Re: [Anima] Adjacency table

[Michael Richardson <[e-mail]>]

First, I confused myself and mis-stated something, but fundamentally
what I said was accurate.  Let me clarify first:

1) every certificate issued by any CA is supposed to have a unique
   "Serial Number" attribute.

dooku-[~] mcr 10008 %openssl x509 -in /etc/postfix/ssl/dooku.crt -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 121 (0x79)
...
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=CA, ST=Ontario, L=Ottawa, O=Sandelman Software Works, OU=Debugging Department, CN=sandelman.ca/emailAddress=[e-mail]
        [yes, I need to remove SHA1 from my SOHO CA]

2) The 802.1AR specification says vendors will use a SubjectAltName to
   indicate a vendor-specific serial number.
   802.1AR is rather silent about the form of that number, but in
     draft-richardson-6tisch-idevid-cert-01 now
     draft-richardson-anima-idevid-cert-00
   I suggested that it would be an integer like SerialNumber.


Michael Behringer (mbehring) <[e-mail]> wrote:
    >> > Probably not, but presumably the security bootstrap can deliver some
    >> > sort of answer to that? Anyway, if the answer is "unique string"
    >> > is what I wanted to know, thanks.

    >> Yes, the combination of <hash-of-vendor-CA-key, serialNumber> will be
    >> unique before bootstrap.

    > Are you suggesting to use that as a device-ID?  Strictly speaking <hash
    > of vendor CA-key> isn't guaranteed to be unique either...

I never said <hash-of-vendor-CA-key> was unique.
I said that the pair <hash-of-vendor-CA-key, SerialNumber> was unique by
construction (yes, bad things can happen, but that's against the spec).
I was vague as to whether this was the SerialNumber in the certificate,
of the device-serialnumber in the SubjectAltName.  Let me clarify that it's
the latter.

    >> After bootstrap, we will have <domain-CA,
    >> domain-specific-serialNumber> in a certificate that would be installed
    >> in each device.

    > I'd prefer to use the same device ID all the time, before and after
    > bootstrap. Why change? It's just a string to identify the device...

Well, because vendorA can issue SN: 000011
and vendorB can issue SN: 00011, and we can't expect them to coordinate.
The enrollment part of the bootstrap process will provide the node with a new
(locally significant) certificate, and can provide it with whatever stable
deviceID you like.  Unless you have a model where unenrolled nodes form
prospective ACPs [that idea of mine was withdrawn after discussion], then no
nodes communicate with each other in a secure way until after they are
enrolled. 

    >> If you are really lazy, you can just use the entire certificate bytes
    >> [on the order of 1Kbytes], but technically, a device might have many
    >> of those over it's lifetime.

    > Right.

    >> The serialNumber is mandated to be unique by pkix/x509.

    > Are you saying that the serial numbers in products ARE unique?

Yes.  The <vendor,serial-number> pair is unique from the factory.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [