Re: [6tisch-security] [Anima] (Fair) competition in pursuing ideas and dreams is good

Robert Cragie <robert.cragie@gridmerge.com> Thu, 05 March 2015 12:16 UTC

Return-Path: <robert.cragie@gridmerge.com>
X-Original-To: 6tisch-security@ietfa.amsl.com
Delivered-To: 6tisch-security@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 462931A1A79; Thu, 5 Mar 2015 04:16:32 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4r-emYtF_Kub; Thu, 5 Mar 2015 04:16:29 -0800 (PST)
Received: from mailscan1.extendcp.co.uk (mailscan33.extendcp.co.uk [79.170.42.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A11541A8773; Thu, 5 Mar 2015 04:16:28 -0800 (PST)
Received: from mailscanlb0.hi.local ([10.0.44.160] helo=mailscan2.extendcp.co.uk) by mailscan-g68.hi.local with esmtp (Exim 4.80.1) (envelope-from <robert.cragie@gridmerge.com>) id 1YTUhW-0006OP-8S; Thu, 05 Mar 2015 12:16:26 +0000
Received: from mailscanlb0.hi.local ([10.0.44.160] helo=mail41.extendcp.co.uk) by mailscan2.extendcp.co.uk with esmtps (UNKNOWN:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.80.1) (envelope-from <robert.cragie@gridmerge.com>) id 1YTUhU-0000mA-Ac; Thu, 05 Mar 2015 12:16:26 +0000
Received: from host86-171-66-135.range86-171.btcentralplus.com ([86.171.66.135] helo=[192.168.0.6]) by mail41.extendcp.com with esmtpsa (UNKNOWN:DHE-RSA-AES128-SHA:128) (Exim 4.80.1) id 1YTUhM-0007WM-Kh; Thu, 05 Mar 2015 12:16:17 +0000
Message-ID: <54F8490E.2000005@gridmerge.com>
Date: Thu, 05 Mar 2015 12:16:14 +0000
From: Robert Cragie <robert.cragie@gridmerge.com>
Organization: Gridmerge Ltd.
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0
MIME-Version: 1.0
To: Hannes Tschofenig <hannes.tschofenig@gmx.net>, Rene Struik <rstruik.ext@gmail.com>, Sheng Jiang <jiangsheng@huawei.com>, Brian E Carpenter <brian.e.carpenter@gmail.com>, "sarikaya@ieee.org" <sarikaya@ieee.org>
References: <77FA386512F0D748BC7C02C36EB1106D921776@szxeml557-mbs.china.huawei.com> <6426.1422664463@sandelman.ca> <77FA386512F0D748BC7C02C36EB1106D92CC62@szxeml557-mbs.china.huawei.com> <54E7219B.6040006@gridmerge.com> <54E72846.20807@gmx.net> <54E7824A.4040906@gmail.com> <cf14f8df23dc2552f062976775e76549@xs4all.nl> <54E86F9A.8020104@gmx.net> <54E8D442.6020909@gmail.com> <54EB4F24.7030609@gmx.net> <CAC8QAcfUDw8McE15gkCpDX5Ur+ZKaYx9mCOXNiS+_rCDHE2XTg@mail.gmail.com> <54EE6E31.8030609@gmail.com> <54F5E2FF.4040205@gmx.net> <54F60CD2.7030001@gmail.com> <54F627D2.5090806@gmail.com> <54F6305E.8060704@gmail.com> <5D36713D8A4E7348A7E10DF7437A4B923B0552CD@nkgeml512-mbx.china.huawei.com> <54F67E42.4090304@gmail.com> <54F6C220.8020801@gmx.net>
In-Reply-To: <54F6C220.8020801@gmx.net>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha1"; boundary="------------ms090003090204020204000105"
X-Authenticated-As: robert.cragie@gridmerge.com
X-Extend-Src: mailout
Archived-At: <http://mailarchive.ietf.org/arch/msg/6tisch-security/pyu-r6oj88gPqz6eAYJFbcmOsgc>
X-Mailman-Approved-At: Fri, 06 Mar 2015 09:03:59 -0800
Cc: "consultancy@vanderstok.org" <consultancy@vanderstok.org>, 6tisch-security <6tisch-security@ietf.org>, Michael Richardson <mcr+ietf@sandelman.ca>, "Hedanping (Ana)" <ana.hedanping@huawei.com>, "6lo@ietf.org" <6lo@ietf.org>, "anima@ietf.org" <anima@ietf.org>
Subject: Re: [6tisch-security] [Anima] (Fair) competition in pursuing ideas and dreams is good
X-BeenThere: 6tisch-security@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: robert.cragie@gridmerge.com
List-Id: Extended Design Team for 6TiSCH security architecture <6tisch-security.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/6tisch-security>, <mailto:6tisch-security-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/6tisch-security/>
List-Post: <mailto:6tisch-security@ietf.org>
List-Help: <mailto:6tisch-security-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/6tisch-security>, <mailto:6tisch-security-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 05 Mar 2015 12:16:32 -0000

The primary reason for Thread being done in a closed way is to focus on 
the specification and implementation thereof in a tight and controlled 
manner. ZigBee IP, which we did in conjunction with the IETF, resulted 
in continually shifting sands as the specifications kept changing. This 
meant it took a long time, with implementers continually having to 
change code, retest etc. This resulted in a lengthy and drawn out 
development which frankly we can't afford to do in Thread. Sure, there 
are risks with this approach but the aim is to contribute back on the 
"rough consensus and running code" basis. This is not a criticism of the 
IETF at all; it is simply an approach to manage the unpredictability 
which will naturally occur in an open development process. A liaison 
agreement will certainly help and rest assured there are some veterans 
involved in the Thread development who will make sure it is not too weird.

It's no secret that Thread is already based on a number of accepted 
Internet standards (http://threadgroup.org/Downloads.aspx). We have 
already successfully demonstrated Thread running in conjunction with 
another 6LoWPAN implementation, using border routers to connect to a 
server, with end-to-end CoAP transactions taking place. "6LoWPAN" per se 
never has been, nor ever will be an interoperable standard, hence the 
need for activities like Thread and ZigBee IP to ensure that product 
certified as such can be interoperable.

Robert

On 04/03/2015 08:28, Hannes Tschofenig wrote:
> While I agree with you, Rene, I still think it is useful to look at
> other work that is being done (particularly if they appear relevant to
> this group).
>
> With regards to the security aspects, I believe at least the following
> efforts appear relevant:
>
>   * TR69
>   * OMA LWM2M
>   * Netconf Zerotouch
>   * Certificate management protocols like EST, CMP, etc.
>   * IEEE 802.1AR
>
> (Maybe there are others.)
>
> Looking at those examples provides ideas about what worked well and what
> didn't.
>
> Ciao
> Hannes
>
> On 03/04/2015 04:38 AM, Rene Struik wrote:
>> Hi Sheng:
>>
>> I think you quite misinterpreted my email: I was just commenting on
>> guessing games re what industry consortia or others may have up their
>> sleeves (not easy to control or influence). From the numerous emails, I
>> got the impression that "Thread" was actually spelled as "Threat". This
>> email exchange would never have happened if it would have been another
>> "Attic project X".
>>
>> Of course, all goodies re striving for convergence and for consensus
>> apply (where discussion re relative technical merit could be viewed as
>> competition of ideas [and what IETF often does quite liberally]).
>>
>> Rene
>>
>> On 3/3/2015 8:22 PM, Sheng Jiang wrote:
>>>> On 04/03/2015 10:29, Rene Struik wrote:
>>>>> Dear colleagues:
>>>>>
>>>>> I don't understand all the excitement here: everyone is free to draw up
>>>>> architectural blueprints and complete designs to their liking. This can
>>>>> be done in the attic, as company-internal project, with an industry
>>>>> consortium, or with SDOs, such as IETF. There is  no way of knowing
>>>>> what
>>>>> people dream up in their attic or in a "secret" project X type of
>>>>> effort. Or, is the fear that IETF will loose its lustre?
>>>> No. The fear (and it has been realised many times in the past) is
>>>> that a closed consortium will agree on and start shipping a solution
>>>> which does not mesh well with the rest of the Internet. A liaison
>>>> arrangement can help to avoid that.
>>> The IETF is mainly a standardization organization. Most of efforts in
>>> IETF is for interoperation. IETF produces a bunch of open standards,
