Re: [Anima-bootstrap] anima-bootstrap: Bootstrap proxy discovery options

["Toerless Eckert (eckert)" <[e-mail]>]

Michael:

Lets assume we replace EST bootstraap with "a guy with a USB stick feeding
manually domain certs to greenfield devices".

a) I agree that we would want to make sure our protocols are set up so that even such
   a device could perfectly bring up ACP afterwards and continue with the rest
   of autonomic functions (GRASP inside ACP, agents,...). 

b) I don't think we would want to call such a device "autonomic". It's partial
   autonomic at best. But yes, it may be perfectly valid and relevant to some
   industries.

If you agree, then the problem is IMHO primarily in the reference model calling
out that devices that for one reason or the other can not / want-not implement
the whole ANIMA suite can perfectly well implement just parts of it, because
ANIMA is defined such that the different building blocks are modular. Just that
such a device is only "partial-autonomic" (or  whatever you think is a good
naming to distinguish it from a truely autonomic device).

Btw: This also goes the other way, eg: it would IHO make sense that the bootstrap
spec can be deplpoyed on devices that do not want any further AN functions after
the certificates are enrolled. I think that option is also something we want to
explain in the bootstrap draft.

Cheers
    Toerless

On Wed, Dec 09, 2015 at 01:08:39PM +0000, Michael Behringer (mbehring) wrote:
> > The discovery alternatives cited by toerless impress me as a list of services of
> > which at least one must be present.
> > 
> > Therefore my consideration that for something as basic as Service discovery,
> > some industries may regret that they need for example mDNS next to their
> > favoured discovery service e.g. Resource Directory.
> > Faced with this choice they may decide that mDNS is not wanted but
> > replaced by RD; and the Anima code in their products is adapted for that
> > choice; while maintaining interoperability with ANIMA routers in all other
> > respects.
> 
> At the end of the day I personally don't care *how* a domain certificate gets onto a new device. 
> 
> Probably we should be more clear on this, draw a big line, and state that the domain enrolment process may be replaced by many other methods, and that's ok.
> 
> So for us here that means, AN must also work if the domain certificates are (for whatever reason) already on the devices. I.e., what happens later in the AN process must not depend on anything in the bootstrap process, except the PKI info. 
> 
> Michael
>  
> > Peter
> > 
> > _______________________________________________
> > Anima-bootstrap mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/anima-bootstrap