Re: [T2TRG] idevid-considerations at -- SecDispatch/IETF108

Good start, Michael.

I have sent a zillion editorial comments (yes, starting from “toxonomy”) to the authors; I really recommend reading the document as soon as they are addressed.

It is amazing that even this document occasionally falls into the trap of using the same term for a public key/certificate and a key pair (or even the attribute that is proven by demonstrating the possession of that key pair).  That is easy to do because they work in step/in harmony, but we do need to fix our language here.

I think that the questions in Section 6 are good ones, but sometimes I feel that more fundamental questions are struggling to come to the light here.  Can we find them?

The document discusses the issue of “justified parties” for the manufacturing process, but not for the PKI side.  Maybe we can expand on that, too.

Grüße, Carsten

> On 2020-08-19, at 00:46, Michael Richardson <mcr+ietf@sandelman.ca> wrote:
> 
> I have re-posted with a new name, and title:
> 
> https://datatracker.ietf.org/doc/draft-richardson-t2trg-idevid-considerations/
> 
> A Toxonomy of operational security of manufacturer installed keys and
>                                anchors
>            draft-richardson-t2trg-idevid-considerations-00
> 
> Abstract
> 
>   This document provides a toxonomy of methods by manufacturers of
>   silicon and devices secure private keys and public trust anchors.
>   This deals with two related activities: how trust anchors and private
>   keys are installed into devices during manufacturer, and how the
>   related manufacturer held private keys are secured against
>   disclosure.
> 
>   This document does not evaluate the different mechanisms, but rather
>   just serves to name them in a consistent manner in order to aid in
>   communication.
> 
> _______________________________________________
> T2TRG mailing list
> T2TRG@irtf.org
> https://www.irtf.org/mailman/listinfo/t2trg