[Anima] My comments about draft-richardson-anima-masa-considerations-02:

["Xialiang (Frank, Network Standard & Patent Dept)" <[e-mail]>]

Hi Michael,
This draft is useful for helping guy to get valuable guidance of deploying BRSKI MASA service, please see my current comments as below:


pg 4:

   One way to do the transmission is during a manufacturing during a Bed

   of Nails (see [BedOfNails]) or Boundary Scan.



comment:

   Can the manufacturer internal scep or similar protocols be the other ways?



pg 4:

   has been started the first time.



comment:

   Both in the manufacturing process and in-field provisioning process?



pg 4:

   A serial number for the device can be assigned and placed into a



comment:

   Is it appropriate to assign the serial number to device, since device has

   already had its own SN?



pg 5:

   Ongoing access to the root-CA is important, but not as critical as

   access to the MASA key.



comment:

   MASA key is not relevant with the IDevID three-tier PKI

   infrastructure. So, does this sentence make sense here?



pg 5:

   The IDevID certificates have very long (ideally infinite)

   validity lifetimes for reasons that [ieee802-1AR] explains, but once

   the certificates have been created the intermediate CA has no further

   obligations as neither CRLs nor OCSP are appropriate.



comment:

   Miss some text here for clarifying how the updated intermediate CAs with

   new keypair can still be used to validate the old IDevID which is issued

   with the intermediate CA's old keypair. Can the updated intermediate CA

   still store and use the old keypair?

   And why do you say that the intermediate CA has no further obligations for

   its status update once the IDevIDs have been created?



pg 6:

   A plan to escrow the signing keys SHOULD be detailed, and it is

   likely that customers will want to review it for high-value products.



comment:

   what is the "escrow the signing keys"?



pg 7:

   In order to avoid locking down a single validation key, a PKI infrastructure is

   appropriate.



comment:

   A PKI infrastructure for MASA?



pg 7:

   a new End-Entity (EE) Certificate with an online

   private key, and use that to sign voucher requests. The entity used

   to sign [RFC8366] format vouchers does not need to be a certificate

   authority.



comment:

   Why is it the EE Certificate?


B.R.
Frank

This e-mail and its attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient(s) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!