Re: [Acme] ACME signature mechanics

[Phillip Hallam-Baker <[e-mail]>]

On Thu, Dec 18, 2014 at 7:56 AM, Hannes Tschofenig <
[e-mail]> wrote:
>
> Hi Phillip,
>
> this statement caught my attention:
>
> On 12/18/2014 01:33 PM, Phillip Hallam-Baker wrote:
> > Minimal TLS stacks for embedded devices don't typically do client auth.
> > See 'minimal'.
>
> It depends what devices you are talking about, for what purpose they use
> TLS/DTLS, and what the overall design pattern of the device is.
>
> With the work we are doing in other working groups, such as DICE, we are
> trying to give guidance on how to use TLS/DTLS for use with  Internet of
> Things (=small embedded devices) in an effort to bring more
> (standardized) security protocols into those devices.
>
> With that work we are heavily relying on mutual authentication at the
> DTLS/TLS level.
>
> Ciao
> Hannes
>
> PS: I also don't think that the discussion on this list is relevant to
> embedded devices.
>

Why not?

Support for embedded devices and the cloud is the main forcing function
here. We already have mechanisms that support automated certificate
management, there are dozens. There is little need for these when a
customer only has one cert and no need for standardization unless the
customer has multiple CAs which is very rare except for the very largest
customers.

The best justification for making ACME an IETF standard as opposed to
LetsEncrypt going off and doing their own thing like every CA to date is
that we want to move to an environment where every device uses TLS all the
time. Internet of Things and Cloud computing are the two forcing factors
that make a standardized, automated issue scheme essential.


I want to be able to unpack my Nest thermostat, plug it in and have it grab
a certificate from my local cert issue point as part of the mechanism by
which I grant it access to my home network.

This is an application layer protocol. It should have authentication at the
application layer. The reason TLS client auth isn't very useful is that
client authentication is an application layer concern, not a transport
layer concern.