The existing high-friction device onboarding process hinders the promise and potentiality of Internet of Things (IoT). Even after several attempts by various device manufacturers and working groups, no widely adopted standard solution came to fruition. The latest attempt by Fast Identity Online (FIDO) Alliance promises a zero touch solution for mass market IoT customers, but the burden is transferred to the intermediary supply chain (i.e. they have to maintain infrastructure for managing keys and digital signatures called `Ownership Voucher' for all devices). The specification relies on a `Rendezvous Server' mimicking the notion of Domain Name System (DNS) server'. This essentially means resurrecting all existing possible attack scenarios associated with DNS, which include Denial of Service (DoS) attack, and Correlation attack. `Ownership Voucher' poses the risk that some intermediary supply chain agents may act maliciously and reject the transfer of ownership or sign with a wrong key. Furthermore, the deliberate use of the weak elliptic curve SECP256r1/SECP384r1 (also known as NIST P-256/384) in the specification raises questions. We introduce ASOP: a sovereign and secure device onboarding protocol for IoT devices without blindly trusting the device manufacturer, supply chain, and cloud service provider. The ASOP protocol allows onboarding an IoT device to a cloud server with the help of an authenticator owned by the user. This paper outlines the preliminary development of the protocol and its high-level description. Our `zero-trust' and `human-in-the-loop' approach guarantees that the device owner does not remain at the mercy of third-party infrastructures, and it utilises recently standardized post-quantum cryptographic suite (CRYSTALS) to secure connection and messages.

翻译：现有设备接入流程摩擦大，阻碍了物联网的潜力发挥。尽管各设备制造商和工作组多次尝试，但仍未形成广泛采纳的标准解决方案。FIDO联盟最新提出的零接触方案虽面向大众市场物联网客户，但将负担转嫁至中间供应链（即其需维护管理密钥和数字签名的基础设施，称为"所有权凭证"）。该规范依赖类似域名系统服务器概念的"会合服务器"，本质上是重演所有与DNS相关的攻击场景（包括拒绝服务攻击和关联攻击）。"所有权凭证"存在中间供应链环节恶意操作的风险，如拒绝转移所有权或使用错误密钥签名。此外，规范中刻意采用弱椭圆曲线SECP256r1/SECP384r1（即NIST P-256/384）的做法引发质疑。我们提出ASOP协议，该协议不盲目信任设备制造商、供应链和云服务提供商，为物联网设备提供自主安全的接入方案。ASOP协议允许用户通过其持有的验证器将物联网设备接入云服务器。本文概述了协议的初步开发进展及高层设计描述。我们的"零信任"+"人机交互"方法确保设备所有者免受第三方基础设施的制约，并采用近期标准化的后量子密码套件CRYSTALS保护连接和消息安全。