Re: [lamps] Call for Adoption of draft-tschofenig-lamps-nonce-cmp-est

[Michael Richardson <[e-mail]>]

Mike Ounsworth <Mike.Ounsworth=[e-mail]> wrote:
    > In draft-ietf-lamps-csr-attestation we say that establishment of the
    > nonce between the CA and cert requester is important but needs to be
    > handled by the cert enrollment
    > protocol. draft-tschofenig-lamps-nonce-cmp-est is an instantiation of
    > that. It’s good and important work.

For some time a few of us have been considering how to carry Attestion
Evidence in an RFC8366/8995 voucher request.  The result would be a
background check with the Registrar acting as RP, and the MASA acting a
Verifier.  To make this work we need some freshness for that evidence. Up to
now, I considered doing this via a TLS Exporter on the EST connection.

A reason I haven't gone ahead with that idea is that any remote attestation
that is done at onboarding time might create more execute once code paths.
It would better if IoT devices that are onboarded do some continuous
assurance, and it would better to just run that protocol right after onboarding.

This document suggests in the filename that it is going to support EST, but I
can't see that in the document itself.  I'm not sure what the intentions are;
maybe there is an interaction with  draft-ietf-lamps-rfc7030-csrattrs ??

I think that this document says too much about the CSR attestation situation
(end of section 3).  I would just remove it, and let csr-attestation say
this.



--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide