to solicit the opinion of the WG on this matter, especially since
> we aim to get this draft accepted as (informational) working group document
> at some point.
>
>
> _______________________________________________
> core mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/core
>
>

---

From: Rene Struik <[email-masked]>
Date: Mon, 25 Nov 2013 08:19:47 -0500

Hi Ludwig:

Authorization can only be enforced via proper authentication mechanisms, 
so I do expect any description of the former to refer to the latter.

Rene

On 11/25/2013 6:28 AM, Ludwig Seitz wrote:
> since we aim to get this draft accepted as (informational) working 
> group document at some point.
>
>

-- 
email: [email-masked] | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363

---

From: Stefanie Gerdes <[email-masked]>
Date: Mon, 25 Nov 2013 15:08:28 +0100

> so I do expect any description of the former to refer to the latter.

+1

Best regards,
Steffi

---

From: Göran Selander <[email-masked]>
Date: Mon, 25 Nov 2013 14:25:39 +0000

Hi all,

From: Rene Struik <[email-masked]<mailto:[email-masked]>>
Date: Monday, November 25, 2013 2:19 PM
To: Ludwig Seitz <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [core] Security use cases for CoRE

Hi Ludwig:

Authorization can only be enforced via proper authentication mechanisms, so I do expect any description of the former to refer to the latter.

[Göran] Agree, and it may not restrict access appropriately to only authenticate and authorize, if you transport the response in plain text. So communication security may also be a derived requirement to support authorization. This is not claiming that there would be any new authentication or communication security requirements, but the fact that authentication and communication security is required implies e.g. the need for certain key management, which we have seen is not fully covered in CoAP and DICE.

Best regards,
Göran

---

From: Bert Greevenbosch <[email-masked]>
Date: Tue, 26 Nov 2013 00:30:43 +0000

+1, authentication is essential for authorisation.

From: core [mailto:[email-masked]] On Behalf Of Rene Struik
Sent: 25 November 2013 21:20
To: Ludwig Seitz; [email-masked]
Subject: Re: [core] Security use cases for CoRE

Hi Ludwig:

Rene

as those of you who attended IETF88 might remember, I am working on a draft on CoRE security use cases [1] with a group of interested people from this WG.

The current structure of the draft contains usecases for general communication security, DoS prevention, authentication as well as authorization.

In an offline discussion it has been suggested that the use cases for commSec and authentication are well understood by CoRE and mostly covered by the work of DICE. It was therefore suggested to focus on authorization use cases.

I'd like to solicit the opinion of the WG on this matter, especially since we aim to get this draft accepted as (informational) working group document at some point.

Regards,

Ludwig Seitz

core mailing list

[email-masked]<mailto:[email-masked]>

--

email: [email-masked]<mailto:[email-masked]> | Skype: rstruik

---

From: Likepeng <[email-masked]>
Date: Tue, 26 Nov 2013 01:18:58 +0000

>authentication is essential for authorization

+1.

>we aim to get this draft accepted as (informational) working group document at some point.

I believe a separate WG is more appropriate for this item, since we have a lot of security issues and we really need the help from security area experts and we need more new energies for this area.

Thanks,
Kind Regards
Kepeng

发件人: core [mailto:[email-masked]] 代表 Bert Greevenbosch
发送时间: 2013年11月26日 8:31
收件人: Rene Struik; Ludwig Seitz; [email-masked]
主题: Re: [core] Security use cases for CoRE

From: core [mailto:[email-masked]] On Behalf Of Rene Struik
Sent: 25 November 2013 21:20
To: Ludwig Seitz; [email-masked]<mailto:[email-masked]>
Subject: Re: [core] Security use cases for CoRE

Hi Ludwig:

Rene

Regards,

Ludwig Seitz

core mailing list

--

---

From: Barry Leiba <[email-masked]>
Date: Mon, 25 Nov 2013 22:03:46 -0500

> I believe a separate WG is more appropriate for this item, since we have a
> lot of security issues and we really need the help from security area
> experts and we need more new energies for this area.

For what it's worth, your responsible AD thinks so, too.  I would much
rather see a working group chartered to do this in the Security Area
(though I could accept it in the Applications Area is I were assured
there'd be enough Sec Area participation).

The reason I want it to be separate is to focus the security work and
to provide a place for the Sec Area participants to engage without
their having to sift through the other CORE protocol discussions.

