Subject: [core] Next steps for coap-tcp-tls

From: Brian Raymor <[email-masked]>
Date: Fri, 18 Nov 2016 07:06:59 +0000

As editor, my aspiration is to publish coap-tcp-tls-06 for a second WGLC between December 16-19th. I have editorial issues to address and a few minor normative issues that I'll raise on the mailing list. The main blocking point is https://github.com/core-wg/coap-tcp-tls/issues/11. We need to find a way to quickly move forward and reach rough consensus.

Here is my plan that I've reviewed with Jaime and others:

Following the CoRE WG meeting on Wednesday, I've had several conversations with people who needed to consult with their organizations before sharing positions on this issue. Please share details about your concrete positions and deployment plans/models (if possible) on the mailing list as soon as possible. Remember that many people did not hear the microphone discussions on Wednesday - so this is an opportunity to educate the WG. (I appreciate that we're travelling and then there is a holiday week for the US participants. Do the best you can.)

My perception was that some of the discussion on Wednesday was not focused on CoAP+TCP and its scenarios. Please ensure that you're addressing this specific case rather than constrained devices in general or CoAP+UDP. Also, remember that we all share the same goals even if we're proposing different solutions - to ensure that CoAP+TCP addresses these guidelines (which are the best we have now):

Security Challenges For the Internet Of  Things<https://www.iab.org/wp-content/IAB-uploads/2011/03/Turner.pdf> (2011):

It is essential that IoT protocol suites specify a mandatory to implement but optional to use security solution. This will ensure security is available in all implementations, but configurable to use when not necessary (e.g., in closed environment).

I'll use your information and RFC7252 as a starting point for a pull request. I plan to schedule a conference call with Hannes, Juan Perez, and Göran Selander (or Francesca Palombini) late in the week of December 5th based on availability. We'll iterate on the pull request and then present to the broader working group for review during the week of December 12th.

Thanks,

...Brian

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 18 Nov 2016 08:10:27 +0100

Hi Brian,

your proposal to start with RFC7252 as a starting point but I am
wondering why there is a need for a second WGLC. Normally, we just take
the feedback from the WGLC, incorporate it into the document and then
send it to the IESG (if the WGLC comments are not dramatic).

Ciao
Hannes

On 11/18/2016 08:06 AM, Brian Raymor wrote:
>  
> 
> As editor, my aspiration is to publish coap-tcp-tls-06 for a second WGLC
> between December 16-19th. I have editorial issues to address and a few
> minor normative issues that I’ll raise on the mailing list. The main
> blocking point is https://github.com/core-wg/coap-tcp-tls/issues/11. We
> need to find a way to quickly move forward and reach rough consensus.
> 
>  
> 
> Following the CoRE WG meeting on Wednesday, I've had several
> conversations with people who needed to consult with their organizations
> before sharing positions on this issue. Please share details about your
> concrete positions and deployment plans/models (if possible) on the
> mailing list as soon as possible. Remember that many people did not hear
> the microphone discussions on Wednesday - so this is an opportunity to
> educate the WG. (I appreciate that we're travelling and then there is a
> holiday week for the US participants. Do the best you can.)
> 
>  
> 
> My perception was that some of the discussion on Wednesday was not
> focused on CoAP+TCP and its scenarios. Please ensure that you’re
> addressing this specific case rather than constrained devices in general
> or CoAP+UDP. Also, remember that we all share the same goals even if
> we’re proposing different solutions – to ensure that CoAP+TCP addresses
> these guidelines (which are the best we have now):
> 
>  
> 
> Security Challenges For the Internet Of  Things
> <https://www.iab.org/wp-content/IAB-uploads/2011/03/Turner.pdf> (2011):
> 
> /It is essential that IoT protocol suites specify a *mandatory to
> implement but optional to use security solution*. This will ensure
> security is available in all implementations, but configurable to use
> when not necessary (e.g., in closed environment)./
> 
>  
> 
> I'll use your information and RFC7252 as a starting point for a pull
> request. I plan to schedule a conference call with Hannes, Juan Perez,
> and Göran Selander (or Francesca Palombini) late in the week of December
> 5th based on availability. We’ll iterate on the pull request and then
> present to the broader working group for review during the week of
> December 12th.
> 
>  
> 
> Thanks,
> 
> …Brian
> 
>  
> 
> 
> 
> _______________________________________________
> core mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/core
>

---

From: Brian Raymor <[email-masked]>
Date: Fri, 18 Nov 2016 07:28:57 +0000

Hi Hannes-

In part, I asked Jaime for a second WGLC because of the limited participation in the first WGLC. 

We've scheduled a second WGLC for WebPush. I felt that it really polished the draft for broader review which was noted in the IESG comments.

Measure twice. Cut once.

