Re: [Rats] 802.1AR device identity

["Smith, Ned" <[e-mail]>]

The 802.1AR spec doesn’t AFAIK require IDevIDs that can’t change. But not curtain. Is says things like:

A

device’s DevID module stores each of its DevID secrets securely and supports signing operations that prove

possession of the secret (and thus that the device is the subject of the associated DevID certificate), while

ensuring that the secret remains confidential so the device cannot be impersonated by others.

An Initial Device Identifier (IDevID) provided by a device’s supplier can be supplemented by one or more

Local Device Identifiers (LDevIDs), each using an existing or a freshly generated secret, facilitating

enrollment (provisioning of authentication and authorization credentials to authenticated devices) by a local

network administrator.



A device with DevID capability incorporates a globally unique manufacturer provided Initial Device

Identifier (IDevID), stored in a way that protects it from modification.


LDevIDs can also be used as the sole identifier (by disabling the IDevID) to

assure the privacy of the user of a DevID and the equipment in which it is installed.

-Ned
From: RATS <[e-mail]> on behalf of Guy Fedorkow <gfedorkow=[e-mail]>
Date: Wednesday, March 10, 2021 at 7:59 AM
To: Laurence Lundblade <[e-mail]>
Cc: "[e-mail]" <[e-mail]>
Subject: [Rats] 802.1AR device identity

Hi Laurence,
  We talked about device identity on the RATS call today.
  For RIV, we’re relying on this IEEE spec:
https://1.ieee802.org/security/802-1ar/
  That spec defines Initial and Local Device Identities.  Initial DevID is set by the manufacturer and can’t be changed or replaced, while the Local DevID can be set and erased by the owner of the gear.
  The spec doesn’t address deciding which identity to use for any specific application, but the intent clearly is to allow the owner to use the manufacturer-supplied identity to install an owner-specific identity in a device, and erase the owner-specific identity leaving the manufacturer identity in place when the device is decommissioned.

  Many different specs must have examined this problem, but of course it never hurts to re-use some of these ideas where possible.
  Thx
/guy



Juniper Business Use Only