Re: [TLS] Inclusion of OCB mode in TLS 1.3

[Peter Gutmann <[e-mail]>]

Aaron Zauner <[e-mail]> writes:

>That's a nice trick but as you point out pretty useless in terms of a PKI.

It's done solely to deal with browsers, which demand to see a certificate when
they're connecting to something via TLS.

(Aside: You can see why some people think the CA/Browser forum as a conspiracy
 to force the use of certs, despite there being very good alternatives
 available browsers force you to use certificates whether they're appropriate
 or not).

More generally, PKI is pretty much useless for many SCADA situations.  Take
for example IEDs, the unfortunately-named Intelligent Electronic Devices used
in the power industry.  These talk something like GOOSE/GSSE or MMS running
over DNP3 or switched Ethernet, or maybe Modbus, for which PKI makes no sense
whatsoever (both because the way things are identified don't work with
certificates, and because the concept of doing cert-provisioning and
revocation checking and whatnot in an IED like an on-load tap changer
controller is just bizarre).

What I've seen so far (and things are in a state of change at the moment
because there are standards that say you have to use TLS with certificates and
whatnot and the industry is realising that while it's fine to say that in a
spec, it doesn't work in practice) is a management interface using hardwired
certs (the memcpy()-a-blob system) and then the control interfaces using PSK
or who knows what else (there are vast numbers of protocols used, it's a
headache to untangle them).

Peter.