Subject: Re: [Lwip] Fwd: IPsec/Diet-ESP for IoT and Minimal ESP

From: "Cao Zhen \(CZ\)" <[email-masked]>
Date: Tue, 11 Feb 2014 17:24:36 +0800

Hi , Daniel, 

What's the relationship with existing work on ikev2, and tls? 

Thanks,
Zhen 

> -----Original Message-----
> From: Lwip [mailto:[email-masked]] On Behalf Of Daniel Migault
> Sent: Friday, January 31, 2014 10:59 PM
> To: [email-masked]
> Subject: [Lwip] Fwd: IPsec/Diet-ESP for IoT and Minimal ESP
> 
> Hi,
> 
> Please find our draft for minimal IPsec/ESP.
> 
> Comment are welcome!
> 
> BR,
> Daniel
> 
> 
> Name:        draft-mglt-lwig-minimal-esp
> Revision:    00
> Title:        Minimal ESP
> Document date:    2014-01-31
> Group:        Individual Submission
> Pages:        6
> URL:http://www.ietf.org/internet-drafts/draft-mglt-lwig-minimal-esp-00.txt
> Status:https://datatracker.ietf.org/doc/draft-mglt-lwig-minimal-esp/
> Htmlized:http://tools.ietf.org/html/draft-mglt-lwig-minimal-esp-00
> 
> 
> Abstract:
>    This document describes a minimal version of the IP Encapsulation
>    Security Payload (ESP) described in RFC 4303 which is part of the
>    IPsec suite.
> 
>    ESP is used to provide confidentiality, data origin authentication,
>    connectionless integrity, an anti-replay service (a form of partial
>    sequence integrity), and limited traffic flow confidentiality.
> 
>    This document does not update or modify RFC 4303, but provides a
>    compact description of the minimal version of the protocol.  If this
>    document and RFC 4303 conflicts then RFC 4303 is the authoritative
>    description.
> 
> 
> --
> Daniel Migault
> Orange Labs -- Security
> +33 6 70 72 69 58
> _______________________________________________
> Lwip mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/lwip

---

From: Daniel Migault <[email-masked]>
Date: Thu, 13 Feb 2014 15:45:12 +0100

Hi,

We have not updated the draft to change their names, but I agree they
definitely better fit in the LWIG. We would like to present them both
in LWIG in London.

Note Tero has been provided a 20 minute slot for an overview on "IPsec
in constrained environments". So people interested in IoT and security
should check the agenda at ipsecme too.

[1] http://www.ietf.org/proceedings/89/agenda/agenda-89-ipsecme

On Tue, Feb 4, 2014 at 2:53 AM, Sye Loong Keoh
<[email-masked]> wrote:
> Hi Daniel,
>
> As pointed out by Hannes, DICE WG is not chartered to look at IPSec for IoT.
> However, I think your draft might be useful for LWIG WG though.
>
> Cheers
> Sye Loong
>
> From: dtls-iot [mailto:[email-masked]] On Behalf Of Daniel Migault
> Sent: Friday, 31 January, 2014 10:48 PM
> To: [email-masked]; [email-masked]
> Subject: [Dtls-iot] IPsec/Diet-ESP for IoT and Minimal ESP
>
> Hi,
>
> Please find the two drafts we have just posted. They are about IPsec/ESP minimal implementation and Diet-ESP designed for IoT.
>
> Comment are welcome!
>
> Best Regards,
> Daniel
>
>
> Name:        draft-mglt-dice-diet-esp
> Revision:    00
> Title:        Diet-ESP: a flexible and compressed format for IPsec/ESP
> Pages:        21
> URL:http://www.ietf.org/internet-drafts/draft-mglt-dice-diet-esp-00.txt
> Status:https://datatracker.ietf.org/doc/draft-mglt-dice-diet-esp/
> Htmlized:http://tools.ietf.org/html/draft-mglt-dice-diet-esp-00
>
>
> Abstract:
>    IPsec/ESP has been designed to secure IP packets exchanged between
>    two nodes.  IPsec implements security at the IP layer which makes
>    security transparent to the applications, as opposed to TLS or DTLS
>    that requires application to implement TLS/DTLS.  As a result, IPsec
>    enable to define the security rules in a similar way one establishes
>    firewall rules.
>
>    One of the IPsec's drawbacks is that implementing security on a per
>    packet basis adds overhead to each IP packet.  Considering IoT
>    devices, the data transmitted over an IP packet is expected to be
>    rather small, and the cost of sending extra bytes is so high that
>    IPsec/ESP can hardly be used for IoT as it is currently defined in
>    RFC 4303.
>
>    This document defines Diet-ESP, a protocol that compress and reduce
>    the ESP overhead of IPsec/ESP so that it can fit security and energy
>    efficient IoT requirements.  Diet-ESP use already existing mechanism
>    like IKEv2 to negotiate the compression format.  Furthermore a lot of
>    information, already existing for an IPsec Security Association, are
>    reused to offer light negotiation in addition to maximum compression.
>
>
> dtls-iot mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dtls-iot

-- 
Daniel Migault
Orange Labs -- Security
+33 6 70 72 69 58

---

From: Daniel Migault <[email-masked]>
Date: Thu, 13 Feb 2014 16:22:15 +0100

Hi,

ESP and IKEv2 are protocols of the IPsec suite. IKEv2 is a negotiation
protocol. It authenticates the peers, agrees on a secret keys, the
protocol used to secure the IPsec communication (ESP/AH), the
encryption algos and authentication algos... ESP defines the format of
the IP packet over the IPsec protected communication.

IPsec suites secures the IP datagram. That is, in the case of ESP, it
encrypts/authenticates the transport and upper layer. TLS/DTLS secures
everything above the transport layer.

I hope I answer the question.

BR,
Daniel

-- 
Daniel Migault
Orange Labs -- Security
+33 6 70 72 69 58

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 16 Feb 2014 19:23:55 +0000

Hi Daniel,

thanks for the pointer to the ipsecme agenda.

I agree with you that ipsecme would be the right place to get this work
done since the proposal makes changes to IPsec ESP and they have the
needed experience.

LWIG, as part of the charter, is not allowed to make changes to existing
protocols, as this snippet from the charter illustrates:
"
The group shall also not develop any new protocols or protocol behavior
modifications beyond what is already allowed by existing RFCs, because
it is important to ensure that different types of devices can work together.
"

Ciao
Hannes