Re: [pkix] Simple Certificate Enrollment Protocol (SCEP)

[Anders Rundgren <[e-mail]>]

On 2014-11-10 03:47, Jeffrey Walton wrote:
> On Wed, Oct 29, 2014 at 12:19 PM, Anders Rundgren
> <[e-mail]> wrote:
>> The only thing that could eventually replace SCEP for "devices" including
>> BYOD, would be a protocol that builds on embedded attestation keys like the
>> FIDO/Google U2F scheme.  Such a scheme could completely eliminate the
>> reliance on enrollment passwords.
> Attestation key pairs are shared across devices by a vendor to provide
> anonymity (cf.,
> https://fidoalliance.org/specs/fido-u2f-overview-v1.0-rd-20141008.pdf,
> page 9). I don't think one of SCEP's design goals is anonymity (but
> its been a while since I looked at it and NDES).
>
> Rather, I'm pretty sure its the opposite: during provisioning, the
> SCEP admin wants to know who/what is being provisioned. In this case,
> the anonymity provided by the attestation key pairs is probably
> unwanted; and the uniqueness provided by a challenge password is
> probably desired.


You are absolutely right.  Enrolling certificates to anonymous routers etc.
would be the opposite to what you want.

The problem with PKIX protocols is that they don't provide mechanisms
for attesting keys.  BTW, I suggested this years ago.

>
> I wonder how long before the attestation key pairs start showing up in
> Little Black Box (https://code.google.com/p/littleblackbox/).
>