IETF Logo Mail Archive

Re: [Ace] WGLC comments draft-ietf-ace-coap-est-07

Michael Richardson <mcr+ietf@sandelman.ca> Tue, 15 January 2019 20:25 UTC

Return-Path: <mcr+ietf@sandelman.ca>
X-Original-To: ace@ietfa.amsl.com
Delivered-To: ace@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D01C1295D8; Tue, 15 Jan 2019 12:25:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.201
X-Spam-Level:
X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4AXSmirRqeH5; Tue, 15 Jan 2019 12:25:43 -0800 (PST)
Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 440DF1294D0; Tue, 15 Jan 2019 12:25:43 -0800 (PST)
Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 5D1643808A; Tue, 15 Jan 2019 15:25:04 -0500 (EST)
Received: by sandelman.ca (Postfix, from userid 179) id 98BEB12E3; Tue, 15 Jan 2019 15:25:39 -0500 (EST)
Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 9730212DE; Tue, 15 Jan 2019 15:25:39 -0500 (EST)
From: Michael Richardson <mcr+ietf@sandelman.ca>
To: Jim Schaad <ietf@augustcellars.com>
cc: draft-ietf-ace-coap-est@ietf.org, ace@ietf.org
In-Reply-To: <026e01d4acfd$a0becff0$e23c6fd0$@augustcellars.com>
References: <003b01d4abcd$1e2b0c10$5a812430$@augustcellars.com> <620.1547565175@localhost> <026e01d4acfd$a0becff0$e23c6fd0$@augustcellars.com>
X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1
X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m<nPbLgmtKK-5dC@#:k
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha256"; protocol="application/pgp-signature"
Date: Tue, 15 Jan 2019 15:25:39 -0500
Message-ID: <5692.1547583939@localhost>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ace/QmiWWdPSmEVGePHD2i_mi56e6HQ>
Subject: Re: [Ace] WGLC comments draft-ietf-ace-coap-est-07
X-BeenThere: ace@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" <ace.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ace>, <mailto:ace-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ace/>
List-Post: <mailto:ace@ietf.org>
List-Help: <mailto:ace-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ace>, <mailto:ace-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Jan 2019 20:25:47 -0000

Jim Schaad <ietf@augustcellars.com> wrote:
    > The question I was asking was more about the original enrollment rather
    > than renewal although it could come into question there as well.

    > - I have the implicit trust anchors and get a EST server URL.
    > - Call /cacerts
    > - I now have the explicit trust anchors but potentially have the same EST
    > server URL.
    > - Given that I have a NEW trust anchor, what do I do with the current DTLS
    > session?
    > - I now do an enrollment with the EST server to get a certificate.

    > One can say it is fine to use the implicit TA for that enrollment, but one
    > could also say that as the certificate chain is now different then the
    > DTLS session should be released and a new one established.

I think that the purpose of calling /cacerts is to get context for living
within the network.  I think that one continues with enrollment with the
same connection.  Restarting it might not actually work.

The resulting certificate should validate with the set of trust anchors
provided, and the anchors should let the client validate other clients.

--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
 -= IPv6 IoT consulting =-

v2.23.0 | Report a Bug | By Email