Subject: [Iotops] New Non-WG Mailing List: IOTOPS -- IOT Operations

From: IETF Secretariat <[email-masked]>
Date: Thu, 22 Oct 2020 10:19:29 -0700

A new IETF non-working group email list has been created.

List address: [email-masked]
Archive: https://mailarchive.ietf.org/arch/browse/iotops/
To subscribe: https://www.ietf.org/mailman/listinfo/iotops

Purpose:

This list is for the discussion of the proposed IOTOPS WG.

This WG will be for the discussion of operational issues
related to Internet of Things (IoT) devices and the publication and
standardization of documents that relate to management of IoT devices, 
in particular related to device onboarding and lifecycle management.

Link to proposed WG: https://datatracker.ietf.org/wg/iotops/about/

For additional information, please contact the list administrators.

---

From: "Andrew G. Malis" <[email-masked]>
Date: Fri, 30 Oct 2020 11:53:43 -0400

Now that there seems to be at least a few people on the list, I would like
to suggest that this be put into the charter as recommended reading:

https://arstechnica.com/gaming/2020/01/unauthorized-bread-a-near-future-tale-of-refugees-and-sinister-iot-appliances/

Cheers,
Andy

On Thu, Oct 22, 2020 at 1:20 PM IETF Secretariat <[email-masked]>
wrote:

> _______________________________________________
> IETF-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-announce
>

---

From: Michael Richardson <[email-masked]>
Date: Fri, 30 Oct 2020 12:30:16 -0400

> https://arstechnica.com/gaming/2020/01/unauthorized-bread-a-near-future-tale-of-refugees-and-sinister-iot-appliances/

Tales of dystopian machine dominated futures abound. There is an entire
subarea of sociology that deals with the counter-cyclical nature of SF.
(SF is happy when times are dark, and SF is dystopian when times are good)
For those that like to keep up on the latest stupidity, given that you
probably aren't reading comp.risks anymore, I suggest:
  http://www.firemountain.net/mailman/listinfo/dumpsterfire

Andrew, I presume that the thing we need to take home from this tale of
abusive *DRM*  (nothing specific to do with IoT) is that we need real
transfer of ownership.

That's why the charter proposes to work on issues that include:
  - factory provisioning of devices
  - onboarding of devices
  - administrative control of devices
  - software/firmware upgrades
  - end of life management of devices

There is a significant tussle between:
   1) running the software *you* want on *your* devices
   2) running the software that external entity X says is secure

Vernor Vinge, in _Rainbows End_, written in 2006, and set in 2025,
predicts a world where governments say, "Enough is Enough", and they
stop letting anyone other than them decide what software will run on personal
computing devices, and core Internet routers. (X=government above)
Sure, you can have as many layers of virtualization as we like (the
protagonist's teenage granddaughter sets him up with win95^Wfvwm95), but
they control the turtle at the bottom.

I coined a term Internet of Øwned Things => IøT.
This is the set of things where the device can actually be owned by the
person who bought it.  (vs pwned things, where a hostile owns things)

My take: if you can't control what software runs on your toaster^Wthing, then
you don't really øwn it.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: "Andrew G. Malis" <[email-masked]>
Date: Fri, 30 Oct 2020 12:43:29 -0400

Michael,

Thanks for the dumpsterfire pointer.

Yes, in addition to being a good story, the point is who controls the
firmware in our things, and how bad it can get not only when the
manufacturer enforces DRM, but the gov't enables the behavior
(criminalizing jailbreaking).

Or the issues that arise when the manufacturer fails to properly maintain
the firmware, or goes out of business.

Cheers,
Andy

---

From: Michael Richardson <[email-masked]>
Date: Fri, 30 Oct 2020 13:25:08 -0400

> the firmware, or goes out of business.

All major concerns.  What do you think the IETF can/should do?
I have some very specific ideas which I think are manageable and specific.

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 31 Oct 2020 08:58:27 +1300

> I have some very specific ideas which I think are manageable and specific.

Both BRSKI and SUIT have minor references to the latter problem, and I
think that when considering tiny cheap devices it isn't a theoretical issue,
but one that's highly likely. There is also (as for incandescent light
bulbs) a strong incentive for manufacturers to sell devices that are
designed to break after a while. An expiring certificate would be a great
way to break devices remotely, for example.

   Brian

---

From: Toerless Eckert <[email-masked]>
Date: Fri, 30 Oct 2020 22:03:37 +0100

> way to break devices remotely, for example.

Indeed, before even thinking about transferring ownership i would to see what
IETF security community can do to remove the current problem of even just
MAINTAINING OWNERSHIP in face of (if i am not mistaken) current PKI
recommendations:

My TivoHD for example had its certificate expire few years into its lifetime,
even though i had upfront bought a so-called "lifetime service" for it.
Of course, the lifetime-service did not include "maintaining a current cert for the
lifetime of the device".

