Steve, there maybe a fleeting opportunity with DOCSIS in the new spec
3.0 to right the wrong. The BPI (basic privacy) part of DOCSIS deals
with using the X.509 certs. BPI is being altered for 3.0, and there
most manufacturers haven't fully started making 3.0 compatible modems.
If you are interested, I can help facilitate a meeting with the Cable
Labs security folks who write these specs. Very soon all consumer
electronics products with a network connection will probably end up with
a certificate. I know that we are moving that direction now. I know
that Cable Labs isn't fully using the value of the current cert because
of various problems, but they plan on making better use in the near
future.
I do think though that PKIX should pull the profile out of CAPWAP, and
define a compatible profile. This way multiple rfcs can reference the
profile. This way DOCSIS, Cable Home, OpenCable, PacketCable, CAPWAP,
and others could all run from the same profile for device oriented
certificates.
Ron Ogle
Thomson Product Security