Re: [pkix] Simple Certificate Enrollment Protocol (SCEP)

[Jeffrey Walton <[e-mail]>]

On Wed, Oct 29, 2014 at 12:19 PM, Anders Rundgren
<[e-mail]> wrote:
> The only thing that could eventually replace SCEP for "devices" including
> BYOD, would be a protocol that builds on embedded attestation keys like the
> FIDO/Google U2F scheme.  Such a scheme could completely eliminate the
> reliance on enrollment passwords.
Attestation key pairs are shared across devices by a vendor to provide
anonymity (cf.,
https://fidoalliance.org/specs/fido-u2f-overview-v1.0-rd-20141008.pdf,
page 9). I don't think one of SCEP's design goals is anonymity (but
its been a while since I looked at it and NDES).

Rather, I'm pretty sure its the opposite: during provisioning, the
SCEP admin wants to know who/what is being provisioned. In this case,
the anonymity provided by the attestation key pairs is probably
unwanted; and the uniqueness provided by a challenge password is
probably desired.

I wonder how long before the attestation key pairs start showing up in
Little Black Box (https://code.google.com/p/littleblackbox/).