00:07:27 RRSAgent has joined #wot 00:07:27 logging to http://www.w3.org/2015/11/01-wot-irc 00:07:43 present+ Sebastian_Kaebisch 00:09:43 Meeting: IRTF T2T RG/W3C WoT IG Joint Meeting - Day 2 00:10:44 topic: Reports from Breakouts 00:11:36 s/Reports from Breakouts/Today's agenda 00:12:45 carsten: quickly skims the agenda 00:13:34 topic: Reports from breakouts 00:13:43 topic: W3C and IRTF Alignment 00:14:20 @@1: W3C WoT IG is tackling Thing Description 00:14:59 ... machine-readable format based on JSON-LD 00:15:43 ... Data Model and Semantics and application protocols 00:15:48 ... testing for IPv6 00:16:19 akira has joined #wot 00:16:23 ... understanding WoT IG's work 00:16:56 ... long-running apps and status transition 00:17:29 ... it sounds like generic and not industry specific 00:17:40 ... "TD" stands for Thing Description 00:17:57 s/industry specific/application-specific 00:18:26 ... mapping to CoAP 00:18:54 ... abstract conept and bind to protocols 00:19:13 ... focus on RES 00:19:17 s/RES/REST 00:19:50 ... plugfest done for REST-full systems 00:20:19 ... need to see how TD works for non-REST systems 00:20:33 ... discussion on cookbook 00:21:02 ... i.e., Ari's early adaptation document 00:21:57 ... TD more like the entry points 00:22:24 ... model of the services must be programmmed into the client 00:22:55 ... collection resources (CoMi, CoOL) 00:23:29 ... new concepts 00:24:13 ... Question: should we have compatible "IoT" and Web" worlds? or isOK to have app/domain specific proxies? 00:25:10 ... problem is nothing for testing 00:25:18 ... PlugREST discussion 00:25:44 ... T2T RG to finish our testing and W3C WoT IG to see the results 00:26:00 ... big idea to use REST architecture 00:26:23 ... joint meeting ind of January in France? 00:27:40 carsten: webex call, hangout, etc.? 00:28:31 ... would be good to have discussion on the ML 00:28:44 ... issues complete? 00:28:56 @@1: collection of resources 00:29:07 ... Alex will also continue that 00:29:57 ari: would try to discuss more 00:30:28 @@2: should not try everything 00:31:08 ... if there is a single resource, it's OK 00:31:16 ... but not, we need resource collection 00:31:48 carsten: how to continue? 00:31:55 @@1: ought to continue discussion 00:32:09 topic: Security breakout 00:32:17 carsten: what are the output documents 00:32:46 ... draft-garcia 00:32:56 ... cover whole lifecycle, avoid "media breaks" 00:33:09 ... everything security, including ACE 00:33:25 ... Sandeep's comments 00:34:12 ... easily could become 100 of pages 00:34:56 ... terminology 00:35:40 ... SF's comments 00:36:09 ... device ownership 00:36:36 s/device/handing over device/ 00:36:46 q+ to ask about rent-a-car scenario 00:36:59 ... e.g., hotel room scenario 00:37:07 q? 00:37:14 Zakim has joined #wot 00:37:20 q+ to ask about rent-a-car scenario 00:37:37 ... vendor role, OS provider, app-store provider, OEMs, ODMs 00:38:06 ... cross domain, e.g., car-to-car communication 00:38:35 ... Editor team: Sandeep, Mohit 00:38:52 ... the second document: Security Bootstrapping 00:38:55 ... very old document 00:39:18 ... need more vendors 00:39:35 ... a new survey document different from the previous one 00:39:43 ... Contributors: Mohit, Carsten 00:40:00 ... list solutions and reference draft-garcia 00:40:13 ... everything security, but not covered by ACE 00:40:19 s/, but/but 00:40:28 ... app security vs. network security 00:40:46 ... pre-operational security issues 00:41:07 ... terms 00:41:19 ... pre-operational setup including discovery 00:41:29 ... possible solutions documents 00:41:58 ... small windows of vulnerability -- acceptability of limited opportunity to exploit 00:42:02 ... usability 00:42:49 ... per-solution charastrics 00:43:07 ... manufactured with key 00:43:11 ... out-of-band channels 00:43:14 ... usability 00:43:19 ... what is provisioned 