Re: [Rats] name of identity key

[Guy Fedorkow <[e-mail]>]

Hi Michael,
  I'm not sure I'm seeing the problem...
  The identity key used for ZTP and the identity key used to prove that you're attesting the right box are most likely  the same, as they have the same role, that of authenticating a secure connection to a device.  And it's up to the device manufacturer and the system administrator as to whether they want to use an IDevID provided by the manufacturer or an LDevID provided by the sysadmin.  Obviously if you want drop-ship sZTP to work, it has to be the manufacturer's identity key, since the sysadmin won't get to touch the box before it's plugged in.  But there's nothing to say they couldn't pre-stage it and install a Local Device Identity key (and Local Attestation Key)
  In RIV, it's the Attestation key (Initial or Local) that must be unique, and that one has no purpose other than to sign the evidence collected in the TPM.

  Is there something I'm missing in your question below?

  Thanks
/guy




Juniper Business Use Only

-----Original Message-----
From: Michael Richardson <[e-mail]> 
Sent: Monday, November 25, 2019 2:57 AM
To: Guy Fedorkow <[e-mail]>; [e-mail]
Cc: Jessica Fitzgerald-McKay <[e-mail]>; Henk Berkholz <[e-mail]>; Smith, Ned <[e-mail]>; William Bellingrath <[e-mail]>
Subject: Re: name of identity key


Guy Fedorkow <[e-mail]> wrote:
    > Hi Michael, I don't want to lose your question on the name of the
    > identity credential in RIV (or RATS)...  I think you were saying that
    > from a RATS point of view, you'd want to make the spec more generic
    > than a strict requirement for IEEE DevID.  Can you help me see why?  Is
    > there a more generic way of specifying the certificate that goes with
    > the identity key?  Thanks /guy

I (draft-ietf-anima-bootstrapping-keyinfra) am the user of an IDevID deployed in devices.  This is often located in a TPM.

If the TPM has to have a different IDevID key for signing Evidence, then I forsee a number of problems if the key has the same DN (serial-number, etc.) as the IDevID used for onboarding.

Is it signed by the same manufacturer CA as the onboarding IDevID?
(what names do I even use to distinguish these two keys?)

I can see manufacturers pushing back on having two identities.

One answer might be:
  MANUCA -> RIV_IDEVID(w/CA:TRUE) -> Onboarding_IDEVID

--
Michael Richardson <[e-mail]>, Sandelman Software Works  -= IPv6 IoT consulting =-