[Anima-bootstrap] Does discovery include the domain?

"Michael Behringer (mbehring)" <mbehring@cisco.com> Tue, 08 November 2016 14:29 UTC

From: "Michael Behringer (mbehring)" <mbehring@cisco.com>
To: "Max Pritikin (pritikin)" <pritikin@cisco.com>
Thread-Topic: Does discovery include the domain?
Thread-Index: AdI5yypSlVd772bWQKC9kqDiW9cJXQ==
Date: Tue, 08 Nov 2016 14:29:41 +0000
Message-ID: <cbfb55b18160431ba8e5ebae35146c1c@XCH-RCD-006.cisco.com>
Accept-Language: en-GB, en-US
Content-Language: en-US
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/anima-bootstrap/Z_YeAiaGQ7YK9huU0D0Fjn2niYc>
Cc: Michael Richardson <mcr+ietf@sandelman.ca>, "anima-bootstrap@ietf.org" <anima-bootstrap@ietf.org>
Subject: [Anima-bootstrap] Does discovery include the domain?
Precedence: list

From "Re: [Anima-bootstrap] Detailed BRSKI review, part 1", Max' email from 20 Oct: 

> > In the reference model we state that if a pledge has been rejected by a
> domain, it should preferably use other domains that are seen. We may want
> to add something at the end of 3.1.1. This is also the reason why the pledge
> needs to know if the Registrar has rejected it based on MASA input.
> 
> CONCERN: Discovery doesn’t include a secure statement of the domain
> identity. So this behavior would imply something like “if the TLS
> authentication results in a domain that has explicitely rejected the Pledge
> previously then the attempt immediately fails and no request is initiated” in
> section 5?

Not straightforward. Up to now the pledge only knows it's rejected, not why. So this goes back to the discussion about a feedback to the pledge, which, as MichaelR pointed out, is not easy. But I think we need to be clear about it. 

We agree that "discovery doesn't include a *secure* statement of the domain". But I seem to recall that some folks were in favour of not including the domain info at all, for privacy / security reasons?  Or should we include the domain info in the discovery announcements of the proxy? Did we have a conclusion on that? 

Michael

[Anima-bootstrap] Does discovery include the doma… Michael Behringer (mbehring)