Re: [Iot-onboarding] OPC and BRSKI

[Michael Richardson <[e-mail]>]

Eliot Lear <[e-mail]> wrote:
    >> 1) Low end devices that only support OPC; this means no TLS client
    >> capabilities and no ability to initiate network communication
    >> (i.e. server only mode);
    >>

    > How does OPC handle such devices?  I think this is also coming up
    > elsewhere.  One question is whether TLS is required.  Without TLS one
    > does lose confidentiality, but so long as the client can sign the
    > request, maybe that’s all you use.

The TLS encryption provides confidentiality, yes, and I agree that it
is not critical to onboarding.  The TLS Client and ServerCertificate and
resulting channel is critical though as it provides the cryptographic
hook on which the voucher is attached.

    >> 4) Offline operation is the norm with pre-issued vouchers delivered
    >> out of band. The pre-issued vouchers will need to have reasonably long
    >> lifetime (i.e. years not hours).
    >>
    >> The lifecycle of a device is shown in the following diagram. The
    >> expectation is we would need to add links to the MASA at each step in
    >> the lifetime

    > Thank you for that.  For wired it seems to me that a permissive MASA
    > model (logging only) could provide you a way forward.  For wireless,
    > this is not an option because proper network selection needs to occur.
    > Another question is whether we need another mechanism is necessary to
    > validate the voucher (aka, a PSK w/ proof of knowledge, or DPP, etc).

    > Can you say more about what mechanisms OPC is interested in pursuing?

+1


--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-