...Brian

-----Original Message-----
From: Hannes Tschofenig [mailto:[email-masked]] 
Sent: Friday, November 18, 2016 4:10 PM
To: Brian Raymor <[email-masked]>; [email-masked] WG <[email-masked]>
Subject: Re: [core] Next steps for coap-tcp-tls

Hi Brian,

Ciao
Hannes

On 11/18/2016 08:06 AM, Brian Raymor wrote:
> minor normative issues that I'll raise on the mailing list. The main
> focused on CoAP+TCP and its scenarios. Please ensure that you're
> we're proposing different solutions - to ensure that CoAP+TCP addresses
> 5th based on availability. We'll iterate on the pull request and then
> .Brian

---

From: Brian Raymor <[email-masked]>
Date: Fri, 18 Nov 2016 12:07:58 +0000

Doh. I just realized that my dates are off by a week. I'll blame it on the jet lag ;-) 

Take two.

Week of 11/21: Holiday week
Week of 11/28: Security conference call with Hannes, Juan, and Göran to iterate on the pull request
Week of 12/5: Present security pull request to the WG for review
12/9-12/12: Publish coap-tcp-tls-06 and start the second WGLC

-----Original Message-----
From: core [mailto:[email-masked]] On Behalf Of Brian Raymor
Sent: Friday, November 18, 2016 4:29 PM
To: Hannes Tschofenig <[email-masked]>; [email-masked] WG <[email-masked]>
Subject: Re: [core] Next steps for coap-tcp-tls

Hi Hannes-

Measure twice. Cut once.

...Brian

-----Original Message-----
From: Hannes Tschofenig [mailto:[email-masked]] 
Sent: Friday, November 18, 2016 4:10 PM
To: Brian Raymor <[email-masked]>; [email-masked] WG <[email-masked]>
Subject: Re: [core] Next steps for coap-tcp-tls

Hi Brian,

Ciao
Hannes

---

From: "Carey, Timothy (Nokia - US)" <[email-masked]>
Date: Fri, 18 Nov 2016 23:14:47 +0000

Brian,

Nokia's positions is that a "solution" must be secure.
We believe we will  see some solutions that use CoAP-TCP/TLS between the device and the server. 
OMA is thinking the same thing as LWM2M is considered to be added as a binding in the next release.

While we believe a "solution" must be secure that doesn't mean we have to mandate implementation of TLS or have it be on by default.
There are good reasons in a constrained world not to burden the UE with multiple security protocols and there are other ways to secure the solution (e.g., rely on the bearer, e2e security like OSCOAP).

So our stance is that TLS should be recommended to be implemented and recommended to be turned on.

BR,
Tim

-----Original Message-----
From: Brian Raymor [mailto:[email-masked]] 
Sent: Friday, November 18, 2016 4:29 PM
To: Hannes Tschofenig <[email-masked]>; [email-masked] WG <[email-masked]>
Subject: Re: [core] Next steps for coap-tcp-tls

Hi Hannes-

Measure twice. Cut once.

...Brian

-----Original Message-----
From: Hannes Tschofenig [mailto:[email-masked]]
Sent: Friday, November 18, 2016 4:10 PM
To: Brian Raymor <[email-masked]>; [email-masked] WG <[email-masked]>
Subject: Re: [core] Next steps for coap-tcp-tls

Hi Brian,

your proposal to start with RFC7252 as a starting point but I am wondering why there is a need for a second WGLC. Normally, we just take the feedback from the WGLC, incorporate it into the document and then send it to the IESG (if the WGLC comments are not dramatic).

Ciao
Hannes

On 11/18/2016 08:06 AM, Brian Raymor wrote:
>  
> 
> As editor, my aspiration is to publish coap-tcp-tls-06 for a second 
> WGLC between December 16-19th. I have editorial issues to address and 
> a few minor normative issues that I'll raise on the mailing list. The 
> main blocking point is 
> https://github.com/core-wg/coap-tcp-tls/issues/11. We need to find a way to quickly move forward and reach rough consensus.
> 
>  
> 
> conversations with people who needed to consult with their 
> organizations before sharing positions on this issue. Please share 
> details about your concrete positions and deployment plans/models (if 
> possible) on the mailing list as soon as possible. Remember that many 
> people did not hear the microphone discussions on Wednesday - so this 
> is an opportunity to educate the WG. (I appreciate that we're 
> travelling and then there is a holiday week for the US participants. 
> Do the best you can.)
> 
>  
> 
> addressing this specific case rather than constrained devices in 
> general or CoAP+UDP. Also, remember that we all share the same goals 
> even if we're proposing different solutions - to ensure that CoAP+TCP 
> addresses these guidelines (which are the best we have now):
> 
>  
> 
> and Göran Selander (or Francesca Palombini) late in the week of 
> December 5th based on availability. We'll iterate on the pull request 
> and then present to the broader working group for review during the 
> week of December 12th.
> 
>  
> 
> Thanks,
> 
> .Brian
> 
>  
> 
> 
>