Re: [TLS] bootstrapping of constrained devices

On 2014-03-21 02:52, Rene Struik wrote:
> Hi Robert:
> 
> Wouldn't it be much easier to embed device certificates with constrained devices at manufacturing? This may do away with need to store info that is not public on servers.

+1

way to go
> 
> If you could provide some links to discussions in "IoT community groups" interested in this, that would help.
> 
> Best regards, Rene
> 
> ==
> There is a lot of interest in the IoT community in using some form of PAKE in conjunction with DTLS (or TLS with EAP) for authenticating commissioning/bootstrapping of IoT devices onto IoT networks
> 
> On 3/20/2014 1:21 PM, Robert Cragie wrote:
>>
>> It should be remembered that TLS is used in places other than web browsers - the existence of the DICE WG is testament to this. There is a lot of interest in the IoT community in using some form of PAKE in conjunction with DTLS (or TLS with EAP) for authenticating commissioning/bootstrapping of IoT devices onto IoT networks. I realise this is different to the original proposition in this thread but wanted to draw this to the attention of the WG nevertheless.
>>
>> Robert
>>
>> On 20 Mar 2014 12:28, "Daniel Kahn Gillmor" <dkg@fifthhorseman.net <mailto:dkg@fifthhorseman.net>> wrote:
>>
>>     On 03/20/2014 12:18 PM, Paul Hoffman wrote:
>>     > As an important note, you did not define "we" above. A few possible expansions would be:
>>     >
>>     > - The TLS WG, where this thread currently lives, does not get to define Web UI without a charter change.
>>     >
>>     > - The HTTPbis WG has not asked the TLS WG to take over this work, nor has it embraced anything like it.
>>     >
>>     > - The IETF doesn't do this kind of work as a whole body.
>>     >
>>     > - The IAB (of which none of us are part of the "we") might take the topic on and suggest ways which the IETF might do the work.
>>
>>     yep, thanks for the clarification.  I actually meant "we" in the broad
>>     sense of "the community of people who care about making communications
>>     on the web more secure", which includes groups you didn't even mention
>>     above, like web site designers, systems administrators, etc.
>>
>>     It's still on-topic here (despite the broad scope implied above) because
>>     the TLS WG does have a role to play, by considering the merits of
>>     proposals like http://tools.ietf.org/html/draft-thomson-tls-care, as
>>     well as considering alternatives that deal with this particular use case.
>>
>>     >> option (A) is seriously hard, maybe impossible given the state of the
>>     >> web.  option (B) is terrible.
>>     >
>>     > Exactly right, for any value of "we".
>>
>>     :(
>>
>>             --dkg
>>
>>
>>     _______________________________________________
>>     TLS mailing list
>>     TLS@ietf.org <mailto:TLS@ietf.org>
>>     https://www.ietf.org/mailman/listinfo/tls
>>
>>
>>
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/listinfo/tls
> 
> 
> -- 
> email: rstruik.ext@gmail.com | Skype: rstruik
> cell: +1 (647) 867-5658 | US: +1 (415) 690-7363
> 
> 
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>