Barry, Applications AD

---

From: "weigengyu" <[email-masked]>
Date: Tue, 26 Nov 2013 11:46:34 +0800

I agree to discuss in a separate WG too.

It is easy to see that the security requirements as OMA LWMAN docs are far 
more than that defined in CoAP Charter.

Gengyu

Network Technology Center
School of Computer
Beijing University of Posts & Telecommunications

-----原始邮件----- 
From: Barry Leiba
Sent: Tuesday, November 26, 2013 11:03 AM
To: [email-masked]
Subject: Re: [core] Security use cases for CoRE

Barry, Applications AD

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 26 Nov 2013 08:27:43 +0100

> there'd be enough Sec Area participation).

Maybe this is a hint that this document is creeping away from being a “use cases” document.

But indeed, solution work would benefit from being in its own WG with considerable Security Area attention.
If we want a BOF in London, we have to start now preparing.

Grüße, Carsten

---

From: Likepeng <[email-masked]>
Date: Tue, 26 Nov 2013 08:59:02 +0000

>Maybe this is a hint that this document is creeping away from being a “use cases” document.

I mean, authentication and authorization as a whole, not just the use case document.

>If we want a BOF in London, we have to start now preparing.

Yes, sure. I would be quite happy to work together with interested parties towards this direction.

Thanks,

Kind Regards
Kepeng

-----邮件原件-----
发件人: core [mailto:[email-masked]] 代表 Carsten Bormann
发送时间: 2013年11月26日 15:28
收件人: [email-masked]
主题: Re: [core] Security use cases for CoRE

On 26 Nov 2013, at 04:03, Barry Leiba <[email-masked]> wrote:

>> I believe a separate WG is more appropriate for this item, since we 
>> have a lot of security issues and we really need the help from 
>> security area experts and we need more new energies for this area.
> 

Grüße, Carsten

---

From: Nicolas Damour <[email-masked]>
Date: Tue, 26 Nov 2013 01:50:31 -0800

Hello.

I may be swimming against the current here, so I’m sorry to be a little iconoclast here (and if I am wrong, please accept my apologies in advance).
I would say that from a strict theoretical point of view, authorization does absolutely not require authentication.

A very simple example in the physical world is access to a safe in some (possibly Swiss) banks.
As long as you have the key (or passcode), you can get access to the safe.
And no one will ever ask you for your identity.
As a matter of fact, in some of these cases it is absolutely essential that authorization happens with no form of authentication whatsoever.

In the IT world, it’s quite the same.
An application could access a service by displaying some sort of credential, while never authenticating itself.
I believe that OAuth, for example, does provide that sort of mechanism.

Now, of course there is value in authentication as well.

But I would think that to say that authorization requires authentication is plainly wrong.

Just my two cents,

Nicolas.

Nicolas DAMOUR :: Senior Manager, Business and Innovation Development
SIERRA WIRELESS :: CTO Office
Phone +33 (0) 670 706 003
Lake Park - ZAC de l'Hers - Allée du Lac - BP 87216 :: 31672 Labège Cedex :: France
[email-masked]<mailto:[email-masked]> :: www.sierrawireless.com<http://www.sierrawireless.com/>

De : core [mailto:[email-masked]] De la part de Likepeng
Envoyé : mardi 26 novembre 2013 02:19
À : Bert Greevenbosch; Rene Struik; Ludwig Seitz; [email-masked]
Objet : Re: [core] Security use cases for CoRE

+1.

Thanks,
Kind Regards
Kepeng

发件人: core [mailto:[email-masked]] 代表 Bert Greevenbosch
发送时间: 2013年11月26日 8:31
收件人: Rene Struik; Ludwig Seitz; [email-masked]<mailto:[email-masked]>
主题: Re: [core] Security use cases for CoRE

Hi Ludwig:

Rene

Regards,

Ludwig Seitz

core mailing list

--

---

From: Ludwig Seitz <[email-masked]>
Date: Tue, 26 Nov 2013 11:26:42 +0100

On 11/26/2013 10:50 AM, Nicolas Damour wrote:
> Hello.
>
> I may be swimming against the current here, so I’m sorry to be a little
> iconoclast here (and if I am wrong, please accept my apologies in advance).
>
> I would say that from a strict theoretical point of view, authorization
> does _absolutely not_ require authentication.
>
> As a matter of fact, in some of these cases it is absolutely essential
> that authorization happens with no form of authentication whatsoever.
>
> An application could access a service by displaying some sort of
> credential, while never authenticating itself.
>

You are not really swimming against the current, I recall making a very 
similar remark to Rene during IETF88.

