Re: [Rum] RUE client credentials

[Brian Rosen <[e-mail]>]

Getting back to this, sorry for the delay.



> On Aug 12, 2019, at 3:40 PM, Paul Kyzivat <[e-mail]> wrote:
> 
> On 8/7/19 5:14 PM, Brian Rosen wrote:
>> Working on these comments.  I submitted a new version (-01)
>> I edited the doc to say the client cert is provisioned.  Given that it’s provisioned by the entity that the provides the server, do I need to say anything else about validating the cert?
> 
> I think we need to examine what the goal is here, and whether it is being achieved. I don't think enough is said to decide.
> 
> This client cert mechanism was first added way back when (2015 I think). IIRC, the motivation was because the providers wanted to restrict access to RUE *implementations* that have passed interoperability testing, in order to reduce the problems of dealing with buggy implementations or attackers.
I think you are confusing validating an implementation from authenticating a user.  The notion of mutual auth with a per-device cert is completely separate from some notion of “signing” an implementations code.

We can decide we don’t want the option of having mutual auth.

> 
> The idea was that certs would only be made available to *implementations* (e.g. images) that have been tested. There was no expectation that each user who obtains a rue would need to have it tested.
> 
> But the exact mechanism for binding a cert to a tested implementation was never worked out. I've asked around from time to time and I haven't learned of any way to achieve this.
> 
> Brian's new text pushes this off one level but doesn't solve the problem. The provider's *sip* server can perhaps trust that the rue got the cert from the provider's provisioning server. But the provisioning server still has to decide if this is a trustworthy implementation.
> 
> The Apple store and the Google Play Store solve this problem by being the distributor of apps. The developer has to submit the app, which is then tested/verified by the store and then being assigned credentials. Potentially we could have something list that by having a RUE Store operated by a RUE testing authority. But I don't think anybody is prepared to operate such a thing and it would require the devices receiving these apps to bypass the normal vendor restrictions on installations.
> 
> I don't have a good answer here.
> 
> 	Thanks,
> 	Paul
> 
>