Re: [Anima-bootstrap] authz in the form a cert chain.. from SIDR work

Carsten Bormann <> Thu, 13 October 2016 11:48 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 1CB2A1294E8 for <>; Thu, 13 Oct 2016 04:48:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.2
X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id g8Vo4ZTByrq4 for <>; Thu, 13 Oct 2016 04:48:09 -0700 (PDT)
Received: from ( [IPv6:2001:638:708:30c9::12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id D57DD1294A3 for <>; Thu, 13 Oct 2016 04:48:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
Received: from ( []) by (8.14.5/8.14.5) with ESMTP id u9DBm3Nc003291; Thu, 13 Oct 2016 13:48:03 +0200 (CEST)
Received: from nar-4.local ( []) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPSA id 3svprg1NNNz3PmT; Thu, 13 Oct 2016 13:48:03 +0200 (CEST)
Message-ID: <>
Date: Thu, 13 Oct 2016 13:49:09 +0200
From: Carsten Bormann <>
User-Agent: Postbox 4.0.8 (Macintosh/20151105)
MIME-Version: 1.0
To: "Max Pritikin (pritikin)" <>
References: <>
In-Reply-To: <>
X-Enigmail-Version: 1.2.3
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Archived-At: <>
Cc: Michael Richardson <>, "" <>
Subject: Re: [Anima-bootstrap] authz in the form a cert chain.. from SIDR work
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Mailing list for the bootstrap design team of the ANIMA WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 13 Oct 2016 11:48:10 -0000

Max Pritikin (pritikin) wrote:
> And each member of the sales channel repeats this process as it resales the device?
> Right down to the “Sesame Bix Box Retail” having a PKI and issuing the final bill of sale:

Actually, for some organizations investing in designing security
solutions that's the point:
Security solutions can be designed to favor certain business
arrangements and make others artificially hard.

(In this, case, of course the manufacturer would build a platform to
enable Sesame to run this process.  Manufacturer is happy: more control
over the channel.  This also probably easily justifies the entire
expense of running the platform.  And then later, that platform can be
turned into a "profit center", because security ensures lock-in.)

Grüße, Carsten