Re: [Danish] Charter Text and the Problem Statement

[Viktor Dukhovni <[e-mail]>]

On Thu, Jun 17, 2021 at 11:21:44AM -0700, Ash Wilson wrote:

> DANE server authentication with EAP-TLS brings another challenge: the
> absence of IP connectivity prior to authentication. This could be remedied
> by https://datatracker.ietf.org/doc/html/draft-ietf-tls-dnssec-chain-extension-07,
> if the work on that draft were to continue.

That seems rather unlikely in the short term, but in the meantime

    https://datatracker.ietf.org/doc/draft-dukhovni-tls-dnssec-chain/

will soon be published via the ISE.

> There are also challenges with validating the chain, tied to root key
> rotation. Devices which remain unplugged too long may not be able to
> authenticate.  On the other hand, it is a best practice to ensure that
> a device is patched before putting it into production, and updating
> roots of trust fits within the scope of that sort of activity.

Indeed a device that's been on the shelf for O(1 year) or more may well
find that the root key has been rolled.  There is therefore a need for a
mechanism to allow it to "catch up" by updating its software and trust
anchors.  Secure update of dormant devices is a tricky problem, that may
not have a one size fits all solution, there's likely a continuum of
tradeoffs between convenience and security.

-- 
    Viktor.