Subject: [KEYPROV] DeviceBinding (again)

From: "Hannes Tschofenig" <[email-masked]>
Date: Tue, 10 Feb 2009 15:20:07 +0200

Hi all, 

this is the current text for the <DeviceBinding> element: 

"
   <DeviceBinding>:  This element carries the identifier that can be
      used to bind keys to the device or to a class of devices.  When
      loading keys into a device, this identifier can be checked against
      information obtained from the device to ensure that the correct
      device or class of device is being used.
"

Based on the discussion I would suggest to extend the description. Here is a
first proposal: 

"
<DeviceBinding>:  In a number of cases access to lower layer device
identifiers, such as a serial number, from a PSKC implementation is
difficult or not possible. For this purpose an opaque identifier, carried in
the <DeviceBinding> element, is introduced that allows to bind keys to the
device or to a class of devices.  When loading keys into a device, the value
of the <DeviceBinding> element MUST be checked against information provided
to the user via out-of-band mechanisms. The implementation then ensures that
the correct device or class of device is being used with respect to the
provisioned key.
"

Helpful? 

Ciao
Hannes