Re: [Iot-onboarding] OPC and BRSKI

[Dan Harkins <[e-mail]>]

   Hi Kent,

On 8/7/19 12:43 PM, Kent Watsen wrote:
>> On Aug 7, 2019, at 4:50 AM, Eliot Lear <[e-mail] 
>> <mailto:[e-mail]>> wrote:
>>
>> The purpose, as I see it, of the voucher, is simply to provide 
>> zero-touch network provisioning.  I was asking a slightly different 
>> question: for purposes of network connectivity will operators want to 
>> know that only devices*they* authorized are connecting (e.g., 802.1X 
>> and then like)?  This is a natural assumption in the wireless world, 
>> but less so in wired.
>
> More specifically, the voucher enables the device to trust the 
> network, i.e., the entity claiming to be the device's owner.  Without 
> the voucher, there is the TOFU (trust on first use), a.k.a. 
> "resurrecting duckling" problem.

   The problematic nature of voucher-less trust can be offset somewhat 
by limiting
knowledge of the device's credential. DPP attempts to do this. The DPP 
device will
only accept a provisioning agent that knows its public key.

   The idea is that degree of gratuitousness of the device's 
bootstrapping directly
determines how much it can trust "the network" that has bootstrapped 
it's public key.
A QR code on the device's backside means that the device will trust 
anyone who has
physical possession of it (and can scan it's backside). This does not 
prevent the
"device fell off the truck" threat. But that is not the only way of 
bootstrapping a
device's public key. The device's public key could be bootstrapped from 
a cloud
service-- give the serial number of the device (and/or 
proof-of-ownership) and get
back the device's public key.

   This allows the device to have a modicum of trust in "the network" 
based on the
steps the network had to go through in order to bootstrap the device's 
public key.
This way printers (with a relatively low bar on trust of "the network") 
can get
provisioned for a network that also includes something like a centrifuge 
(with a
relatively higher bar on trust of "the network" that it will join).

   I'm not sure how relevant this is to OPC (I have not found the 
relevant documents
on the OPC website) but I just want to point out that voucher-less 
provisioning does
not have to rely solely on blind trust or TOFU.

   regards,

   Dan.