IETF Logo Mail Archive

Re: [Anima] last minute changes to BRSKI to do endpoint discovery

Brian E Carpenter <brian.e.carpenter@gmail.com> Wed, 22 July 2020 01:43 UTC

Return-Path: <brian.e.carpenter@gmail.com>
X-Original-To: anima@ietfa.amsl.com
Delivered-To: anima@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DE2003A0816 for <anima@ietfa.amsl.com>; Tue, 21 Jul 2020 18:43:05 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, NICE_REPLY_A=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q3g39ALUEq7v for <anima@ietfa.amsl.com>; Tue, 21 Jul 2020 18:43:04 -0700 (PDT)
Received: from mail-pj1-x102f.google.com (mail-pj1-x102f.google.com [IPv6:2607:f8b0:4864:20::102f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C90F3A0814 for <anima@ietf.org>; Tue, 21 Jul 2020 18:43:04 -0700 (PDT)
Received: by mail-pj1-x102f.google.com with SMTP id f16so340181pjt.0 for <anima@ietf.org>; Tue, 21 Jul 2020 18:43:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=cmPdqmc55Hyl7mUe2xuShSzKpsdHeT4AM8B9KUd21uc=; b=kMm/BGS1sH7yZ+SHyR8DHNBrr3I9lx4WfSQmwgvWJxgmMl8xBlH0+CrMIMruAsGY2E W+r1clddwOpKchvTZSq/9CCvOdMIdr89vLnVcu04I0JXUEP25bce8vt1Cayx+EGad+84 BBAwaKj8RdGgV0nx99zxumbZAYJcMGb+xAc/8wPc8xm87jxAOcllXsWTqqE3escCq6hP WXKpZJNwmDMJllb/qp9Mfsr/O8Ic2Em4VIip6Daa27sJJMdDKlt7mZpc355vDqUxUtem IZcV1r/6UWKfc/3LuKwKHcgTMWna28sTTn2OURk6Ge60dHBJwqVvwFYbOjcEeTxsyrJA +2Gw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=cmPdqmc55Hyl7mUe2xuShSzKpsdHeT4AM8B9KUd21uc=; b=n0RpPJs4upLBHzsW65lhyBgD/fRE90jpXt6qmFTibm5WxRM8wpZYU+kcA7ixYaZrGT fRBO0s4BGZPtKfKioWLHLXDuX/CKngEUeCUm+yFuYZ85xcM9gLkA0UBSbVSKR2dAVcRc /kPX6yZvC+ObP2xH1MJteGPUGrIL2ZThz/cNV/EKgz+FkVkpnVskapygco+UHQ8x7btC 4mXWpFvSroFNGO33rb76vdRJjgT/KNOEfQGJ7OcynmwX7jOY7/RuAC5Zu3VcbNMHIp25 7trN9V3v71FyTmc+nm+gxAtvSKYxkDjBjlI5H2VllL+vrQMcWbdGcMvDTifz+frw4Or3 2o1g==
X-Gm-Message-State: AOAM533y8exMQDP+1p9em9iTIOVwhN18HzxvuBJLAh6PYHmcbsJkIGIQ 6Wrx9dWmBJEoK4bBQ0kcmZ/Tj6mV
X-Google-Smtp-Source: ABdhPJwz3EwwTnwhGWcNNTwDQX93en4qRTPWz0Fpdioqbpe+UtMoEyKOwzRdy5U8JSaRNMOlkkpjQw==
X-Received: by 2002:a17:90a:de8d:: with SMTP id n13mr7233996pjv.95.1595382183378; Tue, 21 Jul 2020 18:43:03 -0700 (PDT)
Received: from [192.168.178.20] ([151.210.139.192]) by smtp.gmail.com with ESMTPSA id e6sm21801157pfh.176.2020.07.21.18.43.01 for <anima@ietf.org> (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 21 Jul 2020 18:43:02 -0700 (PDT)
To: anima@ietf.org
References: <4a3b24b3737f4dcbbf3154c89d9c8200@siemens.com> <17250.1594397451@localhost> <a26f70c7dc5145b581f71ece3106529b@siemens.com> <26733.1595375481@localhost>
From: Brian E Carpenter <brian.e.carpenter@gmail.com>
Message-ID: <41316bee-c858-27ab-30d7-4c6b1d6bdc0c@gmail.com>
Date: Wed, 22 Jul 2020 13:43:00 +1200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.9.1
MIME-Version: 1.0
In-Reply-To: <26733.1595375481@localhost>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/anima/4WZGMfCL0z1tld0KjXxoCRkUplk>
Subject: Re: [Anima] last minute changes to BRSKI to do endpoint discovery
X-BeenThere: anima@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Autonomic Networking Integrated Model and Approach <anima.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/anima>, <mailto:anima-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/anima/>
List-Post: <mailto:anima@ietf.org>
List-Help: <mailto:anima-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/anima>, <mailto:anima-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 22 Jul 2020 01:43:06 -0000

