Re: [lamps] Call for Adoption of draft-tschofenig-lamps-nonce-cmp-est

["Brockhaus, Hendrik" <[e-mail]>]

Michael

Hannes provided a first version of the EST specifics in Section 4.
https://datatracker.ietf.org/doc/html/draft-tschofenig-lamps-nonce-cmp-est-01#name-conveying-a-nonce-in-est

Hendrik

> -----Ursprüngliche Nachricht-----
> Von: Spasm <[e-mail]> Im Auftrag von Michael Richardson
> Gesendet: Montag, 15. April 2024 18:10
> An: LAMPS <[e-mail]>
> Betreff: Re: [lamps] Call for Adoption of draft-tschofenig-lamps-nonce-cmp-
> est
> 
> 
> Mike Ounsworth <Mike.Ounsworth=[e-mail]> wrote:
>     > In draft-ietf-lamps-csr-attestation we say that establishment of the
>     > nonce between the CA and cert requester is important but needs to be
>     > handled by the cert enrollment
>     > protocol. draft-tschofenig-lamps-nonce-cmp-est is an instantiation of
>     > that. It’s good and important work.
> 
> For some time a few of us have been considering how to carry Attestion
> Evidence in an RFC8366/8995 voucher request.  The result would be a
> background check with the Registrar acting as RP, and the MASA acting a
> Verifier.  To make this work we need some freshness for that evidence. Up to
> now, I considered doing this via a TLS Exporter on the EST connection.
> 
> A reason I haven't gone ahead with that idea is that any remote attestation
> that is done at onboarding time might create more execute once code paths.
> It would better if IoT devices that are onboarded do some continuous
> assurance, and it would better to just run that protocol right after onboarding.
> 
> This document suggests in the filename that it is going to support EST, but I
> can't see that in the document itself.  I'm not sure what the intentions are;
> maybe there is an interaction with  draft-ietf-lamps-rfc7030-csrattrs ??
> 
> I think that this document says too much about the CSR attestation situation
> (end of section 3).  I would just remove it, and let csr-attestation say
> this.
> 
> 
> 
> --
> Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
>            Sandelman Software Works Inc, Ottawa and Worldwide
> 
> 
>