IEEE 802.1AR-2018 says: An IDevID certificate "subject" field shall be non-null and should include a unique device serial number encoded as the "serialNumber" attribute (RFC 5280, X520SerialNumber).
Maybe the voucher (RFC 8366) could've called it "unique-id", and then bootstrapping protocols could likewise guide implementations to put a "unique-id" into the DevID's serialNumber field. Thus, from a standards perspective, IETF is not requiring the use of the device's serial number. But to what end? I believe that this is a privacy issue more so than a security issue. That is, the security of a device should not hinge on knowledge of its serial number, or any information that might be derived from the serial number (e.g., model number, manufacturing facility, manufacturing date, etc.). Separately, as long as we're raising issues with RFC 8366, I strongly believe that the pinned-domain-certificate should've be a list of certificates. Or, in crypto-types [1] terms, a trust-anchor-cert-cms, not a trust-anchor-cert-x509. To enable the pinned-domain-certificate for an intermediate CA to be a chain that includes the root self-signed certificate, thus supporting tooling unable to validate partial-chains. [1] https://tools.ietf.org/html/draft-ietf-netconf-crypto-types Kent -----Original Message----- From: Anima <anima-boun...@ietf.org> on behalf of Michael Richardson <mcr+i...@sandelman.ca> Date: Thursday, November 29, 2018 at 9:00 PM To: "anima@ietf.org" <anima@ietf.org> Subject: [Anima] gen art issue 7: serial-number in voucher issue #95 https://github.com/anima-wg/anima-bootstrap/issues/95 Jari> Section 3.1: Jari> grouping voucher-request-grouping Jari> +---- voucher Jari> +---- created-on? yang:date-and-time Jari> +---- expires-on? yang:date-and-time Jari> +---- assertion enumeration Jari> +---- serial-number string Jari> I'm not sure it is necessary to base everything on a serial number. I wrote this down, and then went back for context, and found little. So, let's discuss this. You have another idea? The serial-number, as explained in section 2.3.1, the serial-number is pretty critical. It goes into the certificate and the MASA uses it as it's primary key. So I'm not really sure how to proceed with this comment. -- Michael Richardson <mcr+i...@sandelman.ca>, Sandelman Software Works -= IPv6 IoT consulting =- _______________________________________________ Anima mailing list Anima@ietf.org https://www.ietf.org/mailman/listinfo/anima
