Re: [Anima-bootstrap] ACE and scope of bootstrap

> On Nov 25, 2015, at 8:14 AM, Michael Richardson <mcr+ietf@sandelman.ca> wrote:
> 
> 
> I wrote this to deal with any overlap with ACE.
> ACE's charter specifically has the bootstrap between constrained node and
> non-constrained helper (whether client or authorization server) out of scope.
> 
> +      <section title="Trust bootstrap">
> +        <t>
> +          The imprint protocol results in a secure relationship between the
> +          domain registrar and the new device.  If the new device is
> +          sufficiently constrained that the ACE protocol should be leveraged
> +          for operation, (see <xref target="I-D.ietf-ace-actors" />), and
> the
> +          domain registrar is also the Client Authorization Server or the
> +          Authorization Server, then it may be appropriate to use

“to use ACE specified mechanisms”? 

This avoids trying to hint at what the mechanism might be. 

- max

> this
> secure
> +          channel to exchange ACE tokens.
> +        </t>
> +      </section>
>     </section>
> 
> I am uncomfortable with the words "ACE tokens", but I don't know what else to
> write.  I mean the thing that would represent the trust between Client <-> CAS.
> I think that this may also be out-of-scope.  I don't propose to make it
> in-scope for ANIMA, but to make it clear that ANIMA bootstrap will have
> created a (D)TLS connection which could be reused for something else.
> Or a stateless TLS session-resumption token could be exchanged for later use
> by ACE.
> 
> --
> Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
> -= IPv6 IoT consulting =-
> 
> 
> 
> _______________________________________________
> Anima-bootstrap mailing list
> Anima-bootstrap@ietf.org
> https://www.ietf.org/mailman/listinfo/anima-bootstrap