Re: [Anima] Last Call: <draft-ietf-anima-bootstrapping-keyinfra-20.txt> (Bootstrapping Remote Secure Key Infrastructures (BRSKI)) to Proposed Standard
Eliot Lear <lear@cisco.com> Tue, 04 June 2019 16:33 UTC
Return-Path: <lear@cisco.com>
X-Original-To: anima@ietfa.amsl.com
Delivered-To: anima@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9314D120077; Tue, 4 Jun 2019 09:33:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.51
X-Spam-Level:
X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ULHfc--_giub; Tue, 4 Jun 2019 09:33:05 -0700 (PDT)
Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA27D12004A; Tue, 4 Jun 2019 09:33:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=12092; q=dns/txt; s=iport; t=1559665985; x=1560875585; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=3YgtNhDW49qbfttOiDtBrtv/E40dH8yDtzHb5kVDtjs=; b=NJyb4ba9YJpDsCrvsLKTggVa8CQxjKr6JwOaFioVaBGB9JTHn6u0q6jS B3XFG2+IPeqRKSpzCnGoA39TWEuJ+4wdUU9YVi0aCNZ7ZknPPA4QQNyRW aiNBddYL8oFUax1QXpg8V6Is536MluUvnPtY6VR+2Pu+4Nmb6PzUFP9cL E=;
X-Files: signature.asc : 195
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0DqAAB/nPZc/xbLJq1dCRsBAQEBAwEBAQcDAQEBgWWBD1OBGVIgEiiEFIh7jBqSXYd7AgcBAQEJAwEBGAEMCgEBhEACgnU4EwEDAQEEAQECAQRtHAyFSgEBAQECAQEBIUsLBQsLGCMHAgInHxEGE4MiAYF7Dw+nNIExhDIBE0FAhF0QgTSBUIohgX+BEScfgkw+gmEBAQMBgTMDgzEygiYEi2eHPFSVDgmCEIIZgQaDIox1G4IjaIYNg1uKBJQYjBCDBgIEBgUCFYFmIYFYMxoIGxU7KgGCDQEzCTWCCIM5hRSFQT0DMI8AAiQHgiUBAQ
X-IronPort-AV: E=Sophos;i="5.60,550,1549929600"; d="asc'?scan'208,217";a="12733105"
Received: from aer-iport-nat.cisco.com (HELO aer-core-3.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 04 Jun 2019 16:33:02 +0000
Received: from [10.61.227.242] ([10.61.227.242]) by aer-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id x54GX1ft015713 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 4 Jun 2019 16:33:02 GMT
From: Eliot Lear <lear@cisco.com>
Message-Id: <02DFBB01-F7BA-4BCA-B8C5-CF14E8B7A6F4@cisco.com>
Content-Type: multipart/signed; boundary="Apple-Mail=_D5690984-1C98-477D-B494-B3CE0ABC264A"; protocol="application/pgp-signature"; micalg="pgp-sha1"
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Date: Tue, 04 Jun 2019 18:33:00 +0200
In-Reply-To: <155847367546.2608.5031283783681425886.idtracker@ietfa.amsl.com>
Cc: ibagdona@gmail.com, draft-ietf-anima-bootstrapping-keyinfra@ietf.org, anima@ietf.org, anima-chairs@ietf.org, tte+ietf@cs.fau.de
To: IETF discussion list <ietf@ietf.org>
References: <155847367546.2608.5031283783681425886.idtracker@ietfa.amsl.com>
X-Mailer: Apple Mail (2.3445.104.11)
X-Outbound-SMTP-Client: 10.61.227.242, [10.61.227.242]
X-Outbound-Node: aer-core-3.cisco.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/anima/CPDL-mRfP-div-kklK2n_D22z6A>
Subject: Re: [Anima] Last Call: <draft-ietf-anima-bootstrapping-keyinfra-20.txt> (Bootstrapping Remote Secure Key Infrastructures (BRSKI)) to Proposed Standard
X-BeenThere: anima@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Autonomic Networking Integrated Model and Approach <anima.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/anima>, <mailto:anima-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/anima/>
List-Post: <mailto:anima@ietf.org>
List-Help: <mailto:anima-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/anima>, <mailto:anima-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 04 Jun 2019 16:33:08 -0000
Just on this text: In Section 10.3 the following text exists: o A Trust-On-First-Use (TOFU) mechanism. A human would be queried upon seeing a manufacturer's trust anchor for the first time, and then the trust anchor would be installed to the trusted store. There are risks with this; even if the key to name is validated using something like the WebPKI, there remains the possibility that the name is a look alike: e.g, c1sco.com, .. First, this isn’t REALLY Trust-On-First-Use, and I would prefer that the term be replaced with something like "out-of-band approval". This would also be a good area for certification services to step in to indicate the trustworthiness of a manufacturer. Eliot > On 21 May 2019, at 23:21, The IESG <iesg-secretary@ietf.org> wrote: > > > The IESG has received a request from the Autonomic Networking Integrated > Model and Approach WG (anima) to consider the following