Re: [Anima-bootstrap] BRSKI State Machine

["Michael Behringer (mbehring)" <[e-mail]>]

> -----Original Message-----
> From: Brian E Carpenter [mailto:[e-mail]]
> Sent: 17 October 2016 21:41
> To: Michael Behringer (mbehring) <[e-mail]>; anima-
> [e-mail]
> Subject: Re: [Anima-bootstrap] BRSKI State Machine
> 
> Hi Michael,
> On 15/10/2016 03:42, Michael Behringer (mbehring) wrote:
> ...
> > * First of all, one thing isn't coming out clearly (it's there, but somehow not
> obvious at all): We have three "paths" through the algorithm, and it is the
> *pledge* that has "hard coded" which paths we're taking:
> >
> > 1) join any domain (first come first join)
> >    --> No MASA required
> > 2) require audit token
> >    --> MASA required, audit mode
> > 3) require authentication token
> >    --> MASA required, ownership tracking mode
> >
> > [I really hope we agree on that!!!]
> 
> What about the air gap case (no external interaction allowed, by site policy)?
> Would there be a simulated MASA in that case? In any case, that is not a
> choice that the pledge can make.

Well, if you can't have external communications, you have two options: 
1) case 1 above. Registrar and CA are local within the airgap zone, all works. With the security caveats that Max makes. 
2) case 3 where the MASA ownership vouchers are created up front, put on a CD ROM, and send into the airgap zone. 
 
Your point is probably: We should explain that. And, I think you're right! Sounds like uses cases of BRSKI. Maybe appendices? 

> ...
> > - we need to specify precisely the discovery method, with mDNS field
> names, and other details. In my head we're using mDNS here, and I *think*
> we agreed on that?
> 
> No, I think we agreed on supporting both mDNS or GRASP discovery; it is of
> course the latter hat I've modelled. We have no need of mDNS for GRASP-
> capable nodes, but we must support mDNS between the proxy and a non-
> GRASP-capable pledge. I've got no objection to also specifying mDNS
> between the proxy and the registrar, but I think it's redundant.

Sigh. I'm a bit lost on what we decided, to be honest... Is that written down somewhere? We need to nail down discovery in two places: 

BRSKI: Pledge needs to find proxy. 
3.1.1 is the place in the BRSKI doc where discovery is specified, and it clearly does NOT say what you said above :-) 
ACP: one ANIMA node needs to find other ANIMA nodes. 
5.2 specifies mDNS today. 

We really need to start nailing this down! 

Michael

> Indeed the details have to be specified; I haven't formally written them up
> for the GRASP methods but they are embedded in my Python code.
> (Again, https://www.cs.auckland.ac.nz/~brian/graspy/brski/)
> 
> Rgds
>     Brian