Re: [lamps] Renewing (short lived) certs with EST (RFC7030) [was: Re: Sean: Permissibility of expired cert renewal]

[Michael Richardson <[e-mail]>]

mcr> I think that what we want to do is write a Security Considerations for renewing
mcr> certificates using EST with an expired certificate as
mcr> authentication.    We need to outline what kinds of policy might be required,
mcr> and when it would be approrpriate not to accept specific certificates, or when it
mcr> might be appropriate to accept no expired certificates (perhaps for an interval
mcr> of time).  Or just how old (as a percentage of cert life) is too old.
mcr>
mcr> I think that the threat case here is that devices are inappropriately disposed of
mcr> (vulnerable to dumpster diving or ebay acquisition), with the assumption that
mcr> the credentials are old and do not need to be wiped.
mcr> Probably there are other threat cases that I have not thought of, and I think that
mcr> the goal would be to write the threats down... ideally to give them names.


On Aug 30, 2018, at 13:25, Jim Schaad <[e-mail]> wrote:
> One of the issues that you need to make sure to include is that revocation
> information must be kept by the EST server until the point in time that the
> expired certificate would not be permitted to be used for authentication.
> There is currently on a requirement that this information be kept by the
> server until "the first CRL after the certificate expired as been issued."

That's a very good point.

Sean Turner wrote:
> Mike,
> If you do that then I think you’ll be good to go.

okay.

Toerless, are we trying to put this into draft-ietf-anima-autonomic-control-plane ?
If so, I'll attempt to draft something that fits into that document.

If it belongs somewhere else, then please tell me.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-