Subject: [Iot-onboarding] draft-garciamorchon-t2trg-automated-iot-security-00

From: Michael Richardson <[email-masked]>
Date: Tue, 20 Nov 2018 11:23:23 -0500

I read the t2trg automated iot security document.
  draft-garciamorchon-t2trg-automated-iot-security-00
I read -00, as I guess I started reading before the -01 came out.
I looked at the diff just now, and I suspect that it's an improvement.

I liked the abstract concepts of the PACS and PAVA.
I think it might be important to understand that there isn't a MUD
"protocol", just a file format.  MUD pointers are carried in a variety of
other protocols until DHCP, LLDP, BRSKI and even QR codes.

I'm not sure what to do with this document.
I don't think it defines a protocol that we can implement, but rather a
conceptual architecture that might guide future protocol work.  It feels like
it could be a roadmap document for some WG which does not currently exist.

I am not sure that the assessments proposed are feasible in current CPE
devices that are deployed in homes; but I suppose that the cloud might come
to the rescue.  However, in order for this to be widely useful the inputs and
outputs needs to be well defined, and there needs to be a standard format
for the audit trail of decisions made.   I am reminded of the spamassassin
explanation of why something is or isn't spam.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: "Garcia-Morchon O, Oscar" <[email-masked]>
Date: Mon, 26 Nov 2018 15:51:52 +0000

Hi,

>> Yes. We removed unnecessary details and we tried to highlight the motivation and architecture view. We also tried to show how (a very first version of) such a system can be built.

>> Thank you.

>> Good point. This should be better explained in the document.

>> Version -01 was written with the goal of describing the problem space and solution direction. It indeed only describes a high-level architecture. We only describe "next steps" in Section 6 where we give some (first) details about how the "high-level architecture" in Section 4 can be instantiated.

>> Yes, if we want to perform any type of (risk/privacy) assessment after deployment, contents and formats need standardization.
>> Here, there will be technical solutions that will be able to cover many use cases, but they will be also (more) complex.  Some solutions require (much) less work and can easily help to improve the security level in IoT systems.

On 20/11/2018, 17:23, "Michael Richardson" <[email-masked]> wrote:

________________________________
The information contained in this message may be confidential and legally protected under applicable law. The message is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and destroy all copies of the original message.

---

From: Behcet Sarikaya <[email-masked]>
Date: Mon, 26 Nov 2018 10:00:34 -0600

Hi Michael,

Can you please make a quick review of

draft-sarikaya-t2trg-sbootstrapping-05

In this draft, we also do not define a new protocol but there is a lot of
on boarding discussion.

Thanks,

Behcet for Mohit and Dan

On Tue, Nov 20, 2018 at 10:23 AM Michael Richardson <[email-masked]>
wrote:

> _______________________________________________
> T2TRG mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/t2trg
>