[6tisch-security] ***SPAM*** 5.568 (5) authz in the form a cert chain.. from SIDR work

[Michael Richardson <[e-mail]>]

In my original 802.1AR enabled device claim idea, I imagine a certificate
chain rooted in the Factory CA that would already be present in the mote.

To make it easier to explain, and talk about, I'm going to give some names.
   Factory:       ACME
   National-VAR:  Cadabra
   Regional-Var:  Sesame
   Plant:         Coyote

So, the manager (Wiley) at the Coyote Plan, has just received 1000 new
(wireless) Road-Runner Detector, and plans to spread them along the highway.
The detectors are IDevID 210001 through 210999.  Each Detector has
an 802.1AR certificate pre-installed that looks like:
        Issuer: C=US, ST=New Jersey, L=Fairfield,
                O=ACME Rocket-Powered Products,
                OU=Sensor-Network-Division
        Validity
            Not Before: Feb 17 19:51:50 2010 GMT
            Not After : Dec 31 23:59:59 9999 GMT
        Subject: CN=roadrunner210001
        Data:
            Serial Number: 21:00:01
        Subject Public Key Info: ...


When ACME Factory's Sensor Netowrk Division ships 100 crates of sensors to
Cadabra, it issues a certificate:

        Issuer: C=US, ST=New Jersey, L=Fairfield,
                O=ACME Rocket-Powered Products,
                OU=Sensor-Network-Division
        Validity
            Not Before: Feb 17 19:51:50 2010 GMT
            Not After : Dec 31 23:59:59 9999 GMT
        Subject: C=US,ST=Washington,L=Seattle,O=Cadabra,OU=Logistics
                 RFC3779-Like-Extension: Range(210000, 219999)

When Cadabra ships cases 1-20 to Sesame, it issues a certificate:

        Issuer: C=US,ST=Washington,L=Seattle,O=Cadabra,OU=Logistics
        Validity
            Not Before: Feb 17 19:51:50 2010 GMT
            Not After : Dec 31 23:59:59 9999 GMT
        Subject: C=US, ST=Arkansus, L=Bentonville,
                O=Sesame Bix Box Retail,
                OU=Small Stuff Distribution
                RFC3779-Like-Extension: Range(210000, 211999)

When Coyote Inc buys those 10 boxes of 100 sensors, the bill of sale includes:

        Issuer: C=US, ST=Arkansus, L=Bentonville,
                O=Sesame Bix Box Retail,
                OU=Small Stuff Distribution
        Validity
            Not Before: Feb 17 19:51:50 2010 GMT
            Not After : Dec 31 23:59:59 9999 GMT
        Subject: C=US, ST=Nevada, L=Tonopah,
                 O=Coyote Inc, OU=Supper
                 RFC3779-Like-Extension: Range(210000, 210099)
                 RFC3779-Like-Extension: Range(210200, 210299)
                 RFC3779-Like-Extension: Range(210400, 210499)
                 RFC3779-Like-Extension: Range(210600, 210699)
                 RFC3779-Like-Extension: Range(210800, 210899)
                 RFC3779-Like-Extension: Range(211000, 211099)
                 RFC3779-Like-Extension: Range(211200, 211299)
                 RFC3779-Like-Extension: Range(211600, 211699)
                 RFC3779-Like-Extension: Range(211800, 211899)
(cause, a shipper sent them every other box, the ranges are not contiguous)

The mote/sensor when it sees this certificate, can verity that it's DevID
is in the range, and therefore knows that it has found the right network.

Should Coyote find that they had too many, they can sell some of these
sensors to Sheepdog Sam Inc, by issuing a certificate:

        Issuer: C=US, ST=Nevada, L=Tonopah,
                 O=Coyote Inc, OU=Supper
        Validity
            Not Before: Feb 17 19:51:50 2010 GMT
            Not After : Dec 31 23:59:59 9999 GMT
        Subject: C=GB, ST=Scotland, L=Edinburgh,
                 O=SheepsRUs, OU=Sheepdog
                 RFC3779-Like-Extension: Range(210050, 210099)
                 RFC3779-Like-Extension: Range(211611, 211623)

of course, since Coyote actually still has a valid certificate, all parties
would be advised to use the Enrollment over Secure Transport or an API into
802.1AR, to put an operational certificate in place.    Getting back to
factory default might be impossible (WirelessHart does this, I think), or
at least, will wipe the private key associated with the new certificate from
the device.

BTW: the extension is likely about 20 bytes base, with 5 bytes per IDEVID.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-