Re: [Acme] Fwd: New Version Notification for draft-sweet-iot-acme-04.txt

[Sebastian Nielsen <[e-mail]>]

7) Validity of certificates:  <https://www.ietf.org/archive/id/draft-sweet-iot-acme-04.html#name-iot-device-certificates> https://www.ietf.org/archive/id/draft-sweet-iot-acme-04.html#name-iot-device-certificates

 

>> I disagree with short validity.

If the certificate is restricted to local domain names only, I suggest allowing validity up to 10 years.

 

HOWEVER, if local certificates should be accepted by browsers as root, THEN there must be a mechanism, similar to DNS Rebinding protection, that prohibits an external site (that are not an RFC1918-IP or local resources) or a resource received externally (for example an email) from hyperlinking or redirecting to a .local resource, an private, loopback or local IP, or a mDNS resource.

 

In the same thing, I see that reuse of key material, mentioned in 4.11 is no problem, as long as key material is NEVER reused along multiple devices (eDellSupport and such).

If key material is reused among the same user only (same local network), I see no risks.

 

4.9 and 3.3 solves any issues that may exist with attacks, since each root certificate will only recongnize whatever exist on the very same local network.

 

Since the device SHOULD regenerate certificate (4.5) when a “factory reset” is done, a device which changes owner (through selling on marketplace as used product) will not pose a security risk.

 

There could be good to impose a rule, that a IoT device, should, on each power up:

Set a flag “NeverConnected = true”

Do power up connection.

If a connection to a network for which it owns a certificate is found, then:

“NeverConnected” should be set to false.

 

IF a pairing of a new user is done to the device, AND the pairing is not done through a existing user (Pairing done with a button or similar) – AND “NeverConnected” is set to true, then it should do an automatic factory reset, or require a factory reset.

 

However, if a new user is paired into the device through an old user, there is clear evidence the device is still possessed by the old user, and it does not make sense to reset the device otherwise.

 

This ultimately protects a device which changes hands into a new user from any malicious attacks, even by the previous user, even if the new user does NOT factory reset the device.

 

 

                        Best regards, Sebastian Nielsen