Re: [Iot-onboarding] OPC and BRSKI

[Toerless Eckert <[e-mail]>]

On Wed, Aug 07, 2019 at 10:40:54PM -0700, Dan Harkins wrote:
>   The problematic nature of voucher-less trust can be offset somewhat by
> limiting knowledge of the device's credential. DPP attempts to do this. The DPP
> device will only accept a provisioning agent that knows its public key.

What is DPP ?

Interesting scheme. I wonder how problematic security experts would find
this approach. But certainly novel to me to use a public key as a shared
secret with one "owner".  

> But that is not the only way of  bootstrapping a
> device's public key. The device's public key could be bootstrapped from a
> cloud service-- give the serial number of the device (and/or proof-of-ownership)
> and get back the device's public key.

How about resale of such a device. The second owner knows that the first
owner always has a key left (because it can always remember the public key).
Or else it should be possible to erase/recreate this key-pair.

>   This allows the device to have a modicum of trust in "the network" based
> on the steps the network had to go through in order to bootstrap the device's
> public key.

> This way printers (with a relatively low bar on trust of "the network") can
> get provisioned for a network that also includes something like a centrifuge
> (with a relatively higher bar on trust of "the network" that it will join).

Not sure i understand that point.

>   I'm not sure how relevant this is to OPC (I have not found the relevant
> documents on the OPC website) but I just want to point out that voucher-less
> provisioning does  not have to rely solely on blind trust or TOFU.

A voucher is just a secure digital artefact to pass on authorization of
ownership. If you want to give that authorization to some enterprises
server/registrar in the shared-secret public-key scheme, you would also
need to have some way to pass on that public key to that enterprise
server. Just a different type of voucher.

Aka: there is always a voucher, even if you haven't called it that way ;-))

Cheers
    toerless

>   regards,
> 
>   Dan.