Subject: Re: [lamps] rollover of CA

From: Tomas Gustavsson <[email-masked]>
Date: Mon, 6 Sep 2021 07:25:30 +0000

Haha, nice reference 🙂

Those who control their devices often control the truststore as well, and populate new devices with non-expired CA certificates. The old SCEP protocol have a defined way of updating the trust anchor when devices renew, enabling controlled renewal+trust anchor update throughout a population of devices.

________________________________
From: Michael Richardson
Sent: Friday, September 03, 2021 8:08 PM
To: Tomas Gustavsson; Deb Cooley; Ryan Sleevi; SPASM
Subject: Re: [lamps] rollover of CA

Tomas Gustavsson <[email-masked]> wrote:
    > I remember being part of that discussion Michael.

    > RFC4210 describes it in section 4.2.
    > https://datatracker.ietf.org/doc/html/rfc4210#section-4.4

    > In reality I have only seen rollover using newWithOld, for example in
    > ICAO 9303 part 12 (there called Link Certificate). The purpose being to
    > be able to automatically update trust anchor with a new Root if you
    > already trust the old Root.
    > https://www.icao.int/publications/Documents/9303_p12_cons_en.pdf

    > I have never understood the purpose of, or seen a practical use, of
    > OldWithNew.

OldWithNew allows a device with an OldCert to be trusted by a device that
has the NewCert.   If the device would simply retain the OldCA, then it's not
needed.

However a device which has been recently commissioned might have never seen
the oldCA.   If it has to validate a connection from a device which has been offline for
awhile, it would an issue.
In practice, how would the old device ever get the OldWithNew Link Certificate?
That implies that the OldWithNew Link Certificate would never get sent
inband, but rather needs to be provided to new devices when they enroll.

For a practical explanation of this, and the risks of it, I refer you to:
  https://www.youtube.com/watch?v=4HJ-Y8YTo8Q   :-)

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide