Re: [Drip] Claims, Attestations, and Certificates

[Robert Moskowitz <[e-mail]>]

oops oops!

Responded to the wrong email.

Please ignore this message for probably a day or two...

On 11/21/20 7:15 PM, Robert Moskowitz wrote:
> OOPS!!!
>
> 7250 says:
>
>
>    opaque ASN.1Cert<1..2^24-1>;
>
>    struct {
>        select(certificate_type){
>
>             // certificate type defined in this document.
>             case RawPublicKey:
>               opaque ASN.1_subjectPublicKeyInfo<1..2^24-1>;
>
>            // X.509 certificate defined in RFC 5246
>            case X.509:
>              ASN.1Cert certificate_list<0..2^24-1>;
>
>            // Additional certificate type based on
>            // "TLS Certificate Types" subregistry
>        };
>    } Certificate;
>
>
> so that is the HI, not the HIT.
>
> Thus either need to update 7250, stick with the X.509 form of the 
> RAA|HDA, HHIT, HI certificate, or create something new for DTLS to use 
> HHIT|HI.
>
> Opinions?
>
>
>
> On 11/18/20 4:10 PM, Robert Moskowitz wrote:
>> This is more on the CAC subject after lots of thoughts about who is 
>> on 1st.
>>
>> A HHIT is a Claim.
>>
>> The entity putting forward the HHIT is making a statement, without 
>> proof that there is a HI registered to the RAA|HDA and the hash 
>> component of the HHIT is derived from all the appropriate information 
>> following the ORCHID function.
>>
>> The Self-Attestation is an Attestation/Claim of HI ownership.
>>
>> Through the signature process, the entity putting forward the 
>> Self-Attestation is proving ownership of a keypair.  Validation of 
>> this proof does require obtaining the HI; it is CLAIMED that the 
>> RAA|HDA in the HHIT can provide the HI needed for the proof.
>>
>> The Offline-Attestation is a full Attestation of all facts.
>>
>> The 'internal' HDA Attestation of HI registration with the HDA is 
>> just an Attestation, not a Certificate (see below).  The 'outer' 
>> envelope is an Attestation of owning the HI registered and signing.
>>
>> Finally, why an Attestation and not a Certificate?
>>
>> In my view, a Certification of Registration would contain more 
>> information than currently in the HDA HI registration Attestation. 
>> Minimally it should have a registration date and end of registration 
>> period date.  Probably more, but this is sufficient to place it as an 
>> Attestation, not a Certificate.
>>
>> Thus the terminology I have used in draft-ietf-drip-rid.
>>
>> Next we can talk about all the objects in the claims draft....
>>
>> Fun stuff!
>>
>> Bob
>>
>

-- 
Standard Robert Moskowitz
Owner
HTT Consulting
C:248-219-2059
F:248-968-2824
E:[e-mail]

There's no limit to what can be accomplished if it doesn't matter who 
gets the credit