Re: [Acme] ACME signature mechanics

[Hannes Tschofenig <[e-mail]>]

Hi Phillip,

we already have a mechanism for issuing certificates to embedded
devices, namely OMA Lightweight M2M. It is already used today.
That specification is a version of the OMA device management protocol
(which is also widely used) but uses different protocols that are more
suitable for the embedded side, such as CoAP and JSON.

Hence, I doubt that this work is something the IoT community is asking for.

Ciao
Hannes

On 12/18/2014 02:17 PM, Phillip Hallam-Baker wrote:
> 
> 
> On Thu, Dec 18, 2014 at 7:56 AM, Hannes Tschofenig
> <[e-mail] <mailto:[e-mail]>> wrote:
> 
>     Hi Phillip,
> 
>     this statement caught my attention:
> 
>     On 12/18/2014 01:33 PM, Phillip Hallam-Baker wrote:
>     > Minimal TLS stacks for embedded devices don't typically do client auth.
>     > See 'minimal'.
> 
>     It depends what devices you are talking about, for what purpose they use
>     TLS/DTLS, and what the overall design pattern of the device is.
> 
>     With the work we are doing in other working groups, such as DICE, we are
>     trying to give guidance on how to use TLS/DTLS for use with  Internet of
>     Things (=small embedded devices) in an effort to bring more
>     (standardized) security protocols into those devices.
> 
>     With that work we are heavily relying on mutual authentication at the
>     DTLS/TLS level.
> 
>     Ciao
>     Hannes
> 
>     PS: I also don't think that the discussion on this list is relevant to
>     embedded devices.
> 
> 
> Why not? 
> 
> Support for embedded devices and the cloud is the main forcing function
> here. We already have mechanisms that support automated certificate
> management, there are dozens. There is little need for these when a
> customer only has one cert and no need for standardization unless the
> customer has multiple CAs which is very rare except for the very largest
> customers.
> 
> The best justification for making ACME an IETF standard as opposed to
> LetsEncrypt going off and doing their own thing like every CA to date is
> that we want to move to an environment where every device uses TLS all
> the time. Internet of Things and Cloud computing are the two forcing
> factors that make a standardized, automated issue scheme essential. 
> 
> 
> I want to be able to unpack my Nest thermostat, plug it in and have it
> grab a certificate from my local cert issue point as part of the
> mechanism by which I grant it access to my home network.
> 
> This is an application layer protocol. It should have authentication at
> the application layer. The reason TLS client auth isn't very useful is
> that client authentication is an application layer concern, not a
> transport layer concern.
> 
> 
> _______________________________________________
> Acme mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/acme
>