an initial attempt on security provisioning section

[ereshetova]

Do not merge: just a mere start for the section

---

Preview | Diff

[mmccool]

Some thoughts:

• Need to specify goals before detailed processes
• Need to establish (mutual?) trust, need to provision secrets, need to configure authorizations
• Setup/onboarding/provisioning may involve more than the device itself, it may also involve other system components: other devices to which the new device is granted access, network configuration (eg MUD configuration), registration with databases/directories, etc.

Apparently the last point is also being discussed in architecture.

Also (from Oliver Pfaff): is trust symmetric or asymmetric? Probably depends on use cases. It may be that some use cases require mutual trust and some don't, and different use cases may require different levels of trust. Kaz: let's look at Verifiable Claims.