Re: [Fud] A few questions / observations

[Hannes Tschofenig <[e-mail]>]

Hi Jim,

let me respond to this issue:

On 10/04/2017 10:29 PM, Jim Schaad wrote:
> Many of the people that I have talked to are looking at using either raw
> public keys or pre-shared keys as the authentication mode for doing
> TLS.  This means that the need for any ASN.1 decoding goes away from TLS
> and the DER encoder would not be needed on the end product.  I think
> this might be a YMMV statement.

I guess it depends who you talk to.

As you know, I am co-author of the TLS PSK and the TLS raw public key
mechanism and as such I had obviously expected (or was hoping for) a
widespread adoption of those mechanisms since they provide much better
performance on paper. Since we always hear these stories about
limitations of these IoT devices we obviously buy into these stories.

However, our experience at ARM was a bit different. Those companies who
cared about IoT security tend to be rather conservative and once they
decide to go for the full-blown IoT solution (which includes a device
management solution with firmware updates) they want to go for a
certificate based approach. Of course, there is more overhead but often
there are other factors that play a role in the decision making. For
example, many of these companies are interested in reusing their
existing infrastructure and processes. This might also explain why there
is suddenly interest in standardizing the EST over CoAP-based
certificate management protocol in ACE.

Hence, I believe there is a disconnect between the " optimize like hell"
and the "I need to deploy something I am familiar with" approaches.

Ciao
Hannes