00:43:26 .... bundles 00:43:32 ... interfaces to shopping systems 00:43:41 ... peer-topeer vs. infrastructure-based 00:43:48 ... registration, authentication of human users 00:43:57 ... rebootstrapping, ownership hanover 00:44:13 s/hanover/handover 00:46:32 kaz: there is security discussion within the W3C Automotive group as well 00:47:07 ... would suggest even stronger collaboration between IRTF T2T and W3C 00:47:19 ... e.g., work with the W3C Automotive group as well 00:47:23 carsten: agree 00:47:34 ... next, Report from W3C WoT IG 00:47:53 ... Oliver reports from W3C WoT IG IoT breakout session 00:48:07 ... cunsensus on landscape of security&privacy means 00:48:48 ... W3C is a Member consortium, so need to be a Member company employee or an Invited Expert 00:49:16 mark: W3C discussion is done using public mailing lists 00:50:21 s/... cunsensus on landscape of security&privacy means// 00:50:34 carsten: consensus on landscape of security&privacy means 00:50:51 ... extensive toolset for security&privacy 00:51:23 ... web security mechanisms need to be standard 00:51:41 ... technology generations 00:51:55 ... classic (Kerberos, SAML, TLS, ...) 00:52:07 ... new (OAuth, FIDO, ...) 00:52:08 ... and future ones 00:52:22 ... specific WoT needs 00:52:35 ... physical objects 00:52:46 ... constrained devices 00:52:58 ... constrained networks 00:53:27 ... TLS is the only really standardized one 00:53:40 ... links to the W3C work 00:55:24 ... https://www.w3.org/WoT/IG/wiki -> ttps://www.w3.org/WoT/IG/wiki/Security,_Privacy_and_Resilience -> https://www.w3.org/WoT/IG/wiki/Landscae_of)Security%26Privacy_Means -> https://wee.w3.org/WoT/IG/wiki/Design-time_Security%26Privacy_Means 00:56:01 ... can invite people to W3C's bi-weekly webex calls 00:56:14 ... other W3C WGs exists 00:56:30 s/exists/exist 00:56:46 ... want to understand the relationship to Web security model 00:57:20 rrsagent, draft minutes 00:57:20 I have made the request to generate http://www.w3.org/2015/11/01-wot-minutes.html kaz 00:57:41 ... Actuator security 00:58:05 ... need freshness 00:58:26 ... DTLS (replay protection) doesn't guard against delay attacks 00:58:36 ... limited validty time of authorized commands 01:00:54 ... 1st exchange: get a token and a clock value 01:01:17 ... 2nd exchange: client updates the clock value ... another 2nd exchange: client updates the clock value again 01:02:11 ... standardization for token and clock value 01:02:33 rrsagent, draft minutes 01:02:33 I have made the request to generate http://www.w3.org/2015/11/01-wot-minutes.html kaz 01:02:49 ... ideas on the next steps? 01:03:24 dsr: happy to talk about my personal views 01:03:45 carsten: more like the breakout A (=W3C collaboration) 01:04:17 carsten: move on the agenda 01:04:36 ... alex to give his presentation 01:04:48 s/@@3:/alex:/ 01:05:12 alex: would present a couple of slides 01:05:25 ... CoOL (Constrained Objects Language) 01:05:43 ... Alexander Pelov 01:06:14 ... You want to manage things 01:06:29 ... constrained domain vs. non-constrained domain 01:06:45 ... RESTCONF + YANG model language 01:07:05 Is there a feed or file for the slides? 01:08:02 ... yesterday we had a couple of discussion (during the breakout A) 01:08:44 ... want to manage LPWAN (LR-WAN) 01:08:58 ... 10000 devices per antenna 01:09:08 ... 50kbps max (can be 270 bps) 01:09:17 ... 1-10% dury cycle 01:09:27 ... see draft-pelov-core-cosol-00 01:09:47 ... CoOL 01:09:56 ... CoOL + YANG 01:10:12 ... Identifier 32 bits, CBOR magic (1 byte) + Collections 01:10:13 q? 01:10:17 ack k 01:10:17 kaz, you wanted to ask about rent-a-car scenario 01:10:58 dsr: depending on the number of the server? 