Re: [Secdispatch] DANE IOT proposed outcome

Hi Wei Pan,

I'll ask Ash (who is more plugged into the IOT ecosystem than I am) to
confirm .. but yes, our use case expects devices to have IDevID or some
other preconfigured unique value, so it should be possible to work with
BRSKI. For the DNS record format naming, we were initially looking at the
formats defined in draft-friel-pki-for-devices, specifically the LDevID
organization managed form, but have a slightly simpler form currently
specified in the draft.

Shumon.

On Mon, Nov 16, 2020 at 7:02 AM Panwei (William) <william.panwei@huawei.com>
wrote:

> Thanks to Eliot for summarizing these.
>
>
>
> I think the core concept of using DANE in IoT scenario is to get rid of
> certificates and PKIX. The solution of how to securely onboard the IoT
> devices and allocate the DNS domain name, both with and without initial
> certificates, is the key part to figure out.
>
> If the IoT devices have no initial certificates, such as 802.1AR IDevID
> certificate, as their initial identity, then the BRSKI mechanism won’t be
> appropriate for these devices because BRSKI has a requirement of IDevID.
>
> If the IoT devices have an IDevID certificate, I think it can still use
> BRSKI to onboard, but it won’t use EST to request a certificate any more,
> instead, it will apply for a DNS domain name by using some protocols.
>
>
>
> That’s my preliminary thoughts, maybe not right.
>
>
>
> Regards & Thanks!
>
> Wei Pan
>
>
>
> *From:* Secdispatch [mailto:secdispatch-bounces@ietf.org] *On Behalf Of *Eliot
> Lear
> *Sent:* Monday, November 16, 2020 6:55 PM
> *To:* secdispatch@ietf.org
> *Subject:* [Secdispatch] DANE IOT proposed outcome
>
>
>
> Thanks to Shumon for presenting the DANE use case for IOT.
>
>
>
> We discussed taking this to the iot-onboarding@ietf.org list as there
> were a number of rather big open issues that people wanted to discuss.
>
>
>
> We also discussed a non-WG forming BOF to look at, as Ted put it, the
> broader context for onboarding.  To give people a feel for the sort of
> related work that is available, here are a list of related activities:
>
>
>
>    - draft-ietf-anima-bootstrapping-keyinfra (BRSKI) is a
>    request/response mechanism that uses RFC 8366 vouchers to introduce devices
>    and network infrastructure.
>    - Intel’s SDO provides an application level introduction using
>    vouchers as well.  This work has been taken up by the FIDO alliance.
>    - The Wifi Alliance has Device Provisioning Protocol (DPP) which does
>    not attach to a global name space prior to provisioning having occurred,
>    but does represent a minimum case (just public keys).
>    - draft-friel-eap-tls-eap-dpp borrows from DPP, intended mostly for
>    wired use, where DPP is focused on 802.11 networks.
>    - There are a number of BRSKI related drafts by Owen as well, relating
>    to cloud-based registrars.
>    - There is also work by Michael Richardson and Peter Van Der Stock on
>    constrained vouchers.  That work is taking place in ACE.
>
>
>
> Understanding the landscape might help us understand where DANE fits in.
>
>
>
> Regards,
>
>
>
> Eliot
> _______________________________________________
> Secdispatch mailing list
> Secdispatch@ietf.org
> https://www.ietf.org/mailman/listinfo/secdispatch
>