Subject: [6tisch] rekeying the 6TiSCH network

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Tue, 20 Aug 2019 16:17:15 +0000

Dear all:

I'm looking for a consensus on how to address the following review comment on the 6TiSCH Architecture by Benjamin:

> It would be good to see some architectural discussion about key management

> for the link-layer keys.  (Given that 802.15.4 leaves key management as out of

> scope, it is clearly our problem.)  Thus far I don't even have a sense for when it is

> possible to rotate a network's keys.

To which I answered:

PT> I'll take that to a separate thread with Michael, Tero and Malisa. It is certainly possible to rotate keys. We had a draft about rekeying that went stale. We isolated cases where this is desirable in the discussion on the minimal security draft. I'm unclear how deep we need to go in this regards vs. what belongs to the minimal security specification.

What do you think?

Pascal

---

From: Michael Richardson <[email-masked]>
Date: Tue, 20 Aug 2019 16:03:12 -0400

Pascal Thubert (pthubert) <[email-masked]> wrote:
    > I'm looking for a consensus on how to address the following review
    > comment on the 6TiSCH Architecture by Benjamin:

    >> possible to rotate a network's keys.

    PT> I'll take that to a separate thread with Michael, Tero and Malisa. It
    PT> is certainly possible to rotate keys. We had a draft about rekeying
    PT> that went stale. We isolated cases where this is desirable in the
    PT> discussion on the minimal security draft. I'm unclear how deep we
    PT> need to go in this regards vs. what belongs to the minimal security
    PT> specification.

6tisch-minimal-security has a section 8.2 "Parameter Update Exchange"
Maybe it should include "(and Rekey)"

We further have section 8.4.3.1 and 8.4.3.2 to explain how to use that
to rekey the entire network.

I'm not sure what's in the Architecture document about this, but I'd
rather that it just said less.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Don Sturek <[email-masked]>
Date: Tue, 20 Aug 2019 13:16:38 -0700

Š. On the rekeying topic for IEEE 802.15.4.

Have a look at IEEE 802.15.9.   It takes existing key establishment
protocols (IEEE 802.1x, etc.) and provides encapsulation over IEEE
802.15.4.  

 IEEE 802.15.9 does not solve all of your rekey needs but the tools are
there when you agree on how you want rekeying to work.

Don 

On 8/20/19, 1:03 PM, "6tisch on behalf of Michael Richardson"
<[email-masked] on behalf of [email-masked]> wrote:

>    >> for the link-layer keys.  (Given that 802.15.4 leaves key
>management
>    >> as out of
>    >> scope, it is clearly our problem.)  Thus far I don't even have a
>sense
>    >> for when it is
>_______________________________________________
>6tisch mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/6tisch

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Wed, 21 Aug 2019 08:18:03 +0000

Hello Michael

I agree that the details of how it is done in practice belong to minimal security.
My expectation would be that we discuss times when it is appropriate to rekey, and what it takes to do that.

Out of my hat (but please come back with cases that I missed) I can see that:
 
- we need to rekey to expel undesired nodes.
- we need to rekey if a short address is reassigned to avoid nonce-replay attacks with an ASN in the past
- the ASN-based nonce never wraps in practice, but should we reset ASN -or allow it to go back in time - for whatever reason, we'd need to rekey as well.
- based on Mirja's comment - seconded by Benjamin - minimal security should be a normative reference since it expands on the security considerations

I think it does not hurt to have a word on that in the architecture, even if more details are found in minimal security

All the best,

Pascal

> -----Original Message-----
> From: 6tisch <[email-masked]> On Behalf Of Michael Richardson
> Sent: mardi 20 août 2019 22:03
> To: Pascal Thubert (pthubert) <[email-masked]>; Benjamin Kaduk
> <[email-masked]>; =?iso-8859-2?Q?Mali=B9a_Vu=E8ini=E6?=
> <[email-masked]>; Tero Kivinen <[email-masked]>; [email-masked]
> Subject: Re: [6tisch] rekeying the 6TiSCH network
> 
> 
> We further have section 8.4.3.1 and 8.4.3.2 to explain how to use that to rekey
> the entire network.
> 
> I'm not sure what's in the Architecture document about this, but I'd rather that it
> just said less.
> 
> --
> Michael Richardson <[email-masked]>, Sandelman Software Works  -
> = IPv6 IoT consulting =-
> 
>

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Wed, 21 Aug 2019 10:53:12 +0000

Yes, Don. 

So far I have not seen any 6TiSCH implementation using 802.15.9 but I guess it could be added. If people did try please let us now, now is a good time.
It results that at the moment we do not have text on 15.9 at all. It seems a bit late to add it now.

What do others think?

All the best,

Pascal

> From: Don Sturek <[email-masked]>
> Sent: mardi 20 août 2019 22:17
> To: Michael Richardson <[email-masked]>; Pascal Thubert (pthubert)
> <[email-masked]>; Benjamin Kaduk <[email-masked]>; Mališa Vučinić
> protocols (IEEE 802.1x, etc.) and provides encapsulation over IEEE 802.15.4.
> 
>  IEEE 802.15.9 does not solve all of your rekey needs but the tools are there
> when you agree on how you want rekeying to work.
> 
> Don
> 
> 
>

---

From: Michael Richardson <[email-masked]>
Date: Wed, 21 Aug 2019 19:30:55 -0400

> there when you agree on how you want rekeying to work.

Yes, thank you for pointing out that this exists.
6tisch-minimal is designed to key a network that can not afford yet
another AKE for peer to peer keying.

draft-ietf-6tisch-dtsecurity-zerotouch-join was designed to (optionally)
enroll devices with certificates so that one can use 802.15.9
(now rolled into 802.15.4, I'm told) to do per-pair keying.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 22 Aug 2019 18:41:41 -0500

> I think it does not hurt to have a word on that in the architecture, even if more details are found in minimal security

That basically matches up with what I was thinking.
(And thanks to those who pointed out 802.15.9; I had forgotten that was an
option, albeit not necessarily a good one for all cases.)

-Ben