USB 3.1 Certificate Authentication with EJBCA

A USB standard for authentication of devices has been released a little while ago [1] as part of USB 3.1.

In short, the standard specifies the use of:

• X509v3, DER encoding certificates 
• ECDSA using the NIST P256 (a.k.a. secp256r1) curve, uncompressed point format 
• SHA256 

SubjectDN fields should be:

• CN: USB:<vendor ID>:<product ID>
• O: organization name attribute shall contain the human-readable name of the organization that owns the private key 
• DN Serial Number: lowercase hex-encoded value of the binary data (e.g. wafer number, lot number, production lot, etc.) necessary for uniqueness. 

In addition, there is one new certificate extension:

Custom certificate extension USB-IF ACD (OID 2.23.145.1.2): Seems to contain static data in an OCTET STRING, which can be added via EJBCA Admin GUI.

Conclusion: EJBCA should be able to issue such certificates.

[1] "USB Authentication Specification Rev. 1.0, March 25, 2016" http://www.usb.org/developers/docs/