Re: [Drip] Claims, Attestations, and Certificates

[Robert Moskowitz <[e-mail]>]

OOPS!!!

7250 says:


    opaque ASN.1Cert<1..2^24-1>;

    struct {
        select(certificate_type){

             // certificate type defined in this document.
             case RawPublicKey:
               opaque ASN.1_subjectPublicKeyInfo<1..2^24-1>;

            // X.509 certificate defined in RFC 5246
            case X.509:
              ASN.1Cert certificate_list<0..2^24-1>;

            // Additional certificate type based on
            // "TLS Certificate Types" subregistry
        };
    } Certificate;


so that is the HI, not the HIT.

Thus either need to update 7250, stick with the X.509 form of the 
RAA|HDA, HHIT, HI certificate, or create something new for DTLS to use 
HHIT|HI.

Opinions?



On 11/18/20 4:10 PM, Robert Moskowitz wrote:
> This is more on the CAC subject after lots of thoughts about who is on 
> 1st.
>
> A HHIT is a Claim.
>
> The entity putting forward the HHIT is making a statement, without 
> proof that there is a HI registered to the RAA|HDA and the hash 
> component of the HHIT is derived from all the appropriate information 
> following the ORCHID function.
>
> The Self-Attestation is an Attestation/Claim of HI ownership.
>
> Through the signature process, the entity putting forward the 
> Self-Attestation is proving ownership of a keypair.  Validation of 
> this proof does require obtaining the HI; it is CLAIMED that the 
> RAA|HDA in the HHIT can provide the HI needed for the proof.
>
> The Offline-Attestation is a full Attestation of all facts.
>
> The 'internal' HDA Attestation of HI registration with the HDA is just 
> an Attestation, not a Certificate (see below).  The 'outer' envelope 
> is an Attestation of owning the HI registered and signing.
>
> Finally, why an Attestation and not a Certificate?
>
> In my view, a Certification of Registration would contain more 
> information than currently in the HDA HI registration Attestation. 
> Minimally it should have a registration date and end of registration 
> period date.  Probably more, but this is sufficient to place it as an 
> Attestation, not a Certificate.
>
> Thus the terminology I have used in draft-ietf-drip-rid.
>
> Next we can talk about all the objects in the claims draft....
>
> Fun stuff!
>
> Bob
>