Subject: [Dtls-iot] Latest dice profile draft

From: "FOSSATI, Thomas (Thomas)" <[email-masked]>
Date: Mon, 19 Oct 2015 09:53:49 +0000

Hi everybody,

We think we've addressed all IESG comments:

https://datatracker.ietf.org/doc/draft-ietf-dice-profile/ballot/#ben-campbell
https://datatracker.ietf.org/doc/draft-ietf-dice-profile/ballot/#spencer-dawkins
https://datatracker.ietf.org/doc/draft-ietf-dice-profile/ballot/#barry-leiba

(thank you Ben, Spencer and Barry),  and submitted a new version of the profile draft.

Please, check the diff from –16 at https://www.ietf.org/rfcdiff?url2=draft-ietf-dice-profile-17

This is the version that will be sent to the RFC editor.

Cheers and thanks very much to all of you for the great work,

Thomas & Hannes.

---

From: Barry Leiba <[email-masked]>
Date: Mon, 19 Oct 2015 10:35:02 -0400

That looks good, guys, and thanks for addressing all my comments!

Barry

On Mon, Oct 19, 2015 at 5:53 AM, FOSSATI, Thomas (Thomas)
<[email-masked]> wrote:
> Please, check the diff from –16 at
> https://www.ietf.org/rfcdiff?url2=draft-ietf-dice-profile-17
>

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Mon, 19 Oct 2015 17:31:11 -0500

Hi, Thomas,

> https://www.ietf.org/rfcdiff?url2=draft-ietf-dice-profile-17

I'm happy, but just to make sure you didn't break anything making me happy
...

I asked about providing a reference for "constant time" in this text:

   For use with this profile the PSK identities
   SHOULD NOT assume a structured format (such as domain names,
   Distinguished Names, or IP addresses) and a constant time bit-by-bit
   comparison operation MUST be used by the server for any operation
   related to the PSK identity.

The -17 corresponding text substituted "byte-by-byte" for "bit-by-bit",
which I don't have an opinion about, but "constant time" simply
disappeared.

Was that intentional?

Thanks,

Spencer

> Cheers and thanks very much to *all* of you for the great work,
>
> Thomas & Hannes.
>

---

From: "FOSSATI, Thomas (Thomas)" <[email-masked]>
Date: Tue, 20 Oct 2015 04:18:05 +0000

Hi Spencer,

There are no timing side-channel concerns here — it's purely an interop affair — so we removed the superfluous "constant time" requirement.

In fact, thanks for asking the right question :-)

From: Spencer Dawkins at IETF <[email-masked]<mailto:[email-masked]>>
Date: Monday, 19 October 2015 23:31
To: Thomas Fossati <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Ben Campbell <[email-masked]<mailto:[email-masked]>>, Barry Leiba <[email-masked]<mailto:[email-masked]>>
Subject: Re: Latest dice profile draft

Hi, Thomas,

On Mon, Oct 19, 2015 at 4:53 AM, FOSSATI, Thomas (Thomas) <[email-masked]<mailto:[email-masked]>> wrote:
Hi everybody,

I'm happy, but just to make sure you didn't break anything making me happy ...

The -17 corresponding text substituted "byte-by-byte" for "bit-by-bit", which I don't have an opinion about, but "constant time" simply disappeared.

Was that intentional?

Thanks,

Spencer

Thomas & Hannes.