document: - > 'Bootstrapping Remote Secure Key Infrastructures (BRSKI)' > <draft-ietf-anima-bootstrapping-keyinfra-20.txt> as Proposed Standard > > This is a second Last Call. IoT Directorate review was done after the ANIMA > WG Last Call and consensus to request the publication, and that review resulted > in substantial changes to the document. > > The IESG plans to make a decision in the next few weeks, and solicits final > comments on this action. Please send substantive comments to the > ietf@ietf.org mailing lists by 2019-06-04. Exceptionally, comments may be > sent to iesg@ietf.org instead. In either case, please retain the beginning of > the Subject line to allow automated sorting. > > Abstract > > > This document specifies automated bootstrapping of an Autonomic > Control Plane. To do this a remote secure key infrastructure (BRSKI) > is created using manufacturer installed X.509 certificate, in > combination with a manufacturer's authorizing service, both online > and offline. Bootstrapping a new device can occur using a routable > address and a cloud service, or using only link-local connectivity, > or on limited/disconnected networks. Support for lower security > models, including devices with minimal identity, is described for > legacy reasons but not encouraged. Bootstrapping is complete when > the cryptographic identity of the new key infrastructure is > successfully deployed to the device but the established secure > connection can be used to deploy a locally issued certificate to the > device as well. > > > > > The file can be obtained via > https://datatracker.ietf.org/doc/draft-ietf-anima-bootstrapping-keyinfra/ > > IESG discussion can be tracked via > https://datatracker.ietf.org/doc/draft-ietf-anima-bootstrapping-keyinfra/ballot/ > > The following IPR Declarations may be related to this I-D: > > https://datatracker.ietf.org/ipr/2816/ > https://datatracker.ietf.org/ipr/3233/ > https://datatracker.ietf.org/ipr/2463/ > > > > The document contains these normative downward references. > See RFC 3967 for additional information: > rfc8368: Using an Autonomic Control Plane for Stable Connectivity of Network Operations, Administration, and Maintenance (OAM) (Informational - IETF stream) > > > > _______________________________________________ > Anima mailing list > Anima@ietf.org > https://www.ietf.org/mailman/listinfo/anima
- [Anima] Last Call: <draft-ietf-anima-bootstrappin… The IESG
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Fries, Steffen
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Michael Richardson
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Fries, Steffen
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Michael Richardson
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Fries, Steffen
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Eliot Lear
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Toerless Eckert
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Eliot Lear
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Toerless Eckert
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Eliot Lear
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Brian E Carpenter
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Eric Rescorla
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Michael Richardson
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Eric Rescorla
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Brian E Carpenter
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Eric Rescorla
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Michael Richardson
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Michael Richardson
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Brian E Carpenter
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Michael Richardson
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Eliot Lear
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Eric Rescorla
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Eliot Lear
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Owen Friel (ofriel)
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Michael Richardson
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… tom petch
- Re: [Anima] Last Call: <draft-ietf-anima-bootstra… Michael Richardson