Re: [Iot-onboarding] [Mud] Some new stuff for mudmaker.org

Hi Ranga,

> On 23 Mar 2020, at 16:09, M. Ranganathan <mranga@gmail.com> wrote:
> 
> I have a very basic question about the whole notion of mixing SBOM with MUD. MUD was intended for network access control whereas SBOM is more for ensuring software integrity. Should this be part of the MUD file or included (for example) as a pointer in the device certificate so it can be independent of MUD? Why include this as part of the MUD file?  I'd just like to understand the motivation.

There are several.  
First, they need some sort of a schema to describe how to get the SBOM in the first place, and if they’re going to go that far they will end up reproducing much of the MUD mechanism.  
Second, access control is just one use of MUD.  There are others, and this is one of them.  Another use that we are contemplating is a list of pointers to certification statements that organizations such as UL might make.  One could even envision a MUD file without ACLs, not that I would recommend it.  
Third, if you are going to produce an SBOM, it seems to me you OUGHT to describe what sort of access you expect the device to have so that if an adversary picks off the SBOM for that particular device or device type, you have some protection.
Fourth, if everyone does their own thing with device certificates they are going to bloat, and become operationally unmanageable. I’m not saying there isn’t room for more, but people should think of MUD more as a means to access various statements the vendor wants to make, and less about just ACLs.
Eliot

> 
> Stay healthy.
> 
> Thanks,
> 
> Ranga
>  
> 
> -- 
> Mud mailing list
> Mud@ietf.org <mailto:Mud@ietf.org>
> https://www.ietf.org/mailman/listinfo/mud <https://www.ietf.org/mailman/listinfo/mud>
> 
> 
> -- 
> M. Ranganathan 
> 