Re: [core] Endpoint Client Name / Endpoint Name in RD draft

[Hannes Tschofenig <[e-mail]>]

Great to hear that I managed to clarify the issue.

Note that I am arguing for having the endpoint name in the RD become optional since I notice the third party registration scenario (even though I consider it somewhat half-baked).

Ciao
Hannes

-----Original Message-----
From: peter van der Stok [mailto:[e-mail]]
Sent: 26 April 2018 16:34
To: Hannes Tschofenig
Cc: Kovatsch, Matthias; Jim Schaad; 'Christian Amsüss'; [e-mail]; 'Carsten Bormann'; [e-mail]
Subject: Re: [core] Endpoint Client Name / Endpoint Name in RD draft

Hi Hannes,

This e-mail of you to Matthias answers my questions I had before.
thanks.
I was under the impression that you wanted to cater for malicious nodes that forged the authorization token.

>
> The requirement for applications using Endpoint Client Names that are
> different from the names in the device certificates/authentication
> credentials for registration appears fuzzy and not well justified.
> What identifier do you believe you can put in an endpoint client name
> but not in a security protocol or what are the needs of an application
> that cannot be met?
>
For example, the d=value is typically installation dependent.
To my knowledge, using d= is envisaged in building installations.
at the same time, the ep=value does not need a value with a semantic meaning, so any identifier will do in my opinion.

I could imagine that a claim with "d"= is added to the token when required.
Same approach for installations which can afford the overhead and want human readable ep names.

Peter
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.