[Anima] Re: title change for RFC8366bis / term 'imprinting'

Esko Dijk <esko.dijk@iotconsultancy.nl> Tue, 18 August 2026 09:11 UTC

Return-Path: <esko.dijk@iotconsultancy.nl>
X-Original-To: anima@mail2.ietf.org
Delivered-To: anima@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 1659C12B7FC75 for <anima@mail2.ietf.org>; Tue, 18 Aug 2026 02:11:27 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1787044287; bh=CWFtcLqR9uVKnvR0xjFWPEvJ/VNgZT0DI/rf3Ro2WPM=; h=Date:Subject:To:Cc:References:From:In-Reply-To; b=Q9f75fAvG1EERa3Szn3WCQxJEVOtmjEEd3Eyh4bcY75Sn5w4FZ8rr8DoKlyyqDnQ+ TIUXxmZCJGwS1FQGOC3v1EcB5UdvcQfOuPOcKg7BCTQc0mZHssscehGvbYewkX3U8a Hxtvb+IQYTCv9mWgL+tuVbFEr5yj4KpWV7TZrTB8=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.797
X-Spam-Level:
X-Spam-Status: No, score=-2.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=iotconsultancy.nl
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cVdjfsOPW14N for <anima@mail2.ietf.org>; Tue, 18 Aug 2026 02:11:26 -0700 (PDT)
Received: from dane.soverin.net (dane.soverin.net [185.233.34.150]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 3B59B12B7FC6E for <anima@ietf.org>; Tue, 18 Aug 2026 02:11:26 -0700 (PDT)
Received: from smtp.soverin.net (unknown [10.10.4.100]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by dane.soverin.net (Postfix) with ESMTPS id 4hPP870qg8z3v; Tue, 18 Aug 2026 09:11:19 +0000 (UTC)
Received: from smtp.soverin.net (smtp.soverin.net [10.10.4.100]) by soverin.net (Postfix) with ESMTPSA id 4hPP856pg9zF2; Tue, 18 Aug 2026 09:11:17 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iotconsultancy.nl; s=soverin1; t=1787044279; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=5NHQMsR1R6/Tes3u89ZeYCxLL7uFxIxtbPB9d1NwZ14=; b=RaT4HcdBHMbuKEgujEbowxRiz3b+TarOB7lFRRo3DyDj1Z6Va8rayfsMpi58xQrbFgeUOY 3CQGQxgOrVVEDRC41k6eoC1ikkInR27DvxQHy6QrppeLRhI8TiKHcKJGMAnBKTxwBWwkaS w7tY7R7xy9fOaNzT+3xzvb9HnMNdPHkt39l691HtMoibjJMBVJD5b/kB0MXqPvKjw5LYf8 KBfKiH2VmuLw4K4veeMrMG4+Wpp2ssfkdKqMqUuIhxQvpogaxUM8prr/qPtYh8+Rnsv5Lg ytVCkGNuEH7hbleEhQKhOzr5MRqTL7yoR8F9EPUgISMFT0skavWW86fA4kYvoQ==
X-CM-Envelope: MS4xfKJk1EUAwT8YeQ5T++HFtAMqJ/NlNg9xB5d34y24m9MV95Jqb+GsOv+SlgJCpA2RaJcpwhNVqmSyozTLj4zBoAELgCoFgVFUhfvzFJxh2CtBZiQKr2Ig e57ULF9ItrDvFtM1gfaVnaxDLK9QKGWX2RxiF6LIzQH3/hegXkhk1fnpdn6Nx2AeMaxkb5Ad1pOS/4xgGNhkwJrBA3q6OnZDL1O/7Bo1MIGDtNPKUvD5DoTP OkdufFoMm8Ns7xNNfqEl/Q==
X-Soverin-Id: 01a01423-b2d8-7885-8078-dd573524e1dd
Content-Type: multipart/alternative; boundary="------------c2dQTcenbK8uddwy7e8Ld0F0"
Message-ID: <d53706fe-9953-4c88-8f9a-0195eb4a48d1@iotconsultancy.nl>
Date: Tue, 18 Aug 2026 11:11:16 +0200
MIME-Version: 1.0
To: "Fries, Steffen" <steffen.fries@siemens.com>, Michael Richardson <mcr+ietf@sandelman.ca>
References: <9377.1786124631@obiwan.sandelman.ca> <9b86fd68-805f-489b-bee0-0afcd27ef044@iotconsultancy.nl> <706a2ed4-2fea-4718-8c09-4e40a354199c@gmail.com> <20480.1786306840@obiwan.sandelman.ca> <e1227cd1-0425-4057-8c61-3b9235b3a7e9@iotconsultancy.nl> <11508.1786318075@obiwan.sandelman.ca> <ef00cf40-df0d-4524-9093-3930760f1c5a@iotconsultancy.nl> <19961.1786914151@obiwan.sandelman.ca> <DU0PR10MB93262B3ADF246CF4BEF0F128F3A72@DU0PR10MB9326.EURPRD10.PROD.OUTLOOK.COM>
Content-Language: en-US
From: Esko Dijk <esko.dijk@iotconsultancy.nl>
Organization: IoTconsultancy.nl
In-Reply-To: <DU0PR10MB93262B3ADF246CF4BEF0F128F3A72@DU0PR10MB9326.EURPRD10.PROD.OUTLOOK.COM>
X-Spampanel-Class: ham
Message-ID-Hash: MTB7XSHD3LLBGJT4NXJTQD7CGS5IZH6D
X-Message-ID-Hash: MTB7XSHD3LLBGJT4NXJTQD7CGS5IZH6D
X-MailFrom: esko.dijk@iotconsultancy.nl
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-anima.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "anima@ietf.org" <anima@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Anima] Re: title change for RFC8366bis / term 'imprinting'
List-Id: Autonomic Networking Integrated Model and Approach <anima.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/anima/a-IRaKW4vOCXm8YA-RcVipIgQrk>
List-Archive: <https://mailarchive.ietf.org/arch/browse/anima>
List-Help: <mailto:anima-request@ietf.org?subject=help>
List-Owner: <mailto:anima-owner@ietf.org>
List-Post: <mailto:anima@ietf.org>
List-Subscribe: <mailto:anima-join@ietf.org>
List-Unsubscribe: <mailto:anima-leave@ietf.org>

