Subject: [Ace] Fwd: New Version Notification for draft-gerdes-ace-tasks-00.txt

From: Stefanie Gerdes <[email-masked]>
Date: Tue, 29 Sep 2015 15:25:00 +0200

Hi all,

I just submitted a new document containing the authentication- and
authorization-related tasks that the actors in the ACE architecture need
to perform. This document can be used as an accompanying document to the
actors draft.

The tasks were originally included in the actors draft but we decided to
put them into a separate document when we merged the actors draft and
the problem description draft.

Comments are welcome!

Best regards,
Steffi

-------- Forwarded Message --------
Subject: New Version Notification for draft-gerdes-ace-tasks-00.txt
Date: Tue, 29 Sep 2015 06:19:17 -0700
From: [email-masked]
To: Stefanie Gerdes <[email-masked]>, Stefanie Gerdes <[email-masked]>

A new version of I-D, draft-gerdes-ace-tasks-00.txt
has been successfully submitted by Stefanie Gerdes and posted to the
IETF repository.

Name:		draft-gerdes-ace-tasks
Revision:	00
Title:		Authorization-Related Tasks in Constrained Environments
Document date:	2015-09-29
Group:		Individual Submission
Pages:		20
URL:
https://www.ietf.org/internet-drafts/draft-gerdes-ace-tasks-00.txt
Status:         https://datatracker.ietf.org/doc/draft-gerdes-ace-tasks/
Htmlized:       https://tools.ietf.org/html/draft-gerdes-ace-tasks-00

Abstract:
   Constrained nodes are small devices which are limited in terms of
   processing power, memory, non-volatile storage and transmission
   capacity.  Due to these constraints, commonly used security protocols
   are not easily applicable.  Nevertheless, an authentication and
   authorization solution is needed to ensure the security of these
   devices.

   Due to the limitations of the constrained nodes it is especially
   important to develop a light-weight security solution which is
   adjusted to the relevant security objectives of each participating
   party in this environment.  Necessary security measures must be
   identified and applied where needed.

   In this document, the required security related tasks are identified
   as guidance for the development of authentication and authorization
   solutions for constrained environments.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Göran Selander <[email-masked]>
Date: Wed, 30 Sep 2015 12:45:21 +0000

Hi Steffi,

I have looked through the draft quickly and here are my comments.

I think a list of potential tasks of an actor on a high level could be
useful to include in the actors draft. Ludwig began compile such a list in
Prague, couldn’t find it right now. I don’t think there is a need for a
separate document, for several reasons:

- This draft is in parts overlapping with the actors draft, and most parts
which are not overlapping are not needed.

- Section 3.3 contains an abstract discussion about “attributes”,
"attribute binding", "attribute binding authority", “endorsement
information", “verifier”,etc.  Many new terms. As far as I understand,
this is completely
generic and thus belong to a text book. Or should it be interpreted
literally as attributes in an access token? Note then that it is not
necessary to have access tokens to perform authorization.

- Section 4.1 The actual description of tasks is not correct in all cases.
It says “S performs the following tasks” and assumes a certain
communication model which does not always apply. E.g.  the RS need not
receive a request. With such considerations the application of the content
is limited and we could just as well settle for some high level examples.

- There are 10 pages of appendices. I don’t think many people would use
this when implementing the ACE solution. And it suffers from the same
issue that it applies to certain authorization schemes.

I don’t know what is the meaning of an “accompanying document”. Do you
propose this to be adopted by the WG? I think ACE has already stretched
the limit on the number of informational drafts that it can bear, and
should not commit or even reference any documents that may affect the time
line.

Regards,
Göran

On 2015-09-29 15:25, "Stefanie Gerdes" <[email-masked]> wrote:

>_______________________________________________
>Ace mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/ace