IoT: Taking PKI Where No PKI Has Gone Before
Talkat AppSec California 2015 · on Wednesday, 2015-01-28· at 14:00· Annenberg Community Beach House: Track 2, 415 Pacific Coast Hwy·
summary
Claim: PKI crypto alone does not produce trust; policies, liability and operational processes must accompany keys. Demonstrations: web PKI mechanics, grid deployment that pairs long‑lived x509 identity certs with short‑lived delegated attribute certificates (RFC 3820) plus SAML assertions for local authorization, showing global federation at scale. Alternatives tested: local databases, attribute certs, and SAML; grid model works for cross‑domain access. Practical notes: manage root stores, audit CAs, prefer short‑lived delegation for shifting device roles, and weigh ECC versus shared keys on constrained BLE sensors.
AI-written summary · about
chapters (9)
- 0:00Start
- 9:04Implementation of Pki
- 9:37General Process
- 11:47The Responsibilities on the Certification Authority
- 14:52Domain Validation
- 25:42Generalizing Pki
- 27:16Certificate Chains
- 29:27The Challenges
- 48:03What Is the Risk to the Business
related talks
24mFrom Trust Assumptions To Trust Evidence: Why PKI and Confidential Computing
28mKeys to the IoT Security Castle
40mDigital Identities - 21 PKI Pitfalls and How Best to Avoid Them
38mPKI deployments are as unique as any snowflake; how to build equally flexible PQ migration strategie
14mAutomated (PKI) Infrastructure: The AI You Should Be Thinking About
36mYou Like It Or Not; You Need It! - PKI And Certificate Management
27mAddressing the growing threat of non-human identities with PKI
16mPKI problem: who we actually trust