Subject: [Iot-onboarding] my thoughts on the Wed morning -- ACME integration side meeting

From: Michael Richardson <[email-masked]>
Date: Mon, 29 Jul 2019 22:43:39 -0400

Owen posted some nice minutes, thank you.

I'm starting a new subject line/thread.  I thought the meeting was called "ACME
Integration" while Toerless described it as ACME for Devices. That's
interesting in itself.

Rifaat had a set of slides that is anchored in draft-yusef-acme-3rd-party-device-attestation.
I found it interesting that he wrote in terms of attestation, and OAUTH2.
So it's more ACME than attestation.  After a quick read of the document,
I am still unclear what the resulting certificate will have in its
rfc822Name!

{A note: There is a company "DeviceAuthority dot com" that provides an
 onboarding service that heresay says is the same as Intel SDO, and is
 halfway between this work and ANIMA BRSKI.  So this might be a poor name}

We spent most of the time in the morning meeting understanding Rifaat's
scenario.   I believe that we should have a "virtual interim" to share a
larger understanding of the different use cases.

I want to point to:
  http://www.lix.polytechnique.fr/hipercom/SmartObjectSecurity/papers/CullenJennings.pdf

which is essentially the same model, and is used for the same problem, which
is transfering control/ownership of VoIP phones to the enterprise owner.
 
Owen also presented during the ANIMA session, and he had the same issue
of what would go into the rfc822Name.  I had pointed out that it must be
provided by the Registrar in the CSRattributes request.
{This is also the section of RFC7030 which may get some better ASN.1
in my rfc7030cte-clarifications document}

We did not talk at all about draft-moriarty-acme-client, but I understand
that Kathleen presented it during the ACME meeting, which I missed.
But, reading it again, I think that maybe it is draft-moriarty-acme-overview
(of which I'm a co-author) that we should be talking about, and I didn't know
that there were two similarly named drafts.

I feel that perhaps some of these concerns would go away with running code?

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [