**Session Date/Time:** 08 Nov 2022 13:00

# iotops

## Summary
This iotops session at IETF 115 in London covered several topics, including device onboarding using SCIM, a draft on baseline security requirements, a new approach to authorization using Power of Attorney (POA), and an attestation-based TLS handshake. The session concluded with a discussion about adopting two drafts from the airwig working group.

## Key Discussion Points

*   **SCIM for Devices (Elliot):**
    *   Presented a draft extending SCIM for device onboarding and provisioning.
    *   Addresses provisioning new devices, establishing bootstrapping credentials, and handling ancillary information and API endpoints.
    *   Open for discussion on the SCIM working group, with co-authors, reviewers, and implementers needed.
    *   Raised concerns about reverse authentication flows compared to typical user provisioning and the need for cross-working group collaboration.
*   **Baseline Security Requirements (Brendan):**
    *   Presented a draft mapping baseline security requirements from sources like NIST and ENISA to IETF technologies.
    *   Seeks to provide a "landing pad" for information on building secure IoT solutions.
    *   Looking for contributors to map additional security requirements documents.
    *   A call for adoption as an iotops document was discussed, with an in-room assessment showing support.
    *   Discussion included gaps in the current mapping, particularly concerning onboarding guidance.
*   **Power of Attorney (POA) for Authorization (Ulo & Ss3):**
    *   Introduced a POA-based authorization mechanism for delegating authority, particularly in onboarding scenarios.
    *   Use case focused on subcontractor onboarding in industrial environments.
    *   Utilizes JWTs to represent POAs and supports multi-level sub-granting.
    *   Discussion focused on differentiation from OAuth, potential overlap with the skit working group, and revocation strategies.
    *   Suggestions included considering FIDO device onboarding and potentially reframing the concept as an access control mechanism rather than onboarding.
*   **Attestation-Based TLS Handshake (Hannes):**
    *   Presented an attestation-based TLS handshake using platform and key attestation tokens.
    *   Focuses on verifying the integrity of the device's software before establishing a secure channel.
    *   Uses a new TLS extension to negotiate attestation technology and pass nonces.
    *   Prototyping efforts are sponsored by the Confidential Computing Consortium.
    *   Discussion covered the ephemeral nature of the identity key, the frequency of attestation, and the possibility of attesting the server to the client.
*   **airwig Working Group Drafts (Carsten):**
    *   Proposed transferring two active drafts from the airwig working group (which is winding down) to iotops.
    *   Drafts cover terminology for constrained node networks (7228bis) and a comparison of security protocols.
    *   An in-room assessment indicated support for adopting the terminology document within the iotops scope.

## Decisions and Action Items

*   **Brendan's Draft:** A formal working group adoption call will be made on the mailing list for the "Baseline Security Requirements" draft.
*   **airwig Drafts:** iotops will take the next steps to determine with the isg and the relevant ADs whether adoption of the "Terminology for Constrained Node Networks (7228bis)" draft is possible.

## Next Steps

*   **SCIM for Devices:** Elliot will follow up with the SCIM working group and continue to provide updates to iotops.
*   **Baseline Security Requirements:** Hold a formal adoption call on the mailing list.
*   **Power of Attorney:** Ulo and Ss3 will explore relevant discussions in the skit and oauth working groups.
*   **Attestation-Based TLS Handshake:** Hannes will continue developing the prototype and documentation, taking feedback into account.
*   **airwig Drafts:** Chairs will discuss the potential adoption of the airwig drafts with relevant ADs.