Re: [Iot-onboarding] BRSKI : proximity registrar cert and MITM question

["M. Ranganathan" <[e-mail]>]

On Wed, Feb 19, 2020 at 4:15 AM Michael Richardson
<[e-mail]> wrote:
>
>
> M. Ranganathan <[e-mail]> wrote:
>     > The BRSKI spec says that the pledge needs to send the proximity
>     > registrar certificate when it requests a voucher. This establishes to
>     > the registrar that it is the same pledge with whom it established a TLS
>     > association. Can the server certificate be re-used if a different
>     > pledge connects?
>
> The registrar uses the same certificate for all pledges.
> The pledge puts that certificate into the voucher request, which is a kind of
> witness to the connection.
>
>     > I don't understand the MITM scenario. An example would be helpful.
>
> Which specific scenario are you talking about?

Thanks for your response.

In section 5.2 it says : The registrar confirms that the assertion is
'proximity' and that pinned 'proximity-registrar-cert' is the
Registrar's certificate. If this validation fails, then there is an
On-Path Attacker (MITM), and the connection MUST be closed after the
returning an HTTP 401 error code.

I was wondering about how that could occur and was trying to construct
a MITM attack which would be thwarted by having that certificate.

> A lot of situations turn out to be difficult to construct in a convincing way
> because the device is authenticated by it's IDevID, and so a MITM would have
> to have an acceptable IDevID as well.

The device signs the request with it's private key and likewise
accepts a Voucher signed by the MASA which it has the ability to
verify. How can a MITM intervene?




>
> --
> ]               Never tell me the odds!                 | ipv6 mesh networks [
> ]   Michael Richardson, Sandelman Software Works        | network architect  [
> ]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [
>


-- 
M. Ranganathan