Re: [Iotops] can we create protocols that securely transfer ownership?

Brian E Carpenter <brian.e.carpenter@gmail.com> Fri, 30 October 2020 19:58 UTC

To: Michael Richardson <mcr+ietf@sandelman.ca>, "Andrew G. Malis" <agmalis@gmail.com>, iotops@ietf.org
References: <160338716989.22551.17761888498316049460@ietfa.amsl.com> <CAA=duU3XAgBsbqf1k=jQ4yh-DdR=TyX+FkTYcm7LKtBzd99fdQ@mail.gmail.com> <13731.1604075416@localhost> <CAA=duU3Z5v03AkoWTJvXN2r4co9r8zTSjS5n7t0Q2NeOoTyDnQ@mail.gmail.com> <28326.1604078708@localhost>
From: Brian E Carpenter <brian.e.carpenter@gmail.com>
Message-ID: <9a2a134a-e530-81de-7c51-e6d401c3c7dd@gmail.com>
Date: Sat, 31 Oct 2020 08:58:27 +1300
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.9.1
MIME-Version: 1.0
In-Reply-To: <28326.1604078708@localhost>
Content-Type: text/plain; charset="utf-8"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/iotops/BLkL1mZ_Rd9ueRoeMY4pAu5Sb4w>
Subject: Re: [Iotops] can we create protocols that securely transfer ownership?
Precedence: list

On 31-Oct-20 06:25, Michael Richardson wrote:
> 
> Andrew G. Malis <agmalis@gmail.com> wrote:
>     > Yes, in addition to being a good story, the point is who controls the
>     > firmware in our things, and how bad it can get not only when the
>     > manufacturer enforces DRM, but the gov't enables the behavior
>     > (criminalizing jailbreaking).
> 
>     > Or the issues that arise when the manufacturer fails to properly maintain
>     > the firmware, or goes out of business.
> 
> All major concerns.  What do you think the IETF can/should do?
> I have some very specific ideas which I think are manageable and specific.

Both BRSKI and SUIT have minor references to the latter problem, and I
think that when considering tiny cheap devices it isn't a theoretical issue,
but one that's highly likely. There is also (as for incandescent light
bulbs) a strong incentive for manufacturers to sell devices that are
designed to break after a while. An expiring certificate would be a great
way to break devices remotely, for example.

   Brian

[Iotops] New Non-WG Mailing List: IOTOPS -- IOT O… IETF Secretariat
Re: [Iotops] New Non-WG Mailing List: IOTOPS -- I… Andrew G. Malis
[Iotops] can we create protocols that securely tr… Michael Richardson
Re: [Iotops] can we create protocols that securel… Andrew G. Malis
Re: [Iotops] can we create protocols that securel… Michael Richardson
Re: [Iotops] can we create protocols that securel… Brian E Carpenter
Re: [Iotops] maintain ownership (was: can we crea… Toerless Eckert
Re: [Iotops] can we create protocols that securel… William_J_G Overington
Re: [Iotops] can we create protocols that securel… Alexandre Petrescu
Re: [Iotops] can we create protocols that securel… Michael Richardson
Re: [Iotops] can we create protocols that securel… Michael Richardson
Re: [Iotops] can we create protocols that securel… Toerless Eckert
[Iotops] Use of abbreviations William_J_G Overington
Re: [Iotops] Use of abbreviations Henk Birkholz
Re: [Iotops] Use of abbreviations William_J_G Overington
Re: [Iotops] Use of abbreviations Brian E Carpenter
Re: [Iotops] can we create protocols that securel… Qin Wu
Re: [Iotops] maintain ownership (was: can we crea… Qin Wu
Re: [Iotops] maintain ownership (was: can we crea… Michael Richardson
Re: [Iotops] maintain ownership (was: can we crea… Toerless Eckert
Re: [Iotops] maintain ownership (was: can we crea… Toerless Eckert
Re: [Iotops] maintain ownership (was: can we crea… Michael Richardson
Re: [Iotops] maintain ownership (was: can we crea… Amyas Phillips, Ambotec
Re: [Iotops] maintain ownership (was: can we crea… Michael Richardson
Re: [Iotops] maintain ownership Brian E Carpenter
Re: [Iotops] maintain ownership Michael Richardson
Re: [Iotops] maintain ownership William_J_G Overington
Re: [Iotops] maintain ownership William_J_G Overington