Subject: [6tisch-security] WirelessHART-like joining flow

From: Jonathan Simon <[email-masked]>
Date: Fri, 30 May 2014 13:46:27 -0700

Everyone - 

Rather than dig up the old email to the main 6TiSCH group as I stated in the last call, I put a couple of slides together showing the basic WH flow and a PK (or PSK) WH-like flow.  We can discuss on the upcoming call.

Jonathan

-- 
Jonathan Simon, Ph. D
Director of Systems Engineering
Linear Technology, Dust Networks product group
30695 Huntwood Ave
Hayward, CA 94544-7021
(510) 400-2936
(510) 489-3799 FAX
[email-masked]

**LINEAR TECHNOLOGY CORPORATION** 
*****Internet Email Confidentiality Notice***** 
 This e-mail transmission, and any documents, files or previous e-mail messages attached to it may contain confidential information that is legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error, please immediately notify me by reply e-mail, or by telephone at (510) 400-2936, and destroy the original transmission and its attachments without reading or saving in any manner. Thank you.

---

From: Michael Richardson <[email-masked]>
Date: Fri, 30 May 2014 21:11:42 -0400

Thanks for those slides.
Some questions/clarifications:

SLIDE 2:

1) it isn't clear in the slide that the PSK is (pre-)shared between the
   PCE/manager and the Joining Node.

SLIDE 3:

>(2)  For  PK,  plaintext  certificate  request (CoAP)   authenticated
>       with  same  key  as Beacon.  This  step  is  not  needed  if
>       using PSK.

I think that this step is wrong.  I don't think one could send a certificate
request here, and I don't think the proxy could answer with a certificate.
If it went to the PCE, I might buy it.

Thinking more about it on my way home, I think that the words "certificate
request" are wrong.  I think the goal is for the joining node to ask the
proxy for the PCE's certificate.  A "certificate request" is something else.

My question would be if (4) and (5) could be done in 6top format.
The other question is: are there advantages if the PCE actually initiates
the conversation.

You ask: Can we start a DTLS session without DH for PSK?
RFC 4279  section 2 says yes.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-