Subject: [Drip] Claims, Attestations, and Certificates

From: Robert Moskowitz <[email-masked]>
Date: Wed, 18 Nov 2020 16:10:09 -0500

This is more on the CAC subject after lots of thoughts about who is on 1st.

A HHIT is a Claim.

The entity putting forward the HHIT is making a statement, without proof 
that there is a HI registered to the RAA|HDA and the hash component of 
the HHIT is derived from all the appropriate information following the 
ORCHID function.

The Self-Attestation is an Attestation/Claim of HI ownership.

Through the signature process, the entity putting forward the 
Self-Attestation is proving ownership of a keypair.  Validation of this 
proof does require obtaining the HI; it is CLAIMED that the RAA|HDA in 
the HHIT can provide the HI needed for the proof.

The Offline-Attestation is a full Attestation of all facts.

The 'internal' HDA Attestation of HI registration with the HDA is just 
an Attestation, not a Certificate (see below).  The 'outer' envelope is 
an Attestation of owning the HI registered and signing.

Finally, why an Attestation and not a Certificate?

In my view, a Certification of Registration would contain more 
information than currently in the HDA HI registration Attestation. 
Minimally it should have a registration date and end of registration 
period date.  Probably more, but this is sufficient to place it as an 
Attestation, not a Certificate.

Thus the terminology I have used in draft-ietf-drip-rid.

Next we can talk about all the objects in the claims draft....

Fun stuff!

Bob

---

From: Robert Moskowitz <[email-masked]>
Date: Sat, 21 Nov 2020 19:15:51 -0500

OOPS!!!

7250 says:

    opaque ASN.1Cert<1..2^24-1>;

    struct {
        select(certificate_type){

             // certificate type defined in this document.
             case RawPublicKey:
               opaque ASN.1_subjectPublicKeyInfo<1..2^24-1>;

            // X.509 certificate defined in RFC 5246
            case X.509:
              ASN.1Cert certificate_list<0..2^24-1>;

            // Additional certificate type based on
            // "TLS Certificate Types" subregistry
        };
    } Certificate;

so that is the HI, not the HIT.

Thus either need to update 7250, stick with the X.509 form of the 
RAA|HDA, HHIT, HI certificate, or create something new for DTLS to use 
HHIT|HI.

Opinions?

On 11/18/20 4:10 PM, Robert Moskowitz wrote:
> The entity putting forward the HHIT is making a statement, without 
> proof that there is a HI registered to the RAA|HDA and the hash 
> component of the HHIT is derived from all the appropriate information 
> following the ORCHID function.
>
> Self-Attestation is proving ownership of a keypair.  Validation of 
> this proof does require obtaining the HI; it is CLAIMED that the 
> RAA|HDA in the HHIT can provide the HI needed for the proof.
>
> an Attestation, not a Certificate (see below).  The 'outer' envelope 
> is an Attestation of owning the HI registered and signing.
>

---

From: Robert Moskowitz <[email-masked]>
Date: Sat, 21 Nov 2020 22:20:23 -0500

oops oops!

Responded to the wrong email.

Please ignore this message for probably a day or two...

On 11/21/20 7:15 PM, Robert Moskowitz wrote:
>> The 'internal' HDA Attestation of HI registration with the HDA is 
>> just an Attestation, not a Certificate (see below).  The 'outer' 
>> envelope is an Attestation of owning the HI registered and signing.
>>

-- 
Standard Robert Moskowitz
Owner
HTT Consulting
C:248-219-2059
F:248-968-2824
E:[email-masked]

There's no limit to what can be accomplished if it doesn't matter who 
gets the credit