Re: [Secret] Questions and comments on tigress charter

[Dmitry Vinokurov <[e-mail]>]

Hi Jim,

Thank you for the review.
As you correctly mentioned, the problem of sharing credential is more complex than just giving a key to another person.
It is more so taking into account the variety of all types or verticals of credentials - some may use symmetric keys, other asymmetric; some devices require credential provides (authority) that generate new keys, other (home or CCC) generate new keys on device.

We specifically did not want to bring into scope the underlying access technologies - such as credential provides, access devices, key generation and provisioning.
The focus of this WG is limited to the problem of transferring such credentials from sender to receiver.
Provisioning process that follows the transfer is much more complex since is is different not just per vertical (e.g. carKey or home key) but even per certain access technology - e.g. HID or SEOS or CCC.


Dmitry Vinokurov

> On Jul 3, 2022, at 12:00 PM, [e-mail] wrote:
> 
> Send Secret mailing list submissions to
> 	[e-mail]
> 
> To subscribe or unsubscribe via the World Wide Web, visit
> 	https://www.ietf.org/mailman/listinfo/secret
> or, via email, send a message with subject or body 'help' to
> 	[e-mail]
> 
> You can reach the person managing the list at
> 	[e-mail]
> 
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Secret digest..."
> Today's Topics:
> 
>   1. Questions and comments on tigress charter (Jim Fenton)
> 
> From: Jim Fenton <[e-mail]>
> Subject: [Secret] Questions and comments on tigress charter
> Date: July 2, 2022 at 7:53:50 PM PDT
> To: [e-mail]
> 
> 
> I guess I missed the deadline on the call for consensus on the charter, but I have some questions and comments nonetheless. I’m referencing charter-ietf-tigress-00-06 as currently shown on Datatracker.
> 
> When I read through the use cases (giving someone temporary use of my car or letting the cat sitter in my home) I immediately thought of this as an authorization problem. I would normally solve this by giving the public key of the delegated user’s credential to the car or house and telling the car or house to accept that credential for some period of time. Or I might authenticate to the hotel and tell them to accept my spouse’s credential. The flow described in the charter is more complicated, and I assume there’s a good reason for that but I don’t understand what it is.
> 
> The charter also refers to a credential authority, but doesn’t explain anything about it. In the case of the cat sitter, what credential authority is there for my home? This is clearer in the hotel room key example (where presumably the credential authority is the hotel or hotel chain?) but that isn’t the general case here.
> 
> I missed the previous BOF but would like to understand the motivation for this WG better.
> 
> -Jim
> 
> 
> 
> 
> Secret mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/secret