Subject: [core] Fwd: New Version Notification for draft-vanderstok-core-coap-est-00.txt

From: peter van der Stok <[email-masked]>
Date: Sat, 29 Oct 2016 17:11:53 +0200

Dear all,

we have submitted a new draft  Enrollment over Secure Transport (EST) 
over coaps to make BRSKI over coap possible.
We expect (parts of) this draft to be integrated with coap-bootstrap 
draft of pritikin and Kampanakis.
This draft removes EST functionality not absolutely needed within the 
context we expect the BRSKI deployment for low-resource devices.

Greetings,

Peter

-------- Oorspronkelijke bericht --------
Onderwerp: New Version Notification for 
draft-vanderstok-core-coap-est-00.txt
Datum: 2016-10-29 17:04
Afzender: [email-masked]
Ontvanger: "Peter van der Stok" <[email-masked]>, "Peter Van 
der Stok" <[email-masked]>, "Sandeep Kumar" 
<[email-masked]>, "Sandeep S. Kumar" <[email-masked]>

A new version of I-D, draft-vanderstok-core-coap-est-00.txt
has been successfully submitted by Peter van der Stok and posted to the
IETF repository.

Name:		draft-vanderstok-core-coap-est
Revision:	00
Title:		EST based on DTLS secured CoAP (EST-coaps)
Document date:	2016-10-29
Group:		Individual Submission
Pages:		15
URL:            
https://www.ietf.org/internet-drafts/draft-vanderstok-core-coap-est-00.txt
Status:         
https://datatracker.ietf.org/doc/draft-vanderstok-core-coap-est/
Htmlized:       
https://tools.ietf.org/html/draft-vanderstok-core-coap-est-00

Abstract:
    Low-resource devices in a Low-power and Lossy Network (LLN) can
    operate in a mesh network using the IPv6 over Low-power Personal Area
    Networks (6LoWPAN) and IEEE 802.15.4 link-layer standards.
    Provisioning these devices in a secure manner with keys (often called
    security bootstrapping) used to encrypt and authenticate messages is
    the subject of Bootstrapping of Remote Secure Key Infrastructures
    (BRSKI) [I-D.ietf-anima-bootstrapping-keyinfra].  Enrollment over
    Secure Transport (EST) [RFC7030], based on TLS and HTTP, is used for
    BRSKI.  This document defines how low-resource devices are expected
    to use EST over DTLS and CoAP. 6LoWPAN fragmentation management and
    minor extensions to CoAP are needed to enable EST over DTLS-secured
    CoAP (EST-coaps).

Please note that it may take a couple of minutes from the time of 
submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Julien Vermillard <[email-masked]>
Date: Mon, 31 Oct 2016 08:54:12 +0100

Hi,
It's something I would like to implement, but I have a question:
why the draft doesn't support PSK based authentication (only certificates),
because I have a fleet of device using PSK and I would like to move them to
X.509 based auth.
My plan is to use EST over CoAP, do the initial auth using DTLS-PSK and
then move to regular DTLS X.509 mutual auth.

--
Julien Vermillard

On Sat, Oct 29, 2016 at 5:11 PM, peter van der Stok <[email-masked]>
wrote:

> Dear all,
>
> we have submitted a new draft  Enrollment over Secure Transport (EST) over
> coaps to make BRSKI over coap possible.
> We expect (parts of) this draft to be integrated with coap-bootstrap draft
> of pritikin and Kampanakis.
> Onderwerp: New Version Notification for draft-vanderstok-core-coap-est
> -00.txt
> Datum: 2016-10-29 17:04
> der Stok" <[email-masked]>, "Sandeep Kumar" <[email-masked]>,
> "Sandeep S. Kumar" <[email-masked]>
>
> URL:            https://www.ietf.org/internet-
> drafts/draft-vanderstok-core-coap-est-00.txt
> Status:         https://datatracker.ietf.org/
> doc/draft-vanderstok-core-coap-est/
> Htmlized:       https://tools.ietf.org/html/d
> raft-vanderstok-core-coap-est-00
>
>
> Abstract:
> _______________________________________________
> core mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/core
>

---

From: peter van der Stok <[email-masked]>
Date: Mon, 31 Oct 2016 09:24:47 +0100

Hi Julien,

thanks for your interest.
Many thanks for this comment.
We urgently needed a write-up for "EST over coaps" within the context of 
commissioning IoT devices.
The use of other means than certificates seemed very unlikely to us, 
given the quantity of devices and other installation constraints.

However, when the need exists for PSK based authentication, we probably 
need to put that in as well.
As stated below, we want to integrate the draft with the work done in 
coap-bootstrap, and there PSK based authentication was originally 
foreseen.

I hope this answers your question,

Peter

Julien Vermillard schreef op 2016-10-31 08:54:
> why the draft doesn't support PSK based authentication (only
> certificates), because I have a fleet of device using PSK and I would
> like to move them to X.509 based auth.
> My plan is to use EST over CoAP, do the initial auth using DTLS-PSK
> and then move to regular DTLS X.509 mutual auth.
> 
> --
> Julien Vermillard
> On Sat, Oct 29, 2016 at 5:11 PM, peter van der Stok
> <[email-masked]> wrote:
> 
>> Dear all,
>> 
>> we have submitted a new draft  Enrollment over Secure Transport
>> (EST) over coaps to make BRSKI over coap possible.
>> This draft removes EST functionality not absolutely needed within
>> the context we expect the BRSKI deployment for low-resource devices.
>> 
>> Greetings,
>> 
>> Peter
>> 
>> Ontvanger: "Peter van der Stok" <[email-masked]>, "Peter
>> Van der Stok" <[email-masked]>, "Sandeep Kumar"
>> [1]
>> https://datatracker.ietf.org/doc/draft-vanderstok-core-coap-est/ [2]
>> Htmlized:
>> https://tools.ietf.org/html/draft-vanderstok-core-coap-est-00 [3]
>> 
>> Abstract:
>> until the htmlized version and diff are available at tools.ietf.org
>> [4].
>> 
>> The IETF Secretariat
>> 
>> https://www.ietf.org/mailman/listinfo/core [5]
> 
> 
> 
> Links:
> ------
> [1] 
> [2] https://datatracker.ietf.org/doc/draft-vanderstok-core-coap-est/
> [3] https://tools.ietf.org/html/draft-vanderstok-core-coap-est-00
> [4] http://tools.ietf.org
> [5] https://www.ietf.org/mailman/listinfo/core
> Anima-bootstrap mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/anima-bootstrap