Subject: Re: [core] Fwd: New Version Notification for draft-vanderstok-core-coap-est-00.txt

From: Michel Veillette <[email-masked]>
Date: Tue, 1 Nov 2016 15:30:26 +0000

Hi Peter

In section 3 of "draft-vanderstok-core-coap-est-00", "Server-generated key" is listed as supported.
This service returns two components, a PKCS8 containing the private key material and a PKCS7 containing the device certificate chain.
In RFC7030, this information is returned using a Content-Type: multipart/mixed.
How this is supported in "draft-vanderstok-core-coap-est-00"?

     REQ: POST /.well-known/est/serverkeygen (Content-Format: application/pkcs10)
     <ASN.1 CertificationRequest>  // Certificate request carry in a PKCS10
  
    RES: 2.05 Content (Content-Format: ???)
    <ASN.1 ContentSet>            // Private key material for this node carry in a PKCS8
    <ASN.1 ContentInfo>           // Certificate and associated PKI for this node carry in a PKCS7

Regards,
Michel

-----Original Message-----
From: core [mailto:[email-masked]] On Behalf Of peter van der Stok
Sent: Saturday, October 29, 2016 11:12 AM
To: Anima-bootstrap <[email-masked]>; Core <[email-masked]>
Subject: [core] Fwd: New Version Notification for draft-vanderstok-core-coap-est-00.txt

Dear all,

we have submitted a new draft  Enrollment over Secure Transport (EST) over coaps to make BRSKI over coap possible.
We expect (parts of) this draft to be integrated with coap-bootstrap draft of pritikin and Kampanakis.
This draft removes EST functionality not absolutely needed within the context we expect the BRSKI deployment for low-resource devices.

Greetings,

Peter

-------- Oorspronkelijke bericht --------
Onderwerp: New Version Notification for draft-vanderstok-core-coap-est-00.txt
Datum: 2016-10-29 17:04
Afzender: [email-masked]
Ontvanger: "Peter van der Stok" <[email-masked]>, "Peter Van der Stok" <[email-masked]>, "Sandeep Kumar" 
<[email-masked]>, "Sandeep S. Kumar" <[email-masked]>

A new version of I-D, draft-vanderstok-core-coap-est-00.txt
has been successfully submitted by Peter van der Stok and posted to the IETF repository.

Name:		draft-vanderstok-core-coap-est
Revision:	00
Title:		EST based on DTLS secured CoAP (EST-coaps)
Document date:	2016-10-29
Group:		Individual Submission
Pages:		15
URL:            
https://www.ietf.org/internet-drafts/draft-vanderstok-core-coap-est-00.txt
Status:         
https://datatracker.ietf.org/doc/draft-vanderstok-core-coap-est/
Htmlized:       
https://tools.ietf.org/html/draft-vanderstok-core-coap-est-00

Abstract:
    Low-resource devices in a Low-power and Lossy Network (LLN) can
    operate in a mesh network using the IPv6 over Low-power Personal Area
    Networks (6LoWPAN) and IEEE 802.15.4 link-layer standards.
    Provisioning these devices in a secure manner with keys (often called
    security bootstrapping) used to encrypt and authenticate messages is
    the subject of Bootstrapping of Remote Secure Key Infrastructures
    (BRSKI) [I-D.ietf-anima-bootstrapping-keyinfra].  Enrollment over
    Secure Transport (EST) [RFC7030], based on TLS and HTTP, is used for
    BRSKI.  This document defines how low-resource devices are expected
    to use EST over DTLS and CoAP. 6LoWPAN fragmentation management and
    minor extensions to CoAP are needed to enable EST over DTLS-secured
    CoAP (EST-coaps).

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

_______________________________________________
core mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/core

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 1 Nov 2016 16:34:25 +0100

Sending around MIME messages between constrained devices doesn’t strike me as the optimal way forward.
Fortunately, we have COSE, which would be an easy way to combine a key wrap with some signing info.

Grüße, Carsten

On 1 November 2016 at 16:30:43, Michel Veillette ([email-masked]) wrote:

Hi Peter  

Regards,  
Michel  

-----Original Message-----  
From: core [mailto:[email-masked]] On Behalf Of peter van der Stok  
Sent: Saturday, October 29, 2016 11:12 AM  
To: Anima-bootstrap <[email-masked]>; Core <[email-masked]>  
Subject: [core] Fwd: New Version Notification for draft-vanderstok-core-coap-est-00.txt  

Dear all,  

Greetings,  

Peter  

-------- Oorspronkelijke bericht --------  
Onderwerp: New Version Notification for draft-vanderstok-core-coap-est-00.txt  
Datum: 2016-10-29 17:04  
Afzender: [email-masked]  
Ontvanger: "Peter van der Stok" <[email-masked]>, "Peter Van der Stok" <[email-masked]>, "Sandeep Kumar"  

Abstract:  

The IETF Secretariat

---

From: peter van der Stok <[email-masked]>
Date: Fri, 04 Nov 2016 09:57:57 +0100

It all depends on the interest generated in this document and for what 
purpose:
- BRSKI only with limited EST support
- Or full EST

For the moment it is BRSKI without manual intervention. When things are 
missing in that context, we will certainly add them.

Peter

Carsten Bormann schreef op 2016-11-01 16:34:
> On 1 November 2016 at 16:30:43, Michel Veillette
> ([email-masked]) wrote:
> 
>> Hi Peter
>> 
>> In section 3 of "draft-vanderstok-core-coap-est-00",
>> "Server-generated key" is listed as supported.
>> This service returns two components, a PKCS8 containing the private
>> key material and a PKCS7 containing the device certificate chain.
>> we have submitted a new draft Enrollment over Secure Transport (EST)
>> over coaps to make BRSKI over coap possible.
>> This draft removes EST functionality not absolutely needed within
>> the context we expect the BRSKI deployment for low-resource devices.
>> 
>> 
>> Greetings,
>> 
>> Peter
>> 
>> Ontvanger: "Peter van der Stok" <[email-masked]>, "Peter
>> Van der Stok" <[email-masked]>, "Sandeep Kumar"
>> Please note that it may take a couple of minutes from the time of
>> submission until the htmlized version and diff are available at
>> tools.ietf.org.
>> 
>> The IETF Secretariat
>> 
> Anima-bootstrap mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/anima-bootstrap

---

From: Michael Richardson <[email-masked]>
Date: Sat, 12 Nov 2016 11:54:42 +0900

peter van der Stok <[email-masked]> wrote:
    > purpose: - BRSKI only with limited EST support - Or full EST

    > missing in that context, we will certainly add them.

Yeah, it seems to me that we could easily do what Carsten suggested, and find
a new way to combine the two reply into a single component.  It seems like a
simple application of CBOR and COSE.