[Anima-bootstrap] SHA1 usage in Anima-bootstrap voucher yang

[Michael Richardson <[e-mail]>]

In the ANIMA ownership voucher YANG model, the absolute latest which you can
currently see at:
   https://github.com/anima-wg/voucher/blob/master/draft-ietf-anima-voucher-01.txt

we write at line 574:

leaf subject-hash {
    type binary;
    description "The certificate's entire subject field MUST
              match this value.  This value is calculated as the SHA-1
              hash over the TBSCertificate's subject structure, as
              specified by RFC 5280 Section 4.1.2.6, encoded using
              the ASN.1 distinguished encoding rules (DER), as
              specified in ITU-T X.690.

              Note: by using the SHA-1 algorithm, the result can be
              easily compared to OpenSSL's 'subject_hash'
              output.";
}

The voucher is a signed artifact (PKCS7? JWT? CWT? TBD) which indicates to a
particular device who the devices owner is. ("Are you my mummy?" for Dr.Who Fans)

For reasons of key hygiene and longevity, in many cases we do not want to
point at the public key of the registrar directly, but rather indicate that
it's DN=Foo, as signed by CA=Bar.   It seems like there ought be a better way
to do this kind of thing than what we specify above, which is annoyingly SHA1
linked.

Can SPASM offer any advice?

We could list the actual DER itself. Encoded, it might actually not be bigger
than a SHA256, for instance.  That might have privacy implications though,
which we'd need to think through.

Some time ago, I proposed replicating the SIDR artifact (RFC3779), and copy
and pasted it to make:
    https://www.ietf.org/archive/id/draft-richardson-anima-idevid-cert-00.txt

but, we didn't really want to go exactly that way.


--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-