KMIP & EKMI Credential Bootstrapping

["Anders Rundgren" <anders.rundgren@telia.com>]

When you are about to perform trustworthy operations between different entities, authentication of the end-points is typically necessary.

It seems that KMIP (as well as EKMI) leaves the bootstrapping of end-point authentication credentials to somebody else to cater for.

Since this process is both highly device-dependent as well as generally difficult, KMIP interoperability may in practice prove to be quite limited.

As a comparison, my own brain-child, KeyGen2, builds on the fact that devices are shipped with a device certificate.
One may claim that KeyGen2 requires enhanced devices, and yes this is true!

The problem with not requiring enhanced devices is that "the tyranny of the least common denominator" will rule which is a stopgap to progress.  That is, the missing bootstrap may severely impede market acceptance.

 

Note: KeyGen2 does not compete with KMIP because KeyGen2 (deliberately) supports a very limited range of devices that are used by everybody (phones) but would be totally useless for storage.  I would if I were you consider "borrowing" the device certificate concept.

 

Properly implemented, all kinds of shared secrets and enrollment passwords are eliminated by device certificates.

If you are curious on how such a scheme could work you may take a peek in section "Dual-use Device IDs" in:

http://webpki.org/papers/keygen2/secure-key-store.pdf

 

thanks

Anders