[Anima] last minute changes to BRSKI to do endpoint discovery

Michael Richardson <mcr+ietf@sandelman.ca> Tue, 21 July 2020 23:51 UTC

Return-Path: <mcr+ietf@sandelman.ca>
X-Original-To: anima@ietfa.amsl.com
Delivered-To: anima@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 677693A0843 for <anima@ietfa.amsl.com>; Tue, 21 Jul 2020 16:51:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vFnEpZATHWCU for <anima@ietfa.amsl.com>; Tue, 21 Jul 2020 16:51:23 -0700 (PDT)
Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 995A53A0840 for <anima@ietf.org>; Tue, 21 Jul 2020 16:51:23 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id D746F38A26; Tue, 21 Jul 2020 19:30:56 -0400 (EDT)
Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id ul8KyqCGH_55; Tue, 21 Jul 2020 19:30:56 -0400 (EDT)
Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 261F6389D0; Tue, 21 Jul 2020 19:30:56 -0400 (EDT)
Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id BA3E4A8; Tue, 21 Jul 2020 19:51:21 -0400 (EDT)
From: Michael Richardson <mcr+ietf@sandelman.ca>
To: anima@ietf.org
CC: "Fries\, Steffen" <steffen.fries@siemens.com>, "Brockhaus\, Hendrik" <hendrik.brockhaus@siemens.com>, max pritikin <pritikin@cisco.com>, Eliot Lear <lear@cisco.com>
In-Reply-To: <a26f70c7dc5145b581f71ece3106529b@siemens.com>
References: <4a3b24b3737f4dcbbf3154c89d9c8200@siemens.com> <17250.1594397451@localhost> <a26f70c7dc5145b581f71ece3106529b@siemens.com>
X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1
X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m<nPbLgmtKK-5dC@#:k
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature"
Date: Tue, 21 Jul 2020 19:51:21 -0400
Message-ID: <26733.1595375481@localhost>
Archived-At: <https://mailarchive.ietf.org/arch/msg/anima/1yZkQH8x1xsSsgF5Cfp3ZPjpgVg>
Subject: [Anima] last minute changes to BRSKI to do endpoint discovery
X-BeenThere: anima@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Autonomic Networking Integrated Model and Approach <anima.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/anima>, <mailto:anima-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/anima/>
List-Post: <mailto:anima@ietf.org>
List-Help: <mailto:anima-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/anima>, <mailto:anima-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 21 Jul 2020 23:51:25 -0000

The BRSKI-AE authors have suggested that in order to make BRSKI more
easily extendable that prior to using the /.well-known/est end points (both RFC7030
ones and bootstrapping-keyinfra ones), that the pledge should ask for
/.well-known/brski, to get back a list.

The thread ending at https://mailarchive.ietf.org/arch/msg/anima/MQkNXJJjMkP0nqKlNEaxDZ94RgI
alludes to this, but the current -03 document does not include this proposal,
because it would need to go into BRSKI itself.

   REQ: GET /.well-known/brski

   RES: Content-Type: application/link-format   {see RFC6690}
     </brski/voucherrequest>,ct=voucher-cms+json
     </brski/voucher_status>,ct=json
     </brski/requestauditlog>,ct=json
     </brski/enrollstatus>,ct=json

     </est/cacerts>;ct=pkcs7-mime
     </est/cacerts>;ct=pkcs7-mime
     </est/simpleenroll>;ct=pkcs7-mime
     </est/simplereenroll>;ct=pkcs7-mime
     </est/fullcmc>;ct=pkcs7-mime
     </est/serverkeygen>;ct= pkcs7-mime
     </est/csrattrs>;ct=pkcs7-mime

      </cmp/initialization>;ct=pkixcmp
     </cmp/certification>;ct=pkixcmp
     </cmp/keyupdate>;ct=pkixcmp
     </cmp/p10>;ct=pkixcmp
     </cmp/getCAcert>;ct=pkixcmp
     </cmp/getCSRparam>;ct=pkixcmp

This is already done in draft-ietf-ace-coap-est-18, BTW.
But, it asks /.well-known/core?rt=ace.est rather than /.well-known/brski.

At this point, we are waiting for ACP document to be approved by the IESG.
Assuming that our AD was amenable, I think that this could be snuck in before
ACP is approved.   This email does not include my opinion, as it has not yet
been formed.

--
Michael Richardson <mcr+IETF@sandelman.ca>ca>, Sandelman Software Works
 -= IPv6 IoT consulting =-