3 ms·
Nice. You inspired me to look up RFC8366. That's a remarkable document, apparently written in English, where at least the abstract and introduction look like
by amluto 7mo ago
Nice.
You inspired me to look up RFC8366. That's a remarkable document, apparently written in English, where at least the abstract and introduction look like they might be the result of a particularly nerdy game of Mad-Libs. :)
I, personally, have never observed a pledge doing anything other than being heard, although I observed Lemon Pledge smelling unpleasant. But, in RFC8366, pledges can join domains!
(I assume that a manufacturer makes a device and the device somehow contains a "pledge" from the manufacturer that the device is what it says it is...)
- selfmodruntime 7mo agoYou assume almost correct, the device is the pledge itself! RFC8366 is used (among others) in the BRSKI protocol family. For device attestation purposes in 802.1x Networks, a pledge comes with a manufacturer provided public key material, often a certificate but not always, that links it to the manufacturer via a publicly available trust root. In an exchange process, the customer - called the registrar in the specification documents - then asks for and verifies the pledge's key material before issuing their own domain certificates. It's in essence an automated zero-trust-ish protocol for network join purposes :)