Re: [Anima] Roman Danyliw's Discuss on draft-ietf-anima-bootstrapping-keyinfra-28: (with DISCUSS and COMMENT)

[Michael Richardson <[e-mail]>]

Roman Danyliw <[e-mail]> wrote:
    > NEW:

    > With consumer-oriented devices, the "call-home" mechanism in IoT
    > devices raises significant privacy concerns.  See [livingwithIoT] and
    > [IoTstrangeThings] for exemplars.  The Autonomic Control Plane (ACP)
    > usage of BRSKI is not targeted at individual usage of IoT devices, but
    > rather at the Enterprise and ISP creation of networks in a zero-touch
    > fashion where the "call-home" represents a different class of privacy
    > and lifecycle management concerns.

I've used your suggested text in -30.

>     > ** Section 10.7.  Per “It is anticipated that specialist service
>     > providers will come to exist that deal with the creation of vouchers in
>     > much the same way that many companies have outsourced email,
>     > advertising and janitorial services.”, I don’t think this is a fair
>     > analogy.  Delegating the voucher process to an entity would take active
>     > cooperation of the manufacturer.  If the manufacture is out of
>     > business, there is not guarantee this would have been put in place (or
>     > those assets were acquired in the liquidation)
>

    >> Recent changes remind that the manufacturer needs to escrow their
    >> keys.  If the manufacturer is out of business, then where will you get
    >> security updates from?  Do you want to enable a secondary market for
    >> devices with decade old security holes?

    > I'm questioning the analogy to advertising or janitorial services.  To
    > me, both of these examples are instances of a service being provided to
    > the existing company rather than demonstrating how asset hand-off or
    > continued maintenance would occur in the case of
    > bankruptcy/liquidation.

It has been standard practice in every non-open source software organzation I have
ever worked at (going back to 1993) to dump software build trees to backup
media and escrow that to a lawyer.  That used to be to 150M QIC tapes at the
time, and I used to have a filing cabinet of the second copy of these things.

I don't see why the MASA keys wouldn't be part of Business Continuity
backups, and that any Hardware Security Modules that would contain critical keys
like this would be duplicated along with the software escrow.
If the company dies so catastrophically that even that is gone, then there
won't be any more security patches either, and maybe the device OUGHT to be
replaced.  Customers are sometimes SOL when they deal with companies like
that...  Having said that, Nortel Contivity VPN boxes were still in use
at gc.ca years after Nortel died, and may still be running now.
Someone got the tapes and was contracted to do patches is what I heard.

Noting that without the MASA keys, you can't do autonomic enrollment for a
device that has lost it's configuration and had to go through factory
default, or if you pull spare equipment out of cold storage.
You can still plug in a console cable and tell it bootstrap from a specific
IP, which is what you'd have to without BRSKI.  If it's a $3 smartlightbulb,
and the company went under, maybe that's regretable landfill. If you had
100,000 of them in the warehouse, well... that's government procurement :-)

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-