Robert Moskowitz, Verizon May 2011 Project: IEEE P802.15 Working Group for Wireless Personal Area Networks (WPANs) Submission Title: Key Management over 4e Multipurpose Frames Date Submitted: May 10, 2011 Source: Robert Moskowitz, Verizon Address 1000 Bent Creek Blvd, MechanicsBurg, PA, USA Voice:+1 (248) 968-9809, e-mail: rgm@labs.htt-consult.com Re: Key Managementn over 4e Multipurpose Frames Abstract: Using 4e Multipurpose Frames to provide for Key Mangement Purpose: To add Key Management capabilities to 15.4 Notice: This document has been prepared to assist the IEEE P802.15. It is offered as a basis for discussion and is not binding on the contributing individual(s) or organization(s). The material in this document is subject to change in form and content after further study. The contributor(s) reserve(s) the right to add, amend or withdraw material contained herein. Release: The contributor acknowledges and accepts that this contribution becomes the property of IEEE and may be made publicly available by P802.15. Robert Moskowitz, Verizon

Key Management over 15.4e Multipurpose Frames May 2011 Key Management over 15.4e Multipurpose Frames Robert Moskowitz San Francisco July 19, 2011 Robert Moskowitz, Verizon

Abstract To provide for a Key Management Protocol for 802.15.4 May 2011 Abstract To provide for a Key Management Protocol for 802.15.4 KMP agnostic Support: HIP, IKEv2, 802.1X, ... Use the new Multipurpose Frames added via 15.4e for the transport of the KMP frames Also Command Frames Robert Moskowitz, Verizon

Discussion 4e Multipurpose Frame Adds flexibility to 15.4 May 2011 Discussion 4e Multipurpose Frame Adds flexibility to 15.4 New functions without major standards revisions Provides for Information Elements Basic TLV – Type/Length/Value Robert Moskowitz, Verizon

Discussion KMP Information Element KMP type 4bits (HIP, IKEv2, 802.1X) May 2011 Discussion KMP Information Element KMP type 4bits (HIP, IKEv2, 802.1X) Chaining flag 2 bits (no, yes, last) Chaining REQUIRES frame ack Chain count 6bits (multiple frames per KMP packet) KMP payload For HIP see IETF 5201-bis and HIP- DEX Robert Moskowitz, Verizon

Discussion Short address for KMP frames (when HIP is KMP) May 2011 Discussion Short address for KMP frames (when HIP is KMP) I1 always uses long addresses HITs used derive short addresses Low order 16 bits? How to handle collisions? Include short addresses in R1 over long addresses, THEN I2 over short addresses to handle collisions? Robert Moskowitz, Verizon

May 2011 Discussion BEACONLESS PANs are commonly deployed and thus first step in participation would be to KMP over Multipurpose frames. BEACON PANs use ASSOCIATE Command Frames to start participation. These frames can contain IEs so they would be used for KMP transport. Robert Moskowitz, Verizon

Discussion HIT discovery and defense from Diffie- Hellman MITM attacks May 2011 Discussion HIT discovery and defense from Diffie- Hellman MITM attacks Assume Initiator has no knowledge of Responders HIT for I1, so use I1 opportunistic mode (no Responder HIT) Responder authenticates Initiator HIT Pre-configured ACL Restricted time window Robert Moskowitz, Verizon

May 2011 Moving Forward Create 802.15.4 Recommended Practice document for KMP support as outlined Include HIP DEX, IKEv2, and 802.1X guidelines Allow for other KMPs defined elsewhere Robert Moskowitz, Verizon

May 2011 Moving Forward Work with IETF with 'mess under' to support KMP within a 15.4 mess? E.G. to protect IPv6 Neighbor Discovery Robert Moskowitz, Verizon