Re: [Iot-onboarding] BRSKI-EST and TLS Unique ID check

Dan Harkins <dharkins@lounge.org> Sat, 04 April 2020 17:51 UTC

Date: Sat, 04 Apr 2020 10:50:57 -0700
From: Dan Harkins <dharkins@lounge.org>
In-reply-to: <CAHiu4JMF22GQBV+yNtN5ySUvJtcc8_+xj9biJLE9Dcc1YvUp9w@mail.gmail.com>
To: iot-onboarding@ietf.org
Message-id: <0e3c75ca-52b1-6117-cd5c-0bfe5ba9c381@lounge.org>
MIME-version: 1.0
Content-type: text/plain; charset="utf-8"; format="flowed"
Content-language: en-US
Content-transfer-encoding: 8bit
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Thunderbird/68.5.0
References: <CAHiu4JMF22GQBV+yNtN5ySUvJtcc8_+xj9biJLE9Dcc1YvUp9w@mail.gmail.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/iot-onboarding/JUCznjE6oHTn0grPhXHJkIfd7f8>
Subject: Re: [Iot-onboarding] BRSKI-EST and TLS Unique ID check
Precedence: list

   Hi Ranga,

   This check does proof-of-possession of the private key. I think it's
very important.

   regards,

   Dan.

On 4/3/20 9:45 AM, M. Ranganathan wrote:
> Hello,
>
> The EST spec says that if the password on a simpleenroll CSR exists
> then that password should match the tls unique identifier of the HTTPS
> connection (section 3.5).
>
> Given that BRSKI establishes a persistent HTTPS connection, is this
> check even required?
>
> I looked at draft-richardson-anima-registrar-considerations but I
> could not find anything about this so I would appreciate some
> clarification.
>
> Thanks,
>
> Ranga
>
>
>

[Iot-onboarding] BRSKI-EST and TLS Unique ID check M. Ranganathan
Re: [Iot-onboarding] BRSKI-EST and TLS Unique ID … M. Ranganathan
Re: [Iot-onboarding] BRSKI-EST and TLS Unique ID … Dan Harkins
Re: [Iot-onboarding] BRSKI-EST and TLS Unique ID … M. Ranganathan
Re: [Iot-onboarding] BRSKI-EST and TLS Unique ID … Dan Harkins
Re: [Iot-onboarding] BRSKI-EST and TLS Unique ID … Michael Richardson
Re: [Iot-onboarding] BRSKI-EST and TLS Unique ID … Michael Richardson