No technical objection from me.

It isn't just the AD who decides though, is it? It's a substantive change.
That means, according to my Policy Wonk's Handbook, a brief WGLC, a brief
IETF LC, and another run at the IESG agenda.

If that's the case, I'd suggest another approach (either a future short RFC
that updates the BRSKI RFC, or make BRSKI-AE formally update the BRSKI RFC).

Regards
   Brian

On 22-Jul-20 11:51, Michael Richardson wrote:
> 
> The BRSKI-AE authors have suggested that in order to make BRSKI more
> easily extendable that prior to using the /.well-known/est end points (both RFC7030
> ones and bootstrapping-keyinfra ones), that the pledge should ask for
> /.well-known/brski, to get back a list.
> 
> The thread ending at https://mailarchive.ietf.org/arch/msg/anima/MQkNXJJjMkP0nqKlNEaxDZ94RgI
> alludes to this, but the current -03 document does not include this proposal,
> because it would need to go into BRSKI itself.
> 
>    REQ: GET /.well-known/brski
> 
>    RES: Content-Type: application/link-format   {see RFC6690}
>      </brski/voucherrequest>,ct=voucher-cms+json
>      </brski/voucher_status>,ct=json
>      </brski/requestauditlog>,ct=json
>      </brski/enrollstatus>,ct=json
> 
>      </est/cacerts>;ct=pkcs7-mime
>      </est/cacerts>;ct=pkcs7-mime
>      </est/simpleenroll>;ct=pkcs7-mime
>      </est/simplereenroll>;ct=pkcs7-mime
>      </est/fullcmc>;ct=pkcs7-mime
>      </est/serverkeygen>;ct= pkcs7-mime
>      </est/csrattrs>;ct=pkcs7-mime
> 
>       </cmp/initialization>;ct=pkixcmp
>      </cmp/certification>;ct=pkixcmp
>      </cmp/keyupdate>;ct=pkixcmp
>      </cmp/p10>;ct=pkixcmp
>      </cmp/getCAcert>;ct=pkixcmp
>      </cmp/getCSRparam>;ct=pkixcmp
> 
> This is already done in draft-ietf-ace-coap-est-18, BTW.
> But, it asks /.well-known/core?rt=ace.est rather than /.well-known/brski.
> 
> At this point, we are waiting for ACP document to be approved by the IESG.
> Assuming that our AD was amenable, I think that this could be snuck in before
> ACP is approved.   This email does not include my opinion, as it has not yet
> been formed.
> 
> --
> Michael Richardson <mcr+IETF@sandelman.ca>ca>, Sandelman Software Works
>  -= IPv6 IoT consulting =-
> 
> 
> _______________________________________________
> Anima mailing list
> Anima@ietf.org
> https://www.ietf.org/mailman/listinfo/anima
>

v2.8.10 | Report a Bug | By Email