Side meeting: Security for 802.15.4 @ Summit

Community
2

My summary of how I see the roadmap:

  1. Solve the persistence issues, possibly together with the PSA topic
  2. Make the 802.15.4 security module get its numbers from there.

At this point, we fix https://github.com/RIOT-OS/RIOT/issues/16844 and get very minimal security at the level of WEP (shared key that doesn’t get changed, and is burnt into every device)

  1. Implement CoJP.

Now we can roll over network keys, and kick devices from the network.

  1. Implement EDHOC, get network keys with CoJP+EDHOC.

Now we don’t have to provision devices with knowledge of the network, but can enroll them by just handing their public key to the JRC.

Unless we use 6TiSCH at this point, we still need to use local persistence.

  1. Implement ACE-AUTHZ in addition.

Now the device can connect to a network even if it wasn’t told beforehand that this is the network to connect to.

  1. Do something for keys not shared across the network.

I don’t know which specs to use here, and don’t see a strong use case. (I’d use this if different devices have different quotas of outbound traffic or stuff like that, which is a weak case).

Personally, I’d be happy to get to 2 already.