However even for anonymous authorization there needs to be some binding 
between the authorization and the subject exercising it. It might be 
something as simple as possession of an authZ token (with all the 
negative security implications) or something as complicated as a 
pseudonym with linked public key and a trusted third party as an 
identity escrow agent to prevent abuses.

My stance is that there is a relevant number of use cases where 
authentication is required in order to perform meaningful authorization 
and some use cases where anonymous authorization is needed.

tl;dr: Sometimes we need authN for authZ.

/Ludwig

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: Sandeep Kumar <[email-masked]>
Date: Tue, 26 Nov 2013 12:06:36 +0100

+1

However the question is if we know of any IoT scenario that requires
anonymous credentials?

regards
Sandeep

On Tue, Nov 26, 2013 at 10:50 AM, Nicolas Damour <[email-masked]
> wrote:

> does *absolutely not* require authentication.
>
>
>
> *Nicolas DAMOUR :: Senior Manager, Business and Innovation Development*
>
> *SIERRA WIRELESS :: CTO Office*
>
> [email-masked] :: www.sierrawireless.com
>
>
>
> *De :* core [mailto:[email-masked]] *De la part de* Likepeng
> *Envoyé :* mardi 26 novembre 2013 02:19
> *À :* Bert Greevenbosch; Rene Struik; Ludwig Seitz; [email-masked]
> *Objet :* Re: [core] Security use cases for CoRE
>
>
>
> *发件人**:* core [mailto:[email-masked] <[email-masked]>] *代表 *Bert
> Greevenbosch
> *发送时间**:* 2013年11月26日 8:31
> *收件人**:* Rene Struik; Ludwig Seitz; [email-masked]
> *主题**:* Re: [core] Security use cases for CoRE
>
>
>
> *From:* core [mailto:[email-masked] <[email-masked]>] *On
> Behalf Of *Rene Struik
> *Sent:* 25 November 2013 21:20
> *To:* Ludwig Seitz; [email-masked]
> *Subject:* Re: [core] Security use cases for CoRE
>
>
>
> Hi Ludwig:
>

---

From: Stefanie Gerdes <[email-masked]>
Date: Tue, 26 Nov 2013 15:01:42 +0100

Hi,

> As a matter of fact, in some of these cases it is absolutely essential that authorization happens with no form of authentication whatsoever.

I think your bank example is still authentication. The definition in RFC
4949 states that authentication is "The process of verifying a claim
that a system entity or system resource has a certain attribute value."

This means that you are not necessarily verifying the identity of a
subject but verify a certain attribute of the subject, e.g. if it has a
certain key.

If we want to distinguish entities and give different access rights to
different entities we will always need authentication. Without
authentication we can only grant the same access rights to every entity.

Best regards,
Steffi

---

From: Barry Leiba <[email-masked]>
Date: Tue, 26 Nov 2013 12:33:31 -0500

> As a matter of fact, in some of these cases it is absolutely essential that
> authorization happens with no form of authentication whatsoever.

As Stephanie says, this is still authentication: the key or passcode
is the authentication credential/token.

If you need this sort of use case, then you need to make sure the
authentication options allow it.  But you *are* authenticating.

Barry

---

From: Nicolas Damour <[email-masked]>
Date: Wed, 27 Nov 2013 02:17:00 -0800

Thanks Stefanie for your explanation.

I see that my understanding of authentication was too restricted (restricted to the identity), and I can only agree with you :)

Nicolas.

-----Message d'origine-----
De : core [mailto:[email-masked]] De la part de Stefanie Gerdes
Envoyé : mardi 26 novembre 2013 15:02
À : [email-masked]
Objet : Re: [core] Security use cases for CoRE

Hi,

I think your bank example is still authentication. The definition in RFC
4949 states that authentication is "The process of verifying a claim that a system entity or system resource has a certain attribute value."

This means that you are not necessarily verifying the identity of a subject but verify a certain attribute of the subject, e.g. if it has a certain key.

If we want to distinguish entities and give different access rights to different entities we will always need authentication. Without authentication we can only grant the same access rights to every entity.

Best regards,
Steffi