Re: [Anima-bootstrap] BRSKI State Machine

["Michael Behringer (mbehring)" <[e-mail]>]

>     MB> But, we'll need the same method also for the ACP draft: When both
>     MB> nodes have a certificate, they need to discover each other as well.
>     MB> I've been haggling with Toerless about this :-)   I think we should
>     MB> take the mDNS insecure discovery into a separate, new draft.
> 
>     > I don’t follow. mDNS simply *is* insecure. This is important since we
>     > can’t establish a secure discovery yet.

MichaelR, I don't understand your logic below. 
 
> mDNS is just fine to find *a* proxy for a pledge that doesn't know anything
> else.
> (And couldn't verify the proxy anyway).
> 
> I'm still unclear how the GRASP multicast discovery process is going to work
> (the details) such that it leads to an IKEv2 connection.  *All* we need to form
> the ACP links is a multicast that says, "I speak ACP"

Exactly. I think mDNS *could* be used to give exactly that information. 

> , and as I suggested
> before, this could be an multicast IKEv2 PARENT_I1 as much as
> anything else.   Or we use the GRASP discovery multicast port, and the
> response is not a TCP connection that says, "I'm here", as much as just an
> IKEv2 packet instead.

That is an alternative, valid method. But I don't see why you couldn't use mDNS to find all ACP capable nodes? 

To me it still seems most logical to have a standalone method to do ANIMA discovery, and use the result of the discovery in various ways. Today: 
- message "I'm a proxy" --> launch bootstap as a pledge (If local node not in a domain)
- message "I'm an ACP capable device" --> establish the ACP (authenticating that device, of course)

And in the future, we may well have other things to discover: 
- message "I'm a device from domain X" --> start a security association and negotiate cross domain 
   features, such as BGP parameters. 
- message "I'm a constrained device - use method x to talk to me". 

We could do different methods for all of those; I still think it would be nice to have a simple, universal way to discover adjacent nodes in the ANIMA context. Where am I going wrong? 

MichaelB