Re: Access control for IoT

On Sat, 2016-01-16 at 10:26 -0800, Tony Arcieri wrote:
> On Sat, Jan 16, 2016 at 9:59 AM, Alan Karp <[email protected]> wrote:
> 
> > I think one reason for lack of interoperability is the desire for lock-in
> > by the vendors.  Another is lack of standards.
> >
> > As far as privacy versus functionality, I believe 99+% of people will
> > choose the latter without blinking an eye.
> >
> 
> IoT is in a tough spot. Devices are constrained, so implementers often seek
> to cut corners on the systems they use in order to boost performance and/or
> reduce power usage.
> 
> At the same time, these devices require lots of functionality out of the
> cryptosystems they use for secure operation and access control.

most devices used for IoT come with 32K of memory, do not run true
operating system, they run small programs that provide only the required
control/information functionality. Those devices have ethernet or wifi
links. How do you implement access control given that the device will
connect to a local server?


> These two constraints don't play well together, and the result is often
> quite broken.
> 
> I was just at RealWorldCrypto where a speaker from Microsoft was talking
> about a transport encryption protocol designed for non-IP-based transports
> used by IoT devices. He threw up a slide with a protocol description and
> someone in the audience broke it on the spot (identity misbinding attack).
> 
> SecureRF is pushing their "Algebraic Eraser" public key algorithm, which
> they claim has performance which scales linearly to the key size as opposed
> to quadratically like ECC or RSA:
> 
> https://twitter.com/kennyog/status/688409890914717700
> 
> But it was already broken once, and apparently a new paper is coming out
> next week breaking their "fix".
> 
> I have seen plenty of IoT frameworks from real cryptographers which look
> rather interesting, but these are all research projects which are
> half-baked and don't have a suitable implementation for use on real
> hardware.
> 
> All that said, as far as I can tell there really isn't anything to
> recommend so far that remotely resembles a real option in this space. The
> best I can recommend are half-baked research projects.
> 
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk