Re: [Anima-bootstrap] DRAFT minutes up to 2016-09-13

Michael Richardson <mcr+ietf@sandelman.ca> Fri, 16 September 2016 15:47 UTC

Return-Path: <mcr+ietf@sandelman.ca>
X-Original-To: anima-bootstrap@ietfa.amsl.com
Delivered-To: anima-bootstrap@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED44212B2A3 for <anima-bootstrap@ietfa.amsl.com>; Fri, 16 Sep 2016 08:47:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.409
X-Spam-Level:
X-Spam-Status: No, score=-3.409 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-1.508, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x3XFSx7xxA_7 for <anima-bootstrap@ietfa.amsl.com>; Fri, 16 Sep 2016 08:47:20 -0700 (PDT)
Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4916012B29D for <anima-bootstrap@ietf.org>; Fri, 16 Sep 2016 08:47:20 -0700 (PDT)
Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 74207203B0; Fri, 16 Sep 2016 12:00:05 -0400 (EDT)
Received: from obiwan.sandelman.ca (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id D145C6392C; Fri, 16 Sep 2016 11:47:18 -0400 (EDT)
From: Michael Richardson <mcr+ietf@sandelman.ca>
To: Brian E Carpenter <brian.e.carpenter@gmail.com>
In-Reply-To: <82575003-5339-c171-5cbb-1db8e4006f2f@gmail.com>
References: <10796.1473897911@obiwan.sandelman.ca> <1521461d-b050-8dcb-fd75-de846fa23a85@gmail.com> <28340.1473902714@obiwan.sandelman.ca> <05ae8cf7-3924-c5f0-e65b-fcf18a4e0b6d@gmail.com> <11222.1473943775@obiwan.sandelman.ca> <82575003-5339-c171-5cbb-1db8e4006f2f@gmail.com>
X-Mailer: MH-E 8.6; nmh 1.6+dev; GNU Emacs 24.5.1
X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m<nPbLgmtKK-5dC@#:k
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha1; protocol="application/pgp-signature"
Date: Fri, 16 Sep 2016 11:47:18 -0400
Message-ID: <31364.1474040838@obiwan.sandelman.ca>
Archived-At: <https://mailarchive.ietf.org/arch/msg/anima-bootstrap/eUN6CR-S6U72BQjVUziDlsO6KRY>
Cc: anima-bootstrap <anima-bootstrap@ietf.org>
Subject: Re: [Anima-bootstrap] DRAFT minutes up to 2016-09-13
X-BeenThere: anima-bootstrap@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Mailing list for the bootstrap design team of the ANIMA WG <anima-bootstrap.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/anima-bootstrap>, <mailto:anima-bootstrap-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/anima-bootstrap/>
List-Post: <mailto:anima-bootstrap@ietf.org>
List-Help: <mailto:anima-bootstrap-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/anima-bootstrap>, <mailto:anima-bootstrap-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 16 Sep 2016 15:47:22 -0000

Brian E Carpenter <brian.e.carpenter@gmail.com> wrote:
    >> Brian E Carpenter <brian.e.carpenter@gmail.com> wrote:
    >> >> Brian E Carpenter <brian.e.carpenter@gmail.com> wrote:
    >> >> >> I) The ANIMA cast list is as follows:
    >> >> >> i) pledge is TCP-initiator, TLS-client, HTTP/EST client.
    >> >> >> ii) registar is TCP-responder, TLS-server, EST server.
    >> >>
    >> >> > Where's the proxy in that? And didn't we say we'd also have a COAP option?
    >> >>
    >> >> The proxy is in between, but doesn't provide functions above layer-3ish.
    >> >> I ommited it for clarity :-)
    >>
    >> > OK. But layer 4 probably - it seems likely that we would terminate a TLS
    >> > session at the proxy and make another one between the proxy and the
    >> > registrar. (That's the bit I *didn't* model in my Python demos.)
    >>
    >> No, we don't want to do that for a number of reasons:

    > So, accepting those reasons, if (for example) we do the first
    > suggestion in draft-richardson-anima-state-for-joinrouter-01:

    > "3.1.  method 1: Circuit Proxy method

    > In response to discovery, the circuit proxy would return a link-local
    > address on the joining router.  The joining router would have a TCP
    > (or UDP/CoAP) port open on that interface.  It would accept
    > connections on that port, and would turn around and create a new TCP
    > connection to the registrar."

    > Can TLS just ride over such a relayed TCP connection?

Yes, the circuit proxy plugs two layer-4s together.
TLS is a "layer-5" here. It just goes through, unexamined, by the proxy.

    > And so on for the other models in anima-state-for-joinrouter. I do
    > think this needs to be resolved before we can say the model is complete.

    > Brian


--
Michael Richardson <mcr+IETF@sandelman.ca>ca>, Sandelman Software Works
 -= IPv6 IoT consulting =-