13:02:19 RRSAgent has joined #wot-sec 13:02:19 logging to https://www.w3.org/2022/01/24-wot-sec-irc 13:02:56 meeting: WoT Security 13:03:38 present+ Kaz_Ashimura, Jiye_Park, Michael_McCool 13:03:43 chair: McCool 13:07:58 present+ Tomoaki_Mizushima 13:08:46 agenda: https://www.w3.org/WoT/IG/wiki/IG_Security_WebConf#24_January_2022 13:09:08 topic: Minutes 13:09:17 -> https://www.w3.org/2022/01/17-wot-sec-minutes.html Jan-17 13:12:52 approved 13:12:59 topic: Issues 13:13:04 subtopic: Discovery 13:13:44 -> https://github.com/w3c/wot-discovery/issues/263 wot-discovery issue 263 - Profile needs a simple self descriptive mechanism without huge implementation demands 13:15:37 mm: we were planning to make onboarding out of scope, but it seems we need it 13:16:07 ... for example, habs talking with devices 13:16:58 ... any thoughts? 13:17:07 jp: not looked at it yet 13:17:17 ... will see it after this call 13:18:05 mm: (adds comments) 13:18:32 ... disallow self-description under plain HTTP 13:18:43 ... (would essentially disallow it on LANS) 13:21:44 s/LANS/LANs unless some other mechanism, not described in the profile or discovery specs, was used to assign certs to devices) 13:22:03 ... this basically converts the SHOULD in the Discovery spec to a MUST. 13:24:03 ... in practice, it means an on-boarding process needs to be used but is not 13:24:40 jp: browsers may reject the self-signed certs. right? 13:24:44 mm: yeah 13:24:54 s/is not/is not.../ 13:25:17 ... (modifies the comments a bit) 13:25:33 ... on a LAN, raw public keys should be use din place of certs 13:27:45 jp: based on the connection between the server and the client 13:27:51 ... need to check, though 13:27:59 mm: ok 13:28:28 s/certs/certs to set up HTTPS/ 13:28:40 jp: we can check the pre-shared key 13:28:53 mm: we can check the HTTPS spec 13:29:33 jp: please share the resource too 13:29:41 mm: need to check later 13:29:56 ... possibly empty cert can be used 13:31:10 jiye has joined #wot-sec 13:31:11 https://datatracker.ietf.org/doc/html/rfc5246 13:31:15 jp: looking at RFC5246 13:31:21 McCool has joined #wot-sec 13:31:31 https://datatracker.ietf.org/doc/html/rfc5246 13:33:10 s|https://datatracker.ietf.org/doc/html/rfc5246|| 13:33:24 mm: (goes through the RFC 5246) 13:34:25 https://datatracker.ietf.org/doc/html/rfc4279 13:34:47 TLS_RSA_PSK_WITH_RC4_128_SHA RSA_PSK RC4_128 SHA TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA RSA_PSK 3DES_EDE_CBC SHA TLS_RSA_PSK_WITH_AES_128_CBC_SHA RSA_PSK AES_128_CBC SHA TLS_RSA_PSK_WITH_AES_256_CBC_SHA RSA_PSK AES_256_CBC SHA 13:35:55 jy: another RFC (4279) about PSK Ciphersuites for TLS 13:36:35 ... can be used with TLS 1.2 13:40:38 mm: (updates the comments based on the discussion) 13:41:06 ... not essential to define an onboarding process in Profiles 13:41:33 s/Profiles/Profiles (due to time limitation)/ 13:41:57 ... but let's take care of the basics before even considering whether we should do so 13:42:40 ... (copy part of the comments to wot-discovery issue 254) 13:44:41 -> https://github.com/w3c/wot-discovery/issues/254 wot-discovery issue 254 - Review Security and Privacy Considerations 13:45:02 mm: on a LAN, recommend that pre-shared keys be used in place of certs 13:45:20 ... see RFC4279 for cipher suites that can be used with TLS 1.2. 13:45:34 ... see linked issue #263 for discussion 13:45:56 ... The other mitigation is to NOT support self-discovery if security cannot be established. 13:52:34 ... note that passwords, etc., still need to be used since different passwords/tokes/etc. may provide different access levels to different users. 13:52:47 ... the PSK should not be the only access control. 13:53:02 ... in particular, do not use 'nosec' even with PSK. 13:53:28 ... ALso, the PSK should be unique to the device pair and not used for any other purpose. 13:53:48 ... if the PSK is derived from the id of the Thing (or encodes it somehow). 13:56:00 ... the PSK may be derived from internal device identity but this is separate from the "id" used in the Thing. 13:56:19 ... the Thing should NOT be revealing its internal identity 13:56:34 https://github.com/w3c/wot-discovery/issues/254 13:56:42 please commend on this issue for followup 13:56:54 i/https/... however, we do need a separate recommendation somewhere (profile? or TD?)/ 13:57:50 mm: would start with generating a PR 13:58:11 s/PR/PR for wot-discovery/ 14:00:08 https://github.com/w3c/wot-discovery/pull/264 14:00:20 s|https|-> https| 14:00:35 s|264|264 PR 264 - Update Security and Privacy Considerations| 14:00:42 mm: will add you to reviewers 14:00:44 jp: ok 14:02:13 [adjourned] 14:02:20 rrsagent, make log public 14:02:22 rrsagent, draft minutes 14:02:22 I have made the request to generate https://www.w3.org/2022/01/24-wot-sec-minutes.html kaz 15:02:47 Mizushima has left #wot-sec 15:30:36 Zakim has left #wot-sec