Just to provide a pointer to a way that another org decided to handle a similar problem (and I'm not suggesting this is the right approach -- I'm just trying to provide food for thought): http://upnp.org/specs/gw/deviceprotection1/
UPnP Device Protection uses X.509 certificates (which can be self-signed, and in order not to assume a WAN connection, really should be self-signed) and TLS. It describes a couple of ways that initial trust and role assignment (what they are authorized to do, once authenticated) can be accomplished. These absolutely need to involve the user. But they need to be as simple as possible. It also describes a mechanism where the list of trusted devices, their keys, and roles (authorizations) can be provided by one device to another. That allows the user to pair a new device with one other device in the network (don't care which), and then be provided the full list of all other such trusted devices, their keys, and roles. Barbara _______________________________________________ homenet mailing list homenet@ietf.org https://www.ietf.org/mailman/listinfo/homenet