And that is just the most egregious example i ran across because of me having
to learn how to hack up all the software that was talking to the TiVo via
TLS - to ignore the expired cert.

I am saying the IETF is partially to blame because i think we also proliferate
the notion that certificates have to be renewed periodically with maximum
usual lifetimes of now i think one year ? (was two years)

Of course, this is specifically a consumer-IoT problem, because industrial
customers should typically be in a stronger position to avoid these vendor
abuse of pricipally sound technical guidance.

As much as i like to explore short lived certificates more in environments
where i can set up the right environment to support that, we should IMHO
also think about the simplicity of lifetime-long-certificates. Which we
currently do not have in web PKI.

The fact alone that we do only have in browsers one single TA space (Internet)
seems to be the worst offender, proliferated by the fact that that is the
only domain that most big contributors in the IETF are interested in.
Nevertheless, to support what we claissically did without crypto, namely
private networks (with private addresses), we should also have a crypto
strategy for such private networks. And in most cases, livetime-long certs
will be the only reasonable solution there.

But, and to get back to the topic: One way on how to get to lifetime-long
certs would be an actual transfer of ownership from whaever the vendor
put in as certs to a cert from the current owner and using a lifelong
expirty time (e.g.: infinite). This could be hosted in a private TA.
The question is primarily how to have browsers support diffeent TA
domains without confusing the user.

And of course, when you sell the device, you would need to do transfer
of ownership again by overwriting the current cert with one of the
new owner.

JUst a line of thoughts.

Cheers
    Toerless
> 
>    Brian
> 
> -- 
> Iotops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/iotops

-- 
---
[email-masked]

---

From: Alexandre Petrescu <[email-masked]>
Date: Sat, 31 Oct 2020 12:56:52 +0100

'Transferring ownership' - like in selling property to somebody?  A
contract would be needed, and a notary with an electronic signature.

Le 30/10/2020 à 17:30, Michael Richardson a écrit :
>> Now that there seems to be at least a few people on the list, I
>> would like to suggest that this be put into the charter as
>> recommended reading:
> 
> Tales of dystopian machine dominated futures abound.

There are also tales of futures dominated by a few oligarchies storing
the data.  It would be these private interests that dominate the world,
via computers, be them Things or information highways.  A sort of
facebooks extended along certain negative extension lines.

In these worlds indeed the person-to-person communication would be
needed to avoid negative situations.  But 'transferring ownership' would
not be desirable: one would not transfer ownership of information from
one's brain to Things and even less let these Things further
transfer ownership to other private interests.  There would be a need of
a protocol to make sure ownership is not transferred, but hardcoded in
silicium.

Or maybe 'securely transfer ownership' would be akin to a delegation of
identity, under the form of securely allowing somebody to act on one's
behalf, a sort of 'delegation of signature'.  Delegate signature but
maintain control, like in delegating to vote.

Alex

  There is an entire
> subarea of sociology that deals with the counter-cyclical nature of
> SF. (SF is happy when times are dark, and SF is dystopian when times
> are good) For those that like to keep up on the latest stupidity,
> given that you probably aren't reading comp.risks anymore, I
> suggest: http://www.firemountain.net/mailman/listinfo/dumpsterfire
> 
> Andrew, I presume that the thing we need to take home from this tale
> of abusive *DRM*  (nothing specific to do with IoT) is that we need
> real transfer of ownership.
> 
> That's why the charter proposes to work on issues that include: -
> factory provisioning of devices - onboarding of devices -
> administrative control of devices - software/firmware upgrades - end
> of life management of devices
> 
> There is a significant tussle between: 1) running the software *you*
> want on *your* devices 2) running the software that external entity X
> says is secure
> 
> stop letting anyone other than them decide what software will run on
> personal computing devices, and core Internet routers. (X=government
> above) Sure, you can have as many layers of virtualization as we like
> (the protagonist's teenage granddaughter sets him up with
> win95^Wfvwm95), but they control the turtle at the bottom.
> 
> I coined a term Internet of Øwned Things => IøT. This is the set of
> things where the device can actually be owned by the person who
> bought it.  (vs pwned things, where a hostile owns things)
> 
> My take: if you can't control what software runs on your
> toaster^Wthing, then you don't really øwn it.
> 
> -- ]               Never tell me the odds!                 | ipv6
> mesh networks [ ]   Michael Richardson, Sandelman Software Works
> |    IoT architect   [ ]     [email-masked]
> http://www.sandelman.ca/        |   ruby on rails    [
> 
> 
> 
> 
> -- Michael Richardson <[email-masked]>   . o O ( IPv6 IøT
> consulting ) Sandelman Software Works Inc, Ottawa and Worldwide
> 
> 
> 
> 
>