Re: [Anima-bootstrap] AN Group Key

Hi Max,

Thanks. I don't propose anything for now, but maybe this could be an idea for
future work. Since GRASP does rely on link-local multicast, it would be good
to have some idea of how to secure it (if the ACP doesn't take care of
it for us).

Regards
   Brian

On 25/10/2016 06:32, Max Pritikin (pritikin) wrote:
> BRSKI bootstraps a public key identity for the domain. It then rolls into a local certificate distribution but as currently noted in s5.7:
> 
>    The prior sections provide functionality for the New Entity to obtain
>    a trust anchor representative of the Domain.  The following section
>    describe using EST to obtain a locally issued PKI certificate.  The
>    New Entity MAY perform alternative enrollment methods or proceed to
>    use its IDevID credential indefinately, but those that leverage the
>    discovered Registrar to proceed with certificate enrollment MUST
>    implement the following EST choices.
> 
> The exact wording here could be adjusted. The point is that once the domain trust anchor is bootstrapped a mandatory to implement, or highly recommended interoperable approach, to identifying the device be implemented. 
> 
> One could branch off here into a group key method or could distribute the certs and use them to engage with a group key model. 
> 
> - max
> 
> 
>> On Oct 22, 2016, at 5:21 PM, Brian E Carpenter <brian.e.carpenter@gmail.com> wrote:
>>
>> This is perhaps a bit of a side track, but is there a way to leverage the
>> BRSKI registrar to securely distribute a Group Key? If every node in an AN
>> domain had the same Group Key, we could make GRASP multicast secure.
>>
>> (I never followed the MSEC work, but it looks mighty complex.)
>>
>> Regards
>>   Brian Carpenter
>>
>>
>> _______________________________________________
>> Anima-bootstrap mailing list
>> Anima-bootstrap@ietf.org
>> https://www.ietf.org/mailman/listinfo/anima-bootstrap
> 
> 