Re: [Iotops] can we create protocols that securely transfer ownership?

Qin Wu <bill.wu@huawei.com> Tue, 03 November 2020 12:56 UTC

From: Qin Wu <bill.wu@huawei.com>
To: "iotops@ietf.org" <iotops@ietf.org>
CC: Michael Richardson <mcr@sandelman.ca>
Thread-Topic: [Iotops] can we create protocols that securely transfer ownership?
Thread-Index: Adax3ztq9ZIaKul3Q9OMa0o+CJKXng==
Date: Tue, 03 Nov 2020 12:55:53 +0000
Message-ID: <B8F9A780D330094D99AF023C5877DABAADB1F88F@dggeml511-mbs.china.huawei.com>
Accept-Language: zh-CN, en-US
Content-Language: zh-CN
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/iotops/kw1TSxHC9_xm2WgiuiLxVYBD2gQ>
Subject: Re: [Iotops] can we create protocols that securely transfer ownership?
Precedence: list

On 31-Oct-20 06:25, Michael Richardson wrote:
> 
> Andrew G. Malis <agmalis@gmail.com> wrote:
>     > Yes, in addition to being a good story, the point is who controls the
>     > firmware in our things, and how bad it can get not only when the
>     > manufacturer enforces DRM, but the gov't enables the behavior
>     > (criminalizing jailbreaking).
> 
>     > Or the issues that arise when the manufacturer fails to properly maintain
>     > the firmware, or goes out of business.
> 
> All major concerns.  What do you think the IETF can/should do?
> I have some very specific ideas which I think are manageable and specific.

Both BRSKI and SUIT have minor references to the latter problem, and I
think that when considering tiny cheap devices it isn't a theoretical issue,
but one that's highly likely. There is also (as for incandescent light
bulbs) a strong incentive for manufacturers to sell devices that are
designed to break after a while. An expiring certificate would be a great
way to break devices remotely, for example.

[Qin]: Indeed, if someone can tamper the clock and change system clock
Into one past time before the expiring date of the certificate, that means
the certificate duration is extended. How do we deal with this issue?

Similar issue is applicable to software license expiring.

   Brian

[Iotops] New Non-WG Mailing List: IOTOPS -- IOT O… IETF Secretariat
Re: [Iotops] New Non-WG Mailing List: IOTOPS -- I… Andrew G. Malis
[Iotops] can we create protocols that securely tr… Michael Richardson
Re: [Iotops] can we create protocols that securel… Andrew G. Malis
Re: [Iotops] can we create protocols that securel… Michael Richardson
Re: [Iotops] can we create protocols that securel… Brian E Carpenter
Re: [Iotops] maintain ownership (was: can we crea… Toerless Eckert
Re: [Iotops] can we create protocols that securel… William_J_G Overington
Re: [Iotops] can we create protocols that securel… Alexandre Petrescu
Re: [Iotops] can we create protocols that securel… Michael Richardson
Re: [Iotops] can we create protocols that securel… Michael Richardson
Re: [Iotops] can we create protocols that securel… Toerless Eckert
[Iotops] Use of abbreviations William_J_G Overington
Re: [Iotops] Use of abbreviations Henk Birkholz
Re: [Iotops] Use of abbreviations William_J_G Overington
Re: [Iotops] Use of abbreviations Brian E Carpenter
Re: [Iotops] can we create protocols that securel… Qin Wu
Re: [Iotops] maintain ownership (was: can we crea… Qin Wu
Re: [Iotops] maintain ownership (was: can we crea… Michael Richardson
Re: [Iotops] maintain ownership (was: can we crea… Toerless Eckert
Re: [Iotops] maintain ownership (was: can we crea… Toerless Eckert
Re: [Iotops] maintain ownership (was: can we crea… Michael Richardson
Re: [Iotops] maintain ownership (was: can we crea… Amyas Phillips, Ambotec
Re: [Iotops] maintain ownership (was: can we crea… Michael Richardson
Re: [Iotops] maintain ownership Brian E Carpenter
Re: [Iotops] maintain ownership Michael Richardson
Re: [Iotops] maintain ownership William_J_G Overington
Re: [Iotops] maintain ownership William_J_G Overington