Re: [Iot-onboarding] [Secdispatch] DANE IOT proposed outcome

[Phillip Hallam-Baker <[e-mail]>]

Lets break this down.

Does the proposed solution work with existing Browsers?

If yes, fine. But since this is DANE based, it can't be. So we have to
modify the browser. So the question to ask is:

Is this the best solution that involves modifying the browser?

I don't care how much effort went into DANE, that is really inconsequential
when we consider the cost of modifying billions of browsers that are in use.


PKIX is a really lousy match for IoT requirements. It is designed to
authenticate organizations and people within organizations. Hence it begins
with the assumption credentials expire and must be renewed on a regular
basis. That is a bad starting point for IoT.

But DNS is rather worse, the time scale is even shorter because it is set
by the need to push out service configuration changes. And the number of
IoT customers who have access to DNS configurations is a small part of the
target market. And DNS names expire every year and require a paid renewal.
This is going backwards, not forwards.


DANE has had plenty of time to prove itself useful. At this point it is
time to declare that it has lost any claim to own this space. It is time to
ask if other people have a better idea. Including the people who were
repeatedly told they were not welcome to participate in DANE because they
had different ideas.