Re: [Madinas] identities for legitimate devices

[Michael Richardson <[e-mail]>]

    > On 04/11/2020 16:54, Michael Richardson wrote:
    >> But, the key (pun intended), in my opinion, is to change the device
    >> identity from being a MAC address to being a key.

Stephen Farrell <[e-mail]> wrote:
    > While agreeing with the goal (for home networks and similar) I'd word
    > it differently - such n/w's often do not need to identify a specific
    > device, they only need to authorise access to the network.  A common
    > PSK can be fine for that.

A common PSK means that one can not determine which device has become infected.

Is your objection based upon privacy implications of a device doing EAP-TLS
with a home router?  The device would reveal it's client certificate to an
on-path/MITM/malicious-messenger attacker.
Noting that the identity in an LDevID could be arbitrary, but of course, the
public key would still identity the device.

A unique-per-device PSK does not suffer the same, but is presently hard to
provision.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide