IETF Logo Mail Archive

Re: [Anima] last minute changes to BRSKI to do endpoint discovery

"Brockhaus, Hendrik" <hendrik.brockhaus@siemens.com> Wed, 22 July 2020 07:59 UTC

Return-Path: <hendrik.brockhaus@siemens.com>
X-Original-To: anima@ietfa.amsl.com
Delivered-To: anima@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DEEB3A0F7A for <anima@ietfa.amsl.com>; Wed, 22 Jul 2020 00:59:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=siemens.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tHOkf3-FZPkj for <anima@ietfa.amsl.com>; Wed, 22 Jul 2020 00:59:26 -0700 (PDT)
Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40041.outbound.protection.outlook.com [40.107.4.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AEE943A0F79 for <anima@ietf.org>; Wed, 22 Jul 2020 00:59:25 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=OSeZeawXg9c6txhbMrhQbZD/Kjh6JvI2UJmjWhvdv99mwmjMNPkmuGdSbLkbVO5xGswGSxwWlENhOU11Br+IsiNS72YRmPS71BQNbPHTzSPkpsFNNbknvpQbxdLxDhbFcOIKkcRoIeo3gp1thMhYjnBO7PohHFJptzUGb5fEteDVkA8MSBYuxsk3ZoorQajWIuNG92rgbga6VKHD5BJxME5/6xQY4oPiLgeF4YTpBQ5kakig6gFquN/mxEaOUsmgswyjZqIo5UM2t/x88eCeok89q65x8RPwVCyQ6MWJoxFvazcRQVXoPpGX8qqlTt+MGFdhbKdkiaofkHs3mcyeng==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=IVa/NHennqdxaJjZ92yAFohQpqn1cQbEtflmJauhOyU=; b=SfJv03X0Zlvqn6xRWjuWg/Zeu1VpQxy2FWE0G9QSeTnEB/5OM0eT+w7yOsPLHPM3f76DcmHwFk4KLQc8DEP5yDWmAJU1GY8wwjSkBt+KNGh5AvPRSVZfuRG0/Mj71uf29NGqFg+Vt/MCw4oY6Z2o4BsoNchOdzMAbuNjKQdYgDnTjLYIE88uLrRuRm88beaA6dPAv/kh822yVgKHK3jD1Zxat2kqaOe0Qnhs2gUIuUw/noko5erpaPJxDN7nFTNrkTG7XzY51efqCtvdTbU+vHZ5t1IenqKtiC/XX5Hyy8f3GKPtnAFFXu8DDz8WUTX3BTxo/bKzFJug5UdN4H7sQA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=siemens.onmicrosoft.com; s=selector1-siemens-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=IVa/NHennqdxaJjZ92yAFohQpqn1cQbEtflmJauhOyU=; b=J2vbyKjkq+vG9dZsj7aDtpMchJzpTklV+pq3SH7a8ciu3PIBZJQ8DSMKUspodHWdjspMpvbl17kV05MKAsJeG5efrtPGZrl6KneCrjD8ok/gub/EOGy/ig8B0KDCbQRrYHBwqrC4EC487wT1wtUlI+gJyP94+Wufy1wBJU6DaYw=
Received: from AM0PR10MB3153.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:184::10) by AM0PR10MB3457.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:154::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.22; Wed, 22 Jul 2020 07:59:23 +0000
Received: from AM0PR10MB3153.EURPRD10.PROD.OUTLOOK.COM ([fe80::288b:3b52:cf90:8fc0]) by AM0PR10MB3153.EURPRD10.PROD.OUTLOOK.COM ([fe80::288b:3b52:cf90:8fc0%9]) with mapi id 15.20.3195.028; Wed, 22 Jul 2020 07:59:23 +0000
From: "Brockhaus, Hendrik" <hendrik.brockhaus@siemens.com>
To: Michael Richardson <mcr+ietf@sandelman.ca>, "anima@ietf.org" <anima@ietf.org>
CC: "steffen.fries@siemens.com" <steffen.fries@siemens.com>, max pritikin <pritikin@cisco.com>, Eliot Lear <lear@cisco.com>
Thread-Topic: last minute changes to BRSKI to do endpoint discovery
Thread-Index: AQHWX7nZh6IHFyMmykeXnoOiF6WViqkTOqpA
Date: Wed, 22 Jul 2020 07:59:22 +0000
Message-ID: <AM0PR10MB3153F5AA4119DBDDB97F6D06FE790@AM0PR10MB3153.EURPRD10.PROD.OUTLOOK.COM>
References: <4a3b24b3737f4dcbbf3154c89d9c8200@siemens.com> <17250.1594397451@localhost> <a26f70c7dc5145b581f71ece3106529b@siemens.com> <26733.1595375481@localhost>
In-Reply-To: <26733.1595375481@localhost>
Accept-Language: de-DE, en-US
Content-Language: de-DE
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels: MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_ActionId=4a95e6e6-4b56-475b-8ec2-00001ca802c2; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_ContentBits=0; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Enabled=true; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Method=Standard; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Name=restricted-default; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_SetDate=2020-07-22T07:52:34Z; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_SiteId=38ae3bcd-9579-4fd4-adda-b42e1495d55a;
