Re: [Rats] UEID where an instance is a group member

[Thomas Fossati <[e-mail]>]

On 26/03/2020, 21:58, Ned Smith <[e-mail]> wrote:
> The point I was making is that EUID and keyID are not always
> synonymous. In a case where a device only ever has one key, then maybe
> they are synonymous. Otherwise, they should be treated differently.

I'd go a bit further than that: they are never synonyms, at least at a
conceptual level.

In particular, there might be attributes of an attesting endpoint which
are not necessarily related to the signing key.  For example, the
linking to certification data, and more generally anything that has a
chance to change during the lifetime of the device (or is not known at
manufacturing time) is more easily supplied via endorsements to the
verifier.  In my view, EUID/EGID is the handle to all this data, which
MAY include the key used to verify the signature.

((Also, there might be more than one key associated with an attesting
endpoint. But maybe this is too exotic an use case to be relevant in
this discussion.))

cheers, t
--

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.