Re: [lamps] IDevID considerations document to secdispatch

[Tomas Gustavsson <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512


On 2020-06-11 19:52, Michael Richardson wrote:
>
> Tomas Gustavsson <[e-mail]> wrote:
>> The notion of serialNumber in the document, for me, reads as it's
>> not clear what is the certificate serial number (9-19 bytes in
>> your document) and the device serial number. There don't have to
>> be the same. What I have seen commonly used is that the subjectDN
>> field is used to carry the device serial number, while the
>> certificate serial number is random, and only used to uniquely
>> identify the certificate in the PKI (issuer/serial).
>
> Your assumption is entirely correct.  I wish that certificates
> hadn't used "serial Number" in it's terminology, as it's really
> "certificate Identifier", and we have learnt the hard way that it
> should not be sequential.
>
>> In such a case I would assume that the manufacturing execution
>> system (MES) and it's database controls the device serial number,
>> while the PKI controls the certificate serial number, and there
>> does not have to be any synchronization between these two.
>
> Agreed. Do I say something different here?  I would love to clarify
> things.

This section confused me at first read:
- -----
In all cases the serialNumber embedded in the certificate must be
unique across all products produced by the manufacturer. This suggests
some amount of structure to the serialNumber, such that different
intermediate CAs do not need to coordinate when issuing certificates
- -----

At first read I thought about certificate serial number, but now
realize it's the device serial number that is meant. I think that
section can be clarified somewhat.


Some additional nitpicking...
I think this section is missing an 's'?
- -----
The intermediate CA will have a private key, likely kept online, which
is used to sign each generated IDevID. Once the IDevID are created,
the private key is no longer needed and can either be destroyed, or
taken offline.
- -----

In the line preceding this section it talks about "some number of
IDevIDs". Then that the CAs private key can be destroyed after
generating that number if IDevIDs. Hence, just ad an s:

"Once the IDevID are created, the private key is no longer needed and
can either be destroyed, or taken offline."
- ->
"Once the IDevIDs are created, the private key is no longer needed and
can either be destroyed, or taken offline."

Regards,
Tomas
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEWhJUWO1gQBfiUtymYm3EmwBD/kAFAl7nC8gACgkQYm3EmwBD
/kCVAQgAw1vi8QdbAapwi60XQsStaRK1Ap8sNtkfMpyq7J4E45VREVLoazhKnqlX
w5JxuM5ViHPgekNBnIk1qj3hN5XjPEFxZGtoy8Dx1iJh6w0pu8jbK5p/LKBWX71U
H0f1FXQ6e2NGmfSviWR4G76ikapI4bfq05SlIrWP29+b/GPaqUZPyX5g0Uf/UANu
4cWAhnOH6DlSEcHolMJzc7Zi61bjIkY1XXd25AZFiu1/uer0zhxZV/kwuj69ELTd
OTKOrprmOHVtcOC3PapIK0or4c6EusJSBdY3mpo4OibjKKiJsEhQUFqAnj+osg3Q
P7rH5eYNul83MAb0jlAZk88oc3Z2HA==
=NCZB
-----END PGP SIGNATURE-----