Re: [Danish] [EXT] Re: IoT Device Identification with TLSA via Danish

[Hannes Tschofenig <[e-mail]>]

Hi Michael, Hi Jacques,

I found this email thread and was wondering about one aspect in the context of authorization lists.

Where are these authorization lists stored and who creates them?
In what you use cases do you need to configure these authorization lists?

Ciao
Hannes

PS: I would avoid to use the term "identity" because here we are only talking about an identifier. Identity has so much baggage, which is probably not useful in this context.

-----Original Message-----
From: Danish <[e-mail]> On Behalf Of Michael Richardson
Sent: Tuesday, June 15, 2021 8:38 PM
To: Jacques Latour <[e-mail]>; [e-mail]
Subject: Re: [Danish] [EXT] Re: IoT Device Identification with TLSA via Danish


Jacques Latour <[e-mail]> wrote:
    > Top post: I think in the context of IoT Device Client Identity, the
    > identity of an individual device can be revoked for other reasons than
    > a compromise, for example if an IoT device is repurposed for a new use,
    > then a new identity would be provisioned for the new purpose (new
    > customer, new network), I think having a method of knowing that the old
    > identity is revoked (say for 3 months) would be useful.  We would know
    > for sure that the reprovisioning of a new identity to the IoT device
    > didn't work.

A premise of DANISH is that the device comes with an identity, supplied by a manufacturer.
This is the part where the device does not need to go through an onboarding process (to a private CA), but rather it's enough to configure the name of the device into an authorization list.

If the device is repurposed, then it won't get a new name. (that would require that it be onboarded with a name name, right?) So, in order to repurpose a device, it needs to be removed from whatever authorization list it was on, and then added to the new authorization list.
Revoking the certificate would keep the device from being able to be used in the new purpose.

{I personally think that this is a negative of DANISH.
Maybe it's not a core aspect of it, but it seems like it to me.}

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide




IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.