Subject: [6tisch-security] IP-IP-IP example?

From: Thomas Watteyne <[email-masked]>
Date: Tue, 28 Mar 2017 17:16:06 +0200

Michael,

We just discussed IP-IP-IP versus CoAP at the 6TiSCH WG meeting.

I stated that:
- with IP-IP-IP, all nodes in the network would need to know at least the
global and link-local IPv6 addresses of the JRC, as well as the IPv6
address of the LBR.
- With the CoAP proxy option, we could use (well-known?) 6LoWPAN contexts
and hostnames to avoid that.

You stated that my statement 1 was not correct. Could we draw up an example
with all the addresses in the IP-IP-IP case, and what exactly the Pledge
and Join Proxy need to know before being able to join?

Thanks,
Thomas

---

From: Michael Richardson <[email-masked]>
Date: Tue, 28 Mar 2017 12:15:42 -0400

Thomas Watteyne <[email-masked]> wrote:
    > - with IP-IP-IP, all nodes in the network would need to know at least
    > the global and link-local IPv6 addresses of the JRC, as well as the
    > IPv6 address of the LBR.

You write "all-nodes", but can we agree that it's only the Join Proxy?

The Join Proxy needs to know an address to which to forward the join traffic,
regardless of whether or not it is IPIP(IP) or CoAP.  I don't see how it
matters what which.  The JP has to know that address.

That address could be an IPv6 anycast address; it could be provisioned via
some other mechanism.

In the IPIP case, the pledge should ideally send to an address which the
JRC recognizes are local.  Any IPv6 LL-anycast address would work well for this.
That can also be done in the CoAP proxy method as well.

    > - With the CoAP proxy option, we could use (well-known?) 6LoWPAN
    > contexts and hostnames to avoid that.

I agree that using a 6lo context would be a good idea here.
It seems that it can also be used with either method.

I will write some examples today and post.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Michael Richardson <[email-masked]>
Date: Thu, 30 Mar 2017 16:17:37 -0400

Thomas, here is an example of a join message header, as seen on the join
side between pledge and Join Proxy.  Please let me know how I can make this
more complete for your code. If you want hex dump, I'll do that, but I'll
have to create a full topology with some addresses.

Let me do a second email for CoAP proxy example, once you are happy
with this presentation. I don't have a good idea for size of OSCOAP pieces, I
will pull those out.

L2:
        srcmac=ab-cd-12-34-56-78-ab-cd
        dstmac=88-88-aa-bb-cc-dd-ee-ff
IPv6:
        ver=6
        tc=0
        flowid=0
        src=fe80::abcd:1234:5678:abcd
        dst=fe80::0
        nh=17
UDP:
        srcport=1234    <- could be a constant?
        dstport=TBD     <- we could ask for a port, or use 5683

ULP:    OSCOAP stuff.

Travelling from Join Proxy to root/JRC using IPIP(IP):
L2:
        srcmac=ee-ff                    (2-byte, assigned short-address)
        dstmac=next-hop-l2
IPv6:
        ver=6
        tc=0
        flowid=0
        src=2001:db8::eeff
        dst=2001:db8::0001    (assume JRC got assigned short-address 0001)
        nh=41
  RPI header: rank=X, instanceID=Y
IPv6:
        ver=6
        tc=0
        flowid=0
        src=fe80::abcd:1234:5678:abcd
        dst=fe80::0
UDP:
        srcport=1234
        dstport=TBD

ULP:    OSCOAP stuff.

Travelling from root/JRC to Join Proxy using IPIP(IP), if JRC is co-located
in the DODAG root:
L2:
        srcmac=next-hop-l2
        dstmac=ee-ff
IPv6:
        ver=6
        tc=0
        flowid=0
        src=2001:db8::0001
        dst=2001:db8::eeff
        nh=41
  RPI header: rank=X, instanceID=Y
  RH3 header: X hops                    (do you want me to fill this in?)
IPv6:
        ver=6
        tc=0
        flowid=0
        src=fe80::abcd:1234:5678:abcd
        dst=fe80::0
UDP:
        srcport=1234
        dstport=TBD

ULP:    OSCOAP stuff.

Travelling from root/JRC to Join Proxy using IPIP(IP), if JRC is NOT co-located.
in the DODAG root. JRC is now 2001:db8:1::abcd.

L2:
        srcmac=next-hop-l2
        dstmac=ee-ff
IPv6:
        ver=6
        tc=0
        flowid=0
        src=2001:db8::0001
        dst=2001:db8::eeff
        nh=41
  RPI header: rank=X, instanceID=Y
  RH3 header: X hops                    (do you want me to fill this in?)
IPv6:
        ver=6
        tc=0
        flowid=0
        src=2001:db8:1::abcd
        dst=2001:db8::eeff
        nh=41
IPv6:
        ver=6
        tc=0
        flowid=0
        src=fe80::abcd:1234:5678:abcd
        dst=fe80::0
UDP:
        srcport=1234
        dstport=TBD

ULP:    OSCOAP stuff.

Link-Local anycast:
           https://tools.ietf.org/html/rfc4291#section-2.6

as far as I can tell, we can make up our own LL-anycast, but we could
reasonably also use fe80::0

---

From: Göran Selander <[email-masked]>
Date: Fri, 31 Mar 2017 04:45:09 +0000

Hi Michael,

> On 30 Mar 2017, at 22:17, Michael Richardson <[email-masked]> wrote:
> 
> 

There is a new draft with message overhead calculations for CoAP security protocols (DTLS/TLS/OSCOAP). 

https://tools.ietf.org/html/draft-mattsson-core-security-overhead-00

See Figure 1 at the end of the document for a compilation of the results. 

It wasn't presented in the CoRE WG on Tuesday out of lack of time, so I think it is first on the agenda for the Friday meeting. 

Göran