Subject: [Iot-onboarding] So... looking where we are

From: Eliot Lear <[email-masked]>
Date: Tue, 27 Nov 2018 10:14:11 +0000

Hi everyone,

Thanks to a few people for contributing to the GitHub repo we are well on our way.  Dave Thaler in particular has pointed out that we might be asking the wrong questions in some cases.  I wonder if we could have that discussion.  Here are the questions, as they are listed there:

How does device introduce itself to the infrastructure or peer?
What, if any, proof of possession mechanism is there?
Is access to other IP-based devices required in order to fully onboard the device?
What form of credential is returned?
Is full Internet access required for onboarding?
Who becomes the root of trust at the end of onboarding (if any)
Could/Is the resulting credential be used for application identity?
What happens if the box gets reset?
How can transfer of ownership occur?
How can transfer to a different cloud service (if applicable) occur?
What sort of manufacturing requirements are there?
What sort of crypto requirements are there?
Reference link
The one in red is the one that Dave called out as not well-formed.

Eliot

---

From: Michael Richardson <[email-masked]>
Date: Thu, 29 Nov 2018 16:07:31 -0000

Eliot Lear <[email-masked]> wrote:
    > * Who becomes the root of trust at the end of onboarding (if any)

Maybe we could ask:
      "Is the transfer of ownership communicated by a change, or addition, to
      the root of trust?"

      (and a related SUIT-like question: does the transfer of ownership
      include the right to decide what firmware runs?)

    > * Could/Is the resulting credential be used for application identity?
    > * What happens if the box gets reset?
                                     ^factory

    > * How can transfer of ownership occur?
    > * How can transfer to a different cloud service (if applicable) occur?
    > * What sort of manufacturing requirements are there?
    > * What sort of crypto requirements are there?
    > * Reference link

    > The one in red is the one that Dave called out as not well-formed.

What's this colour stuff? :-)