Re: [Iot-onboarding] OPC and BRSKI

[Kent Watsen <[e-mail]>]

Hi Randy,

> What we are looking for from the MASA is a framework that will provide the Operator with a “whitelist” of Device Certificates before any Device is plugged into the Network.
> The OPC UA enabled Registrar would know what Devices are allowed when they attempt to register..
> (IOW – the registrar does not simply rely on the Manufacturer CA).


Indeed.  Assuming a secure device identity certificate (e.g., IDevID), the network trusting the device is a two-step process:
  1) certificate-path validation to the manufacturer's CA
  2) device-identity (e.g., serial number) is expected.

The backend supporting what you're looking for is hinted at by RFC 8572, item #4 in C.1.   What the NMS does is out-of-scope to SZTP, but not doing both path-validation and identity-verification wouldn't make sense, given that a device-specific response is needed in most cases.

Kent