Re: [6tisch] comment on draft-ietf-6tisch-minimal-06

Agreed

Sent from my iPhone

> On Mar 26, 2015, at 2:24 PM, Robert Cragie <robert.cragie@gridmerge.com> wrote:
> 
> I don't see any harm in the last sentence to clarify there is no restriction that the keys be different (which could be inferred from calling them K1 and K2).
> 
> Robert
> 
>> On 26 March 2015 at 18:53, Rene Struik <rstruik.ext@gmail.com> wrote:
>> Hi Kris:
>> 
>> The last sentence "Depending on security policy, these keys could be the same (i.e., K1=K2)" does exactly what you suggest in your email.
>> 
>> This sentence is included to cover potential deployments that use a network-wide key for all frame types (which is a security policy instantiation [which may be allowed or not]).
>> Rene
>> 
>> 
>>> On 3/26/2015 2:42 PM, Kris Pister wrote:
>>> I agree.  Once you have the mechanism to have two keys, higher level policy can
>>> specify what K1 and K2 are.  Rene - is there a reason to have that last line in there?
>>> 
>>> ksjp
>>> 
>>>> On 3/26/2015 11:39 AM, Michael Richardson wrote:
>>>>> NEW:
>>>>> The present document assumes the existence of two cryptographic keys,
>>>>> which can be pre-configured. One of the keys (K1) is used to
>>>>> authenticate EBs. As defined in Section 4, EBs MUST be authenticated,
>>>>> with no payload encryption. This facilitates logical segregation of
>>>>> distinct networks. A second key (K2) is used to authenticate DATA,
>>>>> ACKNOWLEDGEMENT, MAC COMMAND frame types and
>>>>> respective header IEs, with payload encryption.
>>>>> Depending on security policy, these keys could be the same (i.e., K1=K2).
>>>> I also believe it is important that the minimal document specify the use of
>>>> two keys.  This will put a clear requirement on protocol stacks that they
>>>> support more than one key, and that they figure out how to do this kind of
>>>> thing in their datapath processing.
>>>> 
>>>> I agree that we might later on write a document later on that defines K1==K2,
>>>> but I don't think that it is useful to include the last sentence.  I don't
>>>> know what the "depending" is, and it may confuse implementers into thinking
>>>> they can define the situation.
>>>> 
>>>> Leaving out the last sentence, I am happy with the text.
>>>> 
>>>> 
>>>> 
>>>> _______________________________________________
>>>> 6tisch mailing list
>>>> 6tisch@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/6tisch
>>> 
>>> 
>>> 
>>> _______________________________________________
>>> 6tisch mailing list
>>> 6tisch@ietf.org
>>> https://www.ietf.org/mailman/listinfo/6tisch
>> 
>> 
>> -- 
>> email: rstruik.ext@gmail.com | Skype: rstruik
>> cell: +1 (647) 867-5658 | US: +1 (415) 690-7363
>> 
>> _______________________________________________
>> 6tisch mailing list
>> 6tisch@ietf.org
>> https://www.ietf.org/mailman/listinfo/6tisch
> 
> _______________________________________________
> 6tisch mailing list
> 6tisch@ietf.org
> https://www.ietf.org/mailman/listinfo/6tisch