Re: [Danish] Charter Text and the Problem Statement

[Michael Richardson <[e-mail]>]

Hannes Tschofenig <[e-mail]> wrote:
    > I was not necessarily thinking about IEEE 802.1AR and the way BRSKI
    > uses it. BRSKI is kind of special in the way it is designed.

It's not that special, actually :-)

DeviceAuthority has a similar design in their proprietary protocol.
  (I don't know many details, just presentations, they have NDAs)
The Intel-SDO, now FIDO IoT, is also very similiar.
It looks like CHIP/MATTER also arranges for an LDevID equivalent, but without
a voucher.

    > In general, in security there is the idea to use different keys for
    > different purposes. If that has changed then I completed missed it.

It's clearly better to do that if you can.

But, _better sometimes is often the enemy of good enough_ is a proverb I've
heard attributed to many cultures.  Better the keypair you overuse
than the factory default password you can never change, right?

My hope that the TLS subcerts mechanism will allow us to operationally use
different keys, while from an identity and authorization point of view, it's
all one virtual key.  But, first that has to get deployed ubiquitously.

    > Regarding the management of access with wearables and smart home
    > deployments using standardized protocols I thought that this is why we
    > did all the work in ACE.

Yes, that's true.  We did that all that stuff in ACE to allow the protocols
and the authorizations, but the specification and onboarding of identities
was specifically out of scope for ACE.  You might recall that I insisted on
that.
I wanted to do that, because I didn't want ACE to attempt to boil the same
ocean that ANIMA and others were also boiling.

Here in DANISH, we can now look forward to the situation where we can use
what is essentially the well-protected (in some TEEP) factory provisioned
key, with the DANE based identity in the authorization list.  *OR* we could
have the private PKI of one operator vertical to export to DANE for
interoperation with another vectical.  Or some hybrid mix.

What's the bottom line Hannes should take home:
       _billions and billions of new mbedTLS users_ :-)


--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide