[KEYPROV] Provisioning versus Key Management

[Anders Rundgren <[e-mail]>]

For people with interests in future provisioning and key management 
standards...

My initial take on KeyGen2 already in the version it got during my RSA
time supported key management as a part of the provisioning process.

However, it used a fairly simple-minded approach since any serious
key management requires some kind of verification that key(s) to be
managed actually are available.

I have subsequently dropped all the original KeyGen2 ideas [*] in order
to create something that scales better and is more reliable than schemes
based on "assumptions".

The net result is that KeyGen2 now can perform an arbitrary mix of
key provisioning and key management functions.  To do that the
revised protocol support 5 request-response pair but not all of them
needs to be used.

- PlatformNegotiation
- ProvisioningInitialization
- Optional: CredentialDiscovery
- Optional: KeyInitialization
- ProvisioniningFinalization

An example of a KM-only sequence:

http://webpki.org/papers/keygen2/remote-key-unlock.pdf

The KM scheme uses a souped-up version of that of GlobalPlatform.

-- Anders

*] Except using X.509 certificates as key-IDs.  CA keys are though no
longer used for key management because that could inhibit adoption.

http://webpki.org/auth-token-4-the-cloud.html