>>> no secret at all. Then every company can implementation the interface
>>> following these standards. Of course, there are many internal
>>> implementation, which does not need interoperation with other devices,
>>> and they can be closed or secret. Devices can then interoperate with
>>> each other as long as the all following the same standards.
>>>
>>> Consequently, the main efforts of standardization actually compromise
>>> rather than competition. It is all participators to work together
>>> towards a consensus, which most of people could live with (in which
>>> maybe everybody have something unsatisfied.) So, people are encouraged
>>> to discuss, coordinate, merge and make compromises. Working along and
>>> producing several competition solutions would NOT be good in any
>>> standardization organizations.
>>>
>>>>      Brian
>>>>
>>>>> Competition (without bullying) is good and is an enticement to consider
>>>>> solid designs and thinking outside of the
>>>>> "we-did-this-20-years-ago-like-this-and-therefore-have-to-stick-to-this"
>>>>>
>>>>> box (the flaky ones will end up with marketing and PR departments of
>>>>> competing efforts to poke fun at).
>>>>>
>>>>> Best regards, Rene
>>>>>
>>>>>
>>>>> On 3/3/2015 2:34 PM, Brian E Carpenter wrote:
>>>>>> On 04/03/2015 05:36, Hannes Tschofenig wrote:
>>>>>>> At the moment the specifications are only available to Thread members
>>>>>>> since the specification is still work in progress.
>>>>>>>
>>>>>>> I don't know when it will be finalized and released to the wider
>>>>>>> public.
>>>>>>>
>>>>>>> Regarding the liaison I do not have an opinion about the value of it.
>>>>>> It is precisely to get access before the work is finalised, so that it
>>>>>> can be reviewed by all the right people. We know that closed standards
>>>>>> development produces bad standards.
>>>>>>
>>>>>>        Brian
>>>>>>
>>>>>>> Ciao
>>>>>>> Hannes
>>>>>>>
>>>>>>>
>>>>>>> On 02/26/2015 01:52 AM, Brian E Carpenter wrote:
>>>>>>>> On 26/02/2015 10:25, Behcet Sarikaya wrote:
>>>>>>>>
>>>>>>>> ...
>>>>>>>>>>> I know nothing about Thread, whatever and whoever it is.
>>>>>>>>>> Here is an intro document:
>>>>>>>>>> http://threadgroup.org/Portals/0/documents/events/ThreadIntro.pdf
>>>>>>>> Thanks for that. It seems to have all the downsides of secretive
>>>>>>>> ad hoc
>>>>>>>> membership-based consortia, except for the upside of a RAND-RF IPR
>>>>>>>> policy.
>>>>>>>>
>>>>>>>>> I think we need to clarify here that Thread Group is formed to deal
>>>>>>>>> with home environments.
>>>>>>>>>
>>>>>>>>> Enterprise or industrial environments seem to be excluded.
>>>>>>>> So far. The boundary between this and larger building services
>>>>>>>> networks is pretty fuzzy, isn't it?
>>>>>>>>
>>>>>>>> In any case, should we (the WGs on copy, and perhaps some others)
>>>>>>>> be asking the IAB to arrange a meaningful liaison with Thread?
>>>>>>>>
>>>>>>>> Back at Hannes: is there a spec for their approach to security
>>>>>>>> enrollment?
>>>>>>>>
>>>>>>>>       Brian
>>>>>>>>
>>>>>>>> _______________________________________________
>>>>>>>> Anima mailing list
>>>>>>>> Anima@ietf.org
>>>>>>>> https://www.ietf.org/mailman/listinfo/anima
>>>>>>>>
>>>>>> _______________________________________________
>>>>>> 6tisch-security mailing list
>>>>>> 6tisch-security@ietf.org
>>>>>> https://www.ietf.org/mailman/listinfo/6tisch-security
>>>> _______________________________________________
>>>> Anima mailing list
>>>> Anima@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/anima
>>> _______________________________________________
>>> Anima mailing list
>>> Anima@ietf.org
>>> https://www.ietf.org/mailman/listinfo/anima
>>