[Anima-bootstrap] ownership vouchers?

[Kent Watsen <[e-mail]>]

[Changing subject line]




On 4/18/16, 2:40 PM, "Michael Richardson" <[e-mail]> wrote:

>
>Kent Watsen <[e-mail]> wrote:
>    > Though I may not be a regular, I think that we could use a meeting or
>    > two to discuss how to modify the Ownership Voucher definition to suit
>    > ANIMA bootstrap.
>
>I agree that this is an important thing to do.
>Should we detail why this needs to be standardized?


I have one reason outside of ANIMA, which is to enable multi-vendor devices to pull signed data from DNS-SD.  Specifically, look at the very last paragraph in Section 4.2 of the zerotouch draft (https://tools.ietf.org/html/draft-ietf-netconf-zerotouch-08#section-4.2).

Let's says we have two devices, from two different vendors.  If they both do a DNS-SD lookup for say "_zerotouch._tcp.example.com", they'll both get the same signed data and, more to the point, the same ownership voucher.  While a single voucher can span many devices, unless standardized, it could never span more than one vendor.

That said, we may want to extend to concept of a "voucher" to a "bundle of vouchers" as, even with a single vendor case, the vouchers may by issued over time such that a single voucher doesn't span all the devices in a network.  If there were support for bundles, all the vouchers within the bundle would have to have a common format, or else be tagged as to which [vendor-specific] format they're in.  This might be a way to not have to standardize vouchers, but it seems easier to have a single format.

I don't know how realistic it is that a single voucher would span all the devices in a domain at a given time, or how likely it is that anyone would configure their DNS server to return signed data.  On that latter point, it certainly seems like a lot of effort given that the fallback position is to 1) return unsigned data, 2) let the device establish a provisional TLS connection to the bootstrap server, from which 3) it downloads signed data, potentially with a device-specific voucher.

Just thinking out loud here...

Kent