Subject: [6tsch] Work item on security

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Wed, 24 Jul 2013 10:09:13 +0000

Dear all :

So far we have been pretty unclear on whether the security work would be in charter, and what the scope of that work would be.
Raghu unearthed the issue as he was working on the work item slides for the BoF.

I see the need for a security framework that describes commissioning, provisioning, key exchange and link security for large 6TSCH networks.
And that is exactly what Yoshi and the others have started with draft-ohba-6tsch-security.

Questions to the group:
Could/should we make this a full work item?
And if so, what scope exactly?

Cheers,

Pascal

---

From: Rene Struik <[email-masked]>
Date: Wed, 24 Jul 2013 09:08:05 -0400

Hi Pascal:

I suggest to leave the current language in the draft charter as is right now. Broadening the scope to essentially a complete trust life-cycle management solution, as you suggest, seems
to be somewhat premature, esp. given that there has hardly been any discussion on the mailing list or on calls on the topic of security yet (10 minutes during July
5th call; no real discussion). It would be prudent to clearly define what problem one is trying to solve first before jumping on solutions.

The broadened scope would be important for internet-of-things applications of course, but seems to be a larger undertaking than providing the "glue" between 802.15.4e and IPv6.

Best regards, Rene
  
[current draft charter text related to security (version July 24, 2013)]

A document on the security architecture and requirements for 6TSCH will be
developed, and depending on the security requirements identified in the
document, the group may work on a security solution and ask for security area
review.

On 7/24/2013 6:09 AM, Pascal Thubert (pthubert) wrote:
>
> Dear all :
>
> So far we have been pretty unclear on whether the security work would 
> be in charter, and what the scope of that work would be.
>
> I see the need for a security framework that describes commissioning, 
> provisioning, key exchange and link security for large 6TSCH networks.
>
> _______________________________________________
> 6tsch mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/6tsch

-- 
email: [email-masked] | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363

---

From: Subir Das <[email-masked]>
Date: Wed, 24 Jul 2013 09:20:08 -0400

I would agree with Rene. Let's keep the text as it is and hear from folks
during BoF session if there are other suggestions. We do need to develop a
security architecture and requirements document and the charter text is
clear.

-Subir

On Wed, Jul 24, 2013 at 6:09 AM, Pascal Thubert (pthubert) <
[email-masked]> wrote:

>  Dear all :****
>
> ** **
>
> So far we have been pretty unclear on whether the security work would be
> in charter, and what the scope of that work would be.****
>
> Raghu unearthed the issue as he was working on the work item slides for
> the BoF. ****
>
> ** **
>
> provisioning, key exchange and link security for large 6TSCH networks.****
>
> And that is exactly what Yoshi and the others have started with
> draft-ohba-6tsch-security. ****
>
> ** **
>
> Questions to the group:****
>
> Could/should we make this a full work item? ****
>
> And if so, what scope exactly?****
>
> ** **
>
> Cheers,****
>
> ** **
>
> Pascal****
>

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Wed, 24 Jul 2013 13:56:13 +0000

Hi Subir and René:

The current draft charter lists only 6 work items, and then has an unnumbered paragraph as follows:
"
A document on the security architecture and requirements for 6TSCH will be
developed, and depending on the security requirements identified in the
document, the group may work on a security solution and ask for security area
review.
"

My suggestion is not to add standard track work now but to:
1) add the item above as item 7 with a sentence that is more homogeneous with 1 .. 6 and eventually
2) add words like commissioning, provisioning, key life cycle management or network / node bootstrap to indicate that these items are in scope.

What do you think?

Pascal

From: [email-masked] [mailto:[email-masked]] On Behalf Of Subir Das
Sent: mercredi 24 juillet 2013 15:20
To: Pascal Thubert (pthubert)
Cc: Raghuram Sudhaakar (rsudhaak); [email-masked]; Yoshihiro Ohba ([email-masked])
Subject: Re: [6tsch] Work item on security

I would agree with Rene. Let's keep the text as it is and hear from folks during BoF session if there are other suggestions. We do need to develop a security architecture and requirements document and the charter text is clear.

-Subir

On Wed, Jul 24, 2013 at 6:09 AM, Pascal Thubert (pthubert) <[email-masked]<mailto:[email-masked]>> wrote:
Dear all :

Questions to the group:

Cheers,

Pascal

_______________________________________________
6tsch mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/6tsch

---

From: Thomas Watteyne <[email-masked]>
Date: Wed, 24 Jul 2013 16:59:14 +0200

Pascal, Rene, Subir,

I fully share Rene's point that it is premature to talk about full
solution, and that we should stick with an architecture and requirements.
This was the philosophy behind the paragraph in the charter.

I get Pascal's point that this paragraph somehow is "floating" after the 6
clearly defined work items. Things would look somewhat cleaner if a
security *architecture and requirements* would become a work item. Thoughts?

Thomas

On Wed, Jul 24, 2013 at 3:56 PM, Pascal Thubert (pthubert) <
[email-masked]> wrote:

>  Hi Subir and René:****
>
> ** **
>
> The current draft charter lists only 6 work items, and then has an
> unnumbered paragraph as follows:****
>
> “****
>
> ****
> developed, and depending on the security requirements identified in the***
> *
>
> document, the group may work on a security solution and ask for security
> area****
>
> review.****
>
> “****
>
> ** **
>
> My suggestion is not to add standard track work now but to:****
>
> 1) add the item above as item 7 with a sentence that is more homogeneous
> with 1 .. 6 and eventually****
>
> 2) add words like commissioning, provisioning, key life cycle management
> or network / node bootstrap to indicate that these items are in scope.****
>
> ** **
>
> What do you think?****
>
> ** **
>
> Pascal****
>
> ** **
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf
> Of *Subir Das
> *Sent:* mercredi 24 juillet 2013 15:20
> *To:* Pascal Thubert (pthubert)
> *Cc:* Raghuram Sudhaakar (rsudhaak); [email-masked]; Yoshihiro Ohba (
> [email-masked])
> *Subject:* Re: [6tsch] Work item on security****
>
> ** **
>
> clear. ****
>  ****
> -Subir ****
> [email-masked]> wrote:****
>
> Dear all :****
>
>  ****
>
>  ****
>  ****
>  ****
>  ****
> https://www.ietf.org/mailman/listinfo/6tsch****
>
> ** **
>

---

From: Michael Richardson <[email-masked]>
Date: Wed, 24 Jul 2013 11:00:45 -0400

I think that you should ask the BOF and IESG what they want 6tsch to do with
security.  There will be clear security requirements for a routing-layer<->PCE
communications, but it's rather trivially solved if one can assume a
pre-existing trust relationship.

I don't think that 6tsch should solve the security issues around
commissioning and provisioning, as they are simply not 6tsch specific.

--
Michael Richardson <[email-masked]>, Sandelman Software Works

---

From: Subir Das <[email-masked]>
Date: Wed, 24 Jul 2013 14:10:10 -0400

I would suggest to add security requirements and architecture as an work
item and also have discussion with the security ADs.

On Wed, Jul 24, 2013 at 10:59 AM, Thomas Watteyne <
[email-masked]> wrote:

>> developed, and depending on the security requirements identified in the**
>> **
>>
>> *From:* [email-masked] [mailto:[email-masked]] *On
>> Behalf Of *Subir Das