Subject: [Dtls-iot] Hardware-based Random Number Generator

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 15 Jul 2015 13:31:46 +0200

Stephen wrote:

(10) 14: I want to check that the WG are really ok with the "MUST" for
h/w "quality" RNGs. I really like the idea, but it's very odd for the
IETF to have such a MUST touching on the style of implementation.  (Say
if my entire implementation of TLS is in some kind of VM? Then I
couldn't meet this ever.) I think we have to s/MUST/weasel-words/ there
tbh, sadly - it's just not our job to mandate implementation styles. The
following para though does the job nicely, so maybe s/MUST/ought
to/ is enough of a change.

In response to a similar comment from Russ I had softened the language
already. Here is the remark that Russ had:
http://www.ietf.org/mail-archive/web/dtls-iot/current/msg00273.html

I am, however, wondering whether we do ourselves a favour if we don't
state what the requirements are.

The example you have mentioned is also a bit artifical since IoT devices
don't run in a virtual machine and even virtual machines rely on
hardware features from the underlying host operating system.

I hope someone in the group can share their views.

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 21 Jul 2015 14:53:21 +0200

I discussed this issue with my co-worker Thomas and here is the proposed
text change to address your issue:

------------------------

   IoT devices using TLS/DTLS must offer ways to generate quality random
   numbers.  There are various implementation choices for integrating a
   hardware-based random number generator into a product: an
   implementation inside the microcontroller itself is one option but
   also dedicated crypto-chips are reasonable choices.  The best choice
   will depend on various factors outside the scope of this document.
   Guidelines and requirements for random number generation can be found
   in RFC 4086 [RFC4086] and in the NIST Special Publication 800-90a
   [SP800-90A].

------------------------

Ciao
Hannes

On 07/15/2015 01:31 PM, Hannes Tschofenig wrote:
> _______________________________________________
> dtls-iot mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dtls-iot
>