01:11:31 alex: T2T management 01:11:45 ... Thread/ZigBee/Other 01:11:59 ... Architecture 01:12:25 ... CoOL client over CoAP client over Lower layers 01:12:43 ... CoOL server 01:12:50 ... CoOL 01:12:58 ... perform on a single resources 01:13:10 ... "Fields" option contains the list of nodes 01:13:31 s/nodes/nodes/selected, encoded using a CBOR array 01:13:53 ... CoMI vs CoOL - Identifiers 01:14:51 ... CoMI: unmanaged, Hash(long identifier), Collisions (re-hashing, handling thousands of nodes) 01:15:28 CoOL: managed, module ID (20bits) + Node ID (10 bits), automatically allocated, cenral repository for modules, e.g., IANA 01:16:23 ... regarding URI 01:16:54 ... CoMI: BASE64 mapping (30bits -> 5URIsafe chars) 01:17:02 ... Conclusion CoOL 01:17:07 ... managed IDs 01:17:15 ... RESTful collections 01:17:21 s/RESTfull/RESTful/ 01:17:28 ... explicit PATCH 01:17:34 ... use CoOL to manage apps 01:17:45 ... next steps 01:17:58 ... use of deterministic multimaps vs maps 01:18:16 ... multicast for application management 01:18:53 ... e.g., turning on all lights on one controller 01:19:07 daniel: @@@d 01:19:12 alex: module IDs 01:19:23 ... 200-300 01:19:40 rrsagent, draft minutes 01:19:40 I have made the request to generate http://www.w3.org/2015/11/01-wot-minutes.html kaz 01:20:28 carsten: we have had what the efficient tools for managing devices 01:20:42 s/had/had discussions on 01:21:10 ... structure of management information 01:21:27 ... transition from SMI to YANG? 01:21:40 kunitake has joined #wot 01:22:08 ... next step to see NETCONF 01:22:17 s/NETCONF/RESTCONF/ 01:22:33 ... module identifier 01:22:53 ... YANG is xml-based 01:23:01 ... using XPath 01:23:12 ... have to do something for any cases 01:25:18 @@@4: constraint to get back to every device? 01:26:13 ... issues on hierarchical mechanism vs. flat mechanism 01:26:48 topic: CoAP FETCH (Carsten) 01:26:57 ... this problem 01:27:09 ... https://maps.google.com/maps?........ 01:27:48 ... What if > ~ 1KiB? 01:27:57 ... switch to POST? 01:28:09 ... can send detailed parameters in payload instead 01:28:17 ... lose GET properties 01:28:24 ... safe, idempotent 01:28:52 ... HTTP SEARCH 01:29:01 ... like GET 01:29:07 ... add a body 01:29:22 .. no longer need to POST a > 1KiB search 01:29:53 rrsagent, draft minutes 01:29:53 I have made the request to generate http://www.w3.org/2015/11/01-wot-minutes.html kaz 01:30:41 ... CoAP FETCH 01:30:49 ... similar to HTTP SEARCH 01:30:57 ... add request payload to a GET 01:31:12 ... slightly different semantics: cacheable 01:32:05 ... FETCH and collectins 01:32:15 ... FETCH request payload has a media type 01:32:24 ... can define application-specific formats 01:32:35 ... addressing collections 01:32:38 ... Caveat 01:32:45 ... GET operates on a link 01:33:12 ... FETCH additionally requires guidance how to construct payload (form relations!) 01:35:02 ... with GET, can tell how to move to the destination 01:35:11 FETCH rhymes with PATCH 01:35:20 ... GET, PUT, POST, DELETE 01:35:28 ... FETCH, iPATCH, PATCH 01:36:55 ... patch payload, e.g. { * selector => action } 01:37:08 s/FETCH rhymes/... FETCH rhymes/ 01:37:37 rrsagent, draft minutes 01:37:37 I have made the request to generate http://www.w3.org/2015/11/01-wot-minutes.html kaz 01:38:29 Sebastian has joined #wot 01:39:45 ... moved towards to this general solution 01:43:30 johannes: clear mapping between FETCH and PATCH? 01:43:54 carsten: good questions 01:44:13 ... probably more than one operations for FETCH 01:44:28 ... e.g., the long URI of Google Maps 01:44:52 ... can be mechanically translated 01:45:13 johannes: might be a recommendation/guideline for that? 01:45:38 s/between FETCH and PATCH/for FETCH 01:46:02 carsten: 1h50m till lunch 01:46:37 ... can go into breakouts again 01:48:05 (some comments) 01:48:15 carsten: coffee break till eleven, and then breakouts 01:48:20 [ morning break ] 01:48:25 rrsagent, draft minutes 01:48:25 I have made the request to generate http://www.w3.org/2015/11/01-wot-minutes.html kaz 02:03:54 topic: Charter (Carsten) 02:04:09 carsten: put topics on his emacs 02:04:25 ... Charter 02:04:33 ... -- deliverables 02:04:40 ... ---- REST cookbook 02:04:56 ... ---- security considerations 02:05:06 ... ---- bootstrapping survey 02:05:06 ... 02:05:12 ... ---- plugREST 02:05:35 ... ------ documents: reference framework, prototype formats/protocols 02:05:40 ... ------ software 02:05:45 ari: give comments 02:05:55 carsten: updates the list 02:06:18 s/REST cookbook/REST cookbook (limited discussion of HATEOAS) 02:06:41 i/plugREST/... ---- link types, form types, HATEOAS/ 02:06:48 rrsagent, draft minutes 02:06:48 I have made the request to generate http://www.w3.org/2015/11/01-wot-minutes.html kaz 02:07:27 (some more comments) 02:08:01 s/security considerations/security considerations (from draft-garcia)/ 02:08:19 s/bootstrapping survey/bootstrapping survey (from draft-he) 02:08:57 carsten: a couple topics from draft-keranen-t2trg-iot 02:09:30 i/security considerations/(from draft-keranen-t2trg-iot), design patterns/ 02:10:16 rrsagent, make log public 02:10:27 rrsagent, draft minutes 02:10:27 I have made the request to generate http://www.w3.org/2015/11/01-wot-minutes.html kaz 02:11:13 carsten: milestones? 02:11:21 ... next joint meeting with W3C in January? 02:11:46 dsr: Jan. 26? 02:11:52 joerg: maybe 28? 02:12:08 ... actually earlier 02:12:08 ... 25/26 02:13:02 joerg: plugfest and plugrest might be linked to breakout a 02:14:10 carsten: splits plugREST into two pieces and bring "plugREST: initial testing" to track b 02:15:08 ... goes to breakout b 02:16:09 ... add "weekly activity mid-Nov to mid-Jan" to milestone section 02:16:12 ... meetings: 02:16:22 ... Jan 25th 02:16:37 ... Eurocom says they have space to meet 02:17:08 ... Berlin IETF96, July 02:18:48 i/Berlin/... (April 12-14 W3C, North America, maybe MIT)/ 02:19:09 i/Berlin/... IETF95, April 3-8, Buenos Aires 02:19:22 rrsagent, draft minutes 02:19:22 I have made the request to generate http://www.w3.org/2015/11/01-wot-minutes.html kaz 02:35:15 carsten: Carter for proposed RG 02:35:38 ... https://jabber.ietf.org/logs/t2trg/ 02:38:02 s/https/Logs: https/ 02:39:19 ... T2TRG Charter: https://datatracker.ietf.org/rg/t2trg/charter/ 02:40:39 joerg: suggest we make the charter discussion the focal at the Spain meeting 02:41:25 s/the Spain meeting/Sigcomm conf/ 02:42:44 topic: Achileas 02:43:09 ... T2T RG work active in collaboration with IETF 02:43:20 s/IETF/IETF innovation/ 02:43:59 ... 100M budget 02:44:06 ... 6 big areas 02:44:31 s/Achileas/Achilleas 02:45:08 s/Achilleas/Achilleas Kemos: AIOTI work/ 02:45:22 ... workshop Wednesday, 2015-11-04 in Brussels 02:47:34 i/T2T/achilleas: AIOTI European Commission 02:47:54 s/T2T/achilleas: T2T/ 02:48:23 rrsagent, draft minutes 02:48:23 I have made the request to generate http://www.w3.org/2015/11/01-wot-minutes.html kaz 02:48:38 [ break for Lunch till 1pm ] 02:48:56 breakout A: Room 304 02:49:08 breakout B: room 513 02:49:09 rrsagent, draft minutes 02:49:09 I have made the request to generate http://www.w3.org/2015/11/01-wot-minutes.html kaz 03:10:39 Zakim has left #wot 04:06:55 cabo has joined #wot 04:35:26 kaz has joined #wot 05:19:01 naokis has joined #wot 05:59:10 cabo1 has joined #wot 07:00:07 cabo has joined #wot 07:33:27 cabo has joined #wot 11:00:41 kaz has joined #wot 11:01:01 s/mark:/cullen:/ 11:01:05 s/mark:/cullen:/g 11:01:09 rrsagent, draft minutes 11:01:09 I have made the request to generate http://www.w3.org/2015/11/01-wot-minutes.html kaz 11:42:19 naokis has joined #wot 11:57:46 naokis has joined #wot 13:24:59 knagano has joined #wot 14:19:51 knagano has joined #wot 15:33:07 knagano has joined #wot 21:48:48 kaz has joined #wot 22:09:59 dfr has joined #wot 23:00:05 knagano has joined #wot 23:07:31 cabo has joined #wot 23:09:03 cabo1 has joined #wot