We have used the term 'imprint' / imprinting for the equivalent of a 
birth certificate in ANIMA, but only since v11 of 8366bis.

See: 
https://author-tools.ietf.org/iddiff?url1=draft-ietf-anima-rfc8366bis-10&url2=draft-ietf-anima-rfc8366bis-11&difftype=--html

Before that, and in RFC 8366 also, it was used for the process of 
onboarding and in some way "imprinting" the trusted operational network 
(CA or Registrar or other) into the new device.

Also in the original paper of the resurrecting duckling, I believe, 
imprinting is related to trusting the new operational network at first 
sight, with 'resurrecting' implying that it could occur multiple times. 
E.g. after a hard-reset operation. So the imprinting could happen 
multiple times, while the birth certificate provisioning in the factory 
occurs only once.

So in this context, it's better we remove our re-defined term 
"imprinting" from the draft to avoid further confusion. (Which we now 
already did in -35)

Esko


On 8/17/26 09:30, Fries, Steffen wrote:
> Hi Michael, Esko
>
> Just a short observation regarding the definition of "imprint" in draft-irtf-t2trg-security-setup-iot-devices. From the discussion we had in ANIMA in the context of bootstrapping (BRSKI and variants) I understood the term always equivalent to a birth certificate. This typically happens during manufacturing by providing the IDevID. This typically happens just once, while bootstrapping to my understanding was always related to obtaining the security credentials from the target operational domain (trust handover and LDevID(s)).
> But we can sort that out later, once RFC8366bis is finished.
>
> Best regards
> Steffen
>
>
>> -----Original Message-----
>> From: Michael Richardson<mcr+ietf@sandelman.ca>
>> Sent: Sunday, August 16, 2026 11:03 PM
>> To: Esko Dijk<esko.dijk@iotconsultancy.nl>
>> Cc:anima@ietf.org
>> Subject: [Anima] Re: title change for RFC8366bis / term 'imprinting'
>>
>>
>> Esko Dijk<esko.dijk@iotconsultancy.nl> wrote:
>>      > For me ok to replace 'imprinting' with 'provisioning', but if we use the word
>>      > 'provisioning' in the Terminology section anywhere, it would be helpful to
>>      > still define 'provisioning' also there. That word is currently not used
>>      > anywhere in the latest text (Github main) as far as I can tell.
>>
>> It was a goal of Mohit's draft-irtf-t2trg-security-setup-iot-devices-07
>> to explain all these terms...
>>
>> We used the word "provisioned" once in section 8, as a verb, relating to SZTP, but
>> I think it went away already, and I was just now looking at the wrong branch on
>> laptop.
>>
>> One more use of "imprint" in ietf-voucher-request.yang, changed to onboarding.
>>
>> --
>> Michael Richardson<mcr+IETF@sandelman.ca>   . o O ( IPv6 IøT consulting )
>>             Sandelman Software Works Inc, Ottawa and Worldwide
>>
>> **       My working hours and your working hours may be different.         **
>> ** Please do not feel obligated to reply outside your normal working hours **
>>
>>
>>
-- 
*IoTconsultancy.nl* | Email/Teams: esko.dijk@iotconsultancy.nl | +31 6 
2385 8339