x-document-confidentiality: NotClassified
authentication-results: sandelman.ca; dkim=none (message not signed) header.d=none;sandelman.ca; dmarc=none action=none header.from=siemens.com;
x-originating-ip: [165.225.200.158]
x-ms-publictraffictype: Email
x-ms-office365-filtering-ht: Tenant
x-ms-office365-filtering-correlation-id: d64d7c74-eb38-480f-1f34-08d82e15257a
x-ms-traffictypediagnostic: AM0PR10MB3457:
x-ld-processed: 38ae3bcd-9579-4fd4-adda-b42e1495d55a,ExtAddr
x-ms-exchange-transport-forked: True
x-microsoft-antispam-prvs: <AM0PR10MB34573DD350D381F45CC6F5D4FE790@AM0PR10MB3457.EURPRD10.PROD.OUTLOOK.COM>
x-ms-oob-tlc-oobclassifiers: OLM:9508;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: VH7DjA670hDvoeD/c/NL54Lr8HKwltVHGM0mnJdtZy9i0jTCHUAlq8qhRWXAFoxCJw7f47467ns9lRwCvNF1M2+b8MeD21xx1dwYgJDwQiseegl1277HiwsM+R772ZwGtD8cYxseWysyiGE/9CJGIf2uQuumOECKgyh/LQPwvW4sxFXkMCjAm7s3AniZI2zvkPwkKsUtzTPYbwtkv91cAWlBwuhs8liWQfryZ4WS8hP/a80vOEDCBEsRTRj0AqnruKJ3tKm4eTTQtfyVw8dSZvP5ZKOmHPX6ltaqBdoiEwxP4KPqUAtEVTvxBTD5RrpB6To4Ra5m7UPwGsHZcIghgUBAkDHFFQtzn5amhLYaHyZkcC3Sv3++7H6zYbUBgMziDtRWL+9GsOu1Geoeh6EyTg==
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR10MB3153.EURPRD10.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(136003)(366004)(376002)(396003)(39860400002)(52536014)(8676002)(186003)(83380400001)(6506007)(316002)(71200400001)(2906002)(26005)(5660300002)(478600001)(966005)(8936002)(66476007)(66946007)(55236004)(76116006)(7696005)(66556008)(9686003)(55016002)(110136005)(54906003)(86362001)(4326008)(64756008)(33656002)(66446008); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata: r8v8c9+5zMTd7lepZaow0CKQaFYi+Hzp2kbA0/AtNO+r+KNk9d5WbbLR+A1twnVxLcgTlcUdqke3jmwVKB3wTZxsZmZeOG6H6DB8gWl329WH6/KkScmzYF6Op/xyz3AT7UMaVTNrmwQk7pnIj1aajBKOgxbigaudM5LZq4nngLnn5knBap2zGMxHuy7aFeP+VFYTHFdVsgydmU6vffDro5oD8I9edl0/91LydfgZQQh6RVFly8WHvW0OE2l0p2UldoutUoTtK87b1czF8q9uvDWSwHrUD7TzGBN0HblEBEpTwgiEWxjjCZk0yw1O9gL1c5B78yNYcXOsF5cO9dfHxYtBFT6LxqoTQHC8X4lDcI4YAhw3l3U2+aWIIKGX3qvfxIPrrjCDmBt8LpqVx9fTl/U3u0n6dRtRDA72GX/eIn5lC38thadQbC6drK4bzTpZR1dCvqxP8QH35anOqfFpH6DXHKebuArJi+UQWqBv/i43uCAM1Ji8COHJ3MfY1rVa
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: siemens.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: AM0PR10MB3153.EURPRD10.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: d64d7c74-eb38-480f-1f34-08d82e15257a
X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2020 07:59:22.6714 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: UFHedrOyrZQcrtMENujD9U9khduIDD56Wm5CgS2svqHh04z4SiHuRcPT8Yu/4OWxNmJlv6zcaO3aJhMMZPJnZ6QbffD7uUUMcfkPpintmjQ=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR10MB3457
Archived-At: <https://mailarchive.ietf.org/arch/msg/anima/cmw0Ks1Ry9x__MmitLwPJxN-rEw>
Subject: Re: [Anima] last minute changes to BRSKI to do endpoint discovery
X-BeenThere: anima@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Autonomic Networking Integrated Model and Approach <anima.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/anima>, <mailto:anima-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/anima/>
List-Post: <mailto:anima@ietf.org>
List-Help: <mailto:anima-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/anima>, <mailto:anima-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 22 Jul 2020 07:59:27 -0000

