Re: [homenet] security work items - what do we want to do?

[Michael Richardson <[e-mail]>]

Stephen Farrell <[e-mail]> wrote:
    > On 24/01/18 15:36, Ted Lemon wrote:
    >> Yes, enrollment is the process by which trust is established. Google
    >> home has an example, but it's rickety. It's actually not too bad for
    >> actual Google devices, but the third party enrollment process could
    >> really benefit from some open standards (imho).

    > While I don't disagree with you, I do still wonder if we'd
    > not be better off using another term for cases where maybe
    > all that are involved are a couple of routers in the home,
    > and where there's no external party, such as google in the
    > example you give.

If you are suggesting we should write a clear problem statement with
new-fangled and terminology devoid of historical baggage, and then argue
about that for 6-10 months... well...  we could start that now :-)

Two routers exchanging some keys on a TOFU basis might qualify as (mutual)
enrollment, as the keys are stored someplace for the "second use".

Stephen Farrell <[e-mail]> wrote:
    > Without a chair hat on, I'm not sure that some of those
    > other bits of work need to be fully finished - if we know
    > what kind of keying that'll be used in the final results,
    > we could make some progress, but I do agree we'd need to

the reason I said that things should be finished, is because I believe that a
3/4 year problem statement discussion will distract the WG from actually
finishing that existing work.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-