Meeting minutes
Minutes review
McCool: Oct 18
… also joint meeting with IRTF T2TRG and DID meeting
McCool: (goes through the minutes from Oct 28 meeting)
Kaz: (fixes typos, etc.)
(some discussion on IDs within local environment)
McCool: (adds a comment to the GitHub Issue)
wot-security-best-practices issue 14 - TD Signatures, Key Management, and Object Security
McCool: suggested actions
… 1. best WoT practice should be to use TLS for all WoT Things when using HTTP. Otherwise almost all other security measures are broken.
Philipp: TLS works well without your own key management system
McCool: (adds clarification)
… TLS does work locally, as long as an identity can be confirmed for an endpoint
… regular DNS is fine
… a public URL (using DNS, which avoids duplicate registrations) does this but a hardware key and a derived ID could also be used on a LAN
… mDNS (e.g., .local names) do not sine they can be easily spoofed.
… To do: check BREWSKI; there might be a means to combine mDNS, hardware keys, and encryption to generate unspoofable names
RFC8995 - Bootstrapping Remote Secure Key Infrastructure (BRSKI)
Philipp: not only for HTTP but also CoAP?
McCool: (adds DTLS for CoAP/UDP in addition to HTTP/TCP)
… suggested action 2
… for non-browsers operating on a LAN, e.g., hubs talking to devices, they can use an onboarding process or some other mechanism to establish device identities and set up secure connections.
… To Do: consider some specific recommendations for this case, e.g., BRSKI
… suggested action 3
… for browser access, they will (currently) have to use a public URL
… e.g., via a clod proxy or a URL exposed thourhg the ISP and firewall using STUN/TURN and/or DyDNS.
… ohwever this should be limited to a small number of "remote access points", e.g., to a hub dashboard.
Philipp: we should have some recommendation
… but should not limit the possible methods to it
McCool: we should clarify best practices
Philipp: ok
McCool: suggested action 4
… add a recommendation that the number of public URLs should be minimized.
Kaz: technically, we should say "for systems that don't support secure local access, e.g., browsers currently" instead of "browsers have to..."
McCool: (adds the modification)
… my question here is that regular IoT devices don't be regularly updated
Philipp: update is a good point
McCool: should have a best practice to have mechanism to support secure updates. To Do: look at SUIT.
McCool's comments for Issue 14 based on the discussion today
added one line comment to see the above comments to Issue 13 as well
McCool: regarding the minutes for item 6 from vF2F Day 5
… and item 7
… item 6 and 7 to be merged, I think
… objections to approve those sections?
(none)
(approved)
[adjourned]