[leshan-dev] LwM2M bootstrapping purpose

[Kiran Pradeep <kiran.happy@xxxxxxxxx>]

I tried reading post(in medium) by Julien Vermillard on bootstrapping.
But I couldn't understand the exact problem it was trying to solve.
Julien in comments mentioned about rotating keys which I couldn't
understand and so posting here. Kindly guide to appropriate forum in
case this list, takes only development related queries only.

I understood the point of invalidating LwM2M server credentials so
that new keys could be issued if LwM2M server keys are stolen. But
what if bootstrap credentials itself are stolen ? Then the rogue
entity, could easily ask the bootstrap server for LwM2M credentials
and do what ever it feels like. The bootstrap keys is going to have to
be fixed for the device lifetime, since they are written in factory
itself. What is the point I am missing ?

Thanks,
Kiran.