Re: [Danish] [Iot-directorate] SCVP

[Michael Richardson <[e-mail]>]

For others:
    SCVP = Server-Based Certificate Validation Protocol
    RFC5055.

Russ Housley <[e-mail]> wrote:
    > I have recently learned that the US Department of Treasury operates an
    > SCVP responder associated with the US Government's PKI:

    > 	https://vssapi.treasury.gov/vss/docs/treas_scvp_profile_v1.3.pdf

BTW: This URL returns no MIME type, so sane browsers assume text/plain,
     so you'll have to save-as, as load it locally.
The diagram of the federal PKI is truly impressive.
Is the software that they run available?

    > This Got me to thinking about an IoT device trying to construct a
    > certification path in this complex PKI environment.  Such a SCVP
    > responder could be used to offload this task.  There could be battery
    > consumption to send the request and get the response; however, it may
    > very well be less battery than doing the certification path
    > construction itself.

There are three considerations in the analysis in my opinion:
  1) the network energy cost of connecting.
  2) the local energy cost of being awake to receive the reply.
  3) the network energy cost of retrieving the relevant certificate chains.

I think that a major win for IoT devices on challenged networks is being able
to avoid retrieving any of the subordinate or intermediate CRLs/OCSP results
along the way.
This feels like a service that a powered IoT gateway ought to provide.
This eliminates much of the trust issue.
Also, the odds are all the devices in a sensor network would have to validate
much of the same complex path, so caching would work well.

However, I have yet to see any IoT system that has a PKI more complex than
two levels of private PKI.  But, perhaps that's because more complex
scenarios wouldn't work with SCVP.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide