Re: [Iot-onboarding] BRSKI : proximity registrar cert and MITM question

[Michael Richardson <[e-mail]>]

M. Ranganathan <[e-mail]> wrote:
    > The BRSKI spec says that the pledge needs to send the proximity
    > registrar certificate when it requests a voucher. This establishes to
    > the registrar that it is the same pledge with whom it established a TLS
    > association. Can the server certificate be re-used if a different
    > pledge connects?

The registrar uses the same certificate for all pledges.
The pledge puts that certificate into the voucher request, which is a kind of
witness to the connection.

    > I don't understand the MITM scenario. An example would be helpful.

Which specific scenario are you talking about?
A lot of situations turn out to be difficult to construct in a convincing way
because the device is authenticated by it's IDevID, and so a MITM would have
to have an acceptable IDevID as well.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [