[Drip] Authenticating DTLS with HHITs in DRIP

[Robert Moskowitz <[e-mail]>]

The 'P' in DRIP includes protocols used to support use of UAS Remote ID.

Currently two drafts contain proposed protocols for DRIP:

draft-moskowitz-drip-crowd-sourced-rid
draft-moskowitz-drip-secure-nrid-c2

DTLS is one of the security mechanisms presented in these drafts

The registration protocol still needs to be developed as well, and it 
too may use DTLS (and/or TLS for Operator/Pilot registration).

The question here is how to authenticate DTLS with HHITs.

Currently, X.509 (rfc8002 style) is the only defined container for HHITs 
within DTLS.  These are 'easy' to create within a HHIT registration 
process.  But they are 'big' and this may be an issue in some 
constrained communication channels.

What will it take to directly support HHITs for DTLS authentication?

RFC7250 provides a mechanism for using the HI, but this is inadequate.  
The authentication process needs the hierarchy in a trusted method.

For now I am going to write the drafts to use 8002-styled X.509 certs.  
But I am asking people to work out a 'simpler' DTLS authentication 
mechanism that can use HHITs and/or the HDA 132 byte RID registration 
attestation (but still needed to be wrapped in an OID).

Now back to writing text for drip-arch sec 4....


Bob