> Von: Michael Richardson <mcr+ietf@sandelman.ca>
> 
> 
> The BRSKI-AE authors have suggested that in order to make BRSKI more easily
> extendable that prior to using the /.well-known/est end points (both RFC7030
> ones and bootstrapping-keyinfra ones), that the pledge should ask for /.well-
> known/brski, to get back a list.
> 
> The thread ending at
> https://mailarchive.ietf.org/arch/msg/anima/MQkNXJJjMkP0nqKlNEaxDZ94RgI
> alludes to this, but the current -03 document does not include this proposal,
> because it would need to go into BRSKI itself.

I would appreciate to use /.well-known/brski for the endpoints specified in BRSKI and use /.well-known/est for those specified in RFC7030.
This offers more flexibility for future extensions like BSKI-AE.

- Hendrik

> 
>    REQ: GET /.well-known/brski
> 
>    RES: Content-Type: application/link-format   {see RFC6690}
>      </brski/voucherrequest>,ct=voucher-cms+json
>      </brski/voucher_status>,ct=json
>      </brski/requestauditlog>,ct=json
>      </brski/enrollstatus>,ct=json
> 
>      </est/cacerts>;ct=pkcs7-mime
>      </est/cacerts>;ct=pkcs7-mime
>      </est/simpleenroll>;ct=pkcs7-mime
>      </est/simplereenroll>;ct=pkcs7-mime
>      </est/fullcmc>;ct=pkcs7-mime
>      </est/serverkeygen>;ct= pkcs7-mime
>      </est/csrattrs>;ct=pkcs7-mime
> 
>       </cmp/initialization>;ct=pkixcmp
>      </cmp/certification>;ct=pkixcmp
>      </cmp/keyupdate>;ct=pkixcmp
>      </cmp/p10>;ct=pkixcmp
>      </cmp/getCAcert>;ct=pkixcmp
>      </cmp/getCSRparam>;ct=pkixcmp
> 
> This is already done in draft-ietf-ace-coap-est-18, BTW.
> But, it asks /.well-known/core?rt=ace.est rather than /.well-known/brski.
> 
> At this point, we are waiting for ACP document to be approved by the IESG.
> Assuming that our AD was amenable, I think that this could be snuck in before
> ACP is approved.   This email does not include my opinion, as it has not yet
> been formed.
> 
> --
> Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works  -
> = IPv6 IoT consulting =-

v2.23.0 | Report a Bug | By Email