Re: [Secdispatch] [lamps] IDevID considerations document to secdispatch

[Michael Richardson <[e-mail]>]

Brockhaus, Hendrik <[e-mail]> wrote:
    > I use the image of the "birth certificate" to better explain the attributes of an IDevID certificate.
    > - Issued at manufacturing time (in Germany the birth certificate is a
    > simple sheet stamped and signed by the local register office)

    > - The enrollment process requires some organizational/physical
    > security, as there is nothing to derive trust from at that point in
    > time (in Germany the father or mother have to request the birth
    > certificate personally. They need to define the name of the child in
    > front of the register officer and need present a conformation letter
    > from the hospital or midwife about the date of birth)

In Canada, I think the birth certificate is signed by doctor or midwife.

    > - It lasts as long as the device is used (in Germany a birth
    > certificate has no validity and it is difficult to get a new one, if
    > you lost yours)

Thus IDevID never expire.

    > - It is required for initial authentication to request an operational
    > certificate (in Germany the birth certificate is required if you
    > request a national ID card or a passport)

    > - It should not be used for day-to-day operational tasks (you would not
    > use the birth certificate to identify yourself other than to the
    > register office. Only rarely it is requested, e.g., when becoming a
    > governmental or public official)

But, you don't use your IDevID for day-to-day activities.
One needs an onboarding protocol to talk to an organizational CA to get the LDevID.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-