Subject: [saag] IoT Authentication

From: Behcet Sarikaya <[email-masked]>
Date: Wed, 15 Sep 2021 10:09:07 -0500

Hi all,

Can anyone point to a recent survey draft/RFC on IoT authentication
techniques developed/being developed in various WGs so far?

Thanks in advance,

Behcet

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 15 Sep 2021 12:02:14 -0400

Greetings,

Have you looked at the work of the Authentication and Authorization of Constrained Environment (ACE) working group? If not, that is the place to begin.

Best regards,
Kathleen 

Sent from my mobile device

> On Sep 15, 2021, at 11:09 AM, Behcet Sarikaya <[email-masked]> wrote:
> 
> 
> Hi all,
> 
> Can anyone point to a recent survey draft/RFC on IoT authentication techniques developed/being developed in various WGs so far?
> 
> Thanks in advance,
> 
> Behcet
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag

---

From: Michael Richardson <[email-masked]>
Date: Wed, 15 Sep 2021 16:49:03 -0400

> techniques developed/being developed in various WGs so far?

What exactly are you talking about?
You write *authentication*, but do you mean authorization?
I know that you know the difference, so I wonder exactly what you mean.

ACE has done lots of interesting work, but it about authorization, not authentication.

RFC8995 (BRSKI) deals with authentication of devices, including sending
authorizations to the device as to what network they should join, and how to
authenticate that network.

I have a few documents that started in ANIMA:
  1) draft-richardson-anima-masa-considerations (*)
     Mostly about IDevID and other related trust anchors such that
     devices can later be authenticated.

  2) draft-richardson-t2trg-idevid-considerations
     Forked off above, dealing with how the PKI used for above can
     be evaluated.

  3) draft-richardson-anima-registrar-considerations (*)
     about how an operator builds and manages the infrastructure
     to authenticate devices.

(*) sorry, expired, but documents will get refreshed this month.

In addition. t2trg has:
  https://datatracker.ietf.org/doc/draft-irtf-t2trg-secure-bootstrapping/

it refers to many things, including https://datatracker.ietf.org/doc/draft-ietf-emu-eap-noob/
which is on the verge of RFC.

Today, most vertically integrated systems deploy static keys to the devices
to authenticate the "cloud" service to the IoT device.  Whether or not the,
they authenticate the device at all is often unknown without an NDA.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: <[email-masked]>
Date: Thu, 16 Sep 2021 13:14:48 +0000

Hi Michael,
thanks for the pointers! Very helpful, indeed .... although some is already well-known 😉 
Best Regards
Dirk 
-----Original Message-----
From: Michael Richardson <[email-masked]> 
Sent: Mittwoch, 15. September 2021 22:49
To: [email-masked]
Cc: IETF SAAG <[email-masked]>; von Hugo, Dirk <[email-masked]>
Subject: Re: [saag] IoT Authentication

RFC8995 (BRSKI) deals with authentication of devices, including sending authorizations to the device as to what network they should join, and how to authenticate that network.

In addition. t2trg has:

Today, most vertically integrated systems deploy static keys to the devices to authenticate the "cloud" service to the IoT device.  Whether or not the, they authenticate the device at all is often unknown without an NDA.