Return-Path: X-Original-To: anima@ietfa.amsl.com Delivered-To: anima@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ECFA11200DF; Wed, 7 Aug 2019 14:22:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8wtD1pqGPBMT; Wed, 7 Aug 2019 14:22:26 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A46912003F; Wed, 7 Aug 2019 14:22:25 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 30CE63818D; Wed, 7 Aug 2019 17:21:47 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 32C7D479; Wed, 7 Aug 2019 17:22:24 -0400 (EDT) From: Michael Richardson To: Kent Watsen cc: "Owen Friel \(ofriel\)" , "iot-onboarding\@ietf.org" , Rifaat Shekh-Yusef , "anima\@ietf.org" In-Reply-To: <0100016c6772e4e8-8ce5598b-2c2a-488e-b7c2-414d9003e46b-000000@email.amazonses.com> References: <0100016c6772e4e8-8ce5598b-2c2a-488e-b7c2-414d9003e46b-000000@email.amazonses.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Anima] [Iot-onboarding] Device Certificate Deployment Automation with ACME using BRSKI X-BeenThere: anima@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Autonomic Networking Integrated Model and Approach List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 21:22:28 -0000 --=-=-= Content-Type: text/plain Kent Watsen wrote: > Skimming quickly, I see now the direction to go to a cloud registrar to > be redirected to a local registrar. I feel compelled to point out that > this is exactly what SZTP (RFC 8572) does, or at least, supports. > Actually, as a more general statement, it was originally said that the > two WG's approaches were different, but they are now becoming more and > more alike. Well, since SZTP is published already, it's more like the > ANIMA approach is becoming more like SZTP, albeit seemingly with more > complexity. SZTP does not directly result in the same mutually authenticated TLS (EST) connection to a Registrar that BRSKI does. This was not an explicit SZTP goal. What it could do though, is to provide a source of (secure) bootstrap configuration in which such a connection could be initiated. In my mind, I see a fragment of signed JUNOS, IOS (CISCO, not Apple), etc. CLI configuration that initiates the connection. Such a thing would not be standardized. But, I would think that this is exactly the kind of thing that could be encoded in YANG. My understanding of https://tools.ietf.org/html/draft-ietf-netconf-keystore is that it would provided for Registrar initiated (PUSH) updating of device certificates, but would not provide a way for a device to initiate (PULL) to a securely identified EST server. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl1LQQ8ACgkQgItw+93Q 3WWI/gf/bwVjAfF8vN9e02GdUOnmrLrhdhHAiRJFOjGJymFThOVX/mAtkRIeGUy7 sbOV5700wMKS5pesDEu/8VVsu+FXxu++XjuEMRRMiW3kg5XuknAzBSrEdCKANBO9 OH/LbfKXZME92odX2U1us42YlxUNh5C94lJB1A+rLP6ZLXIJRsINzXbG+a3Bxj0z DMDBbp5yvNKx2ljKnikQ7s2tEtbQJEH/Kyn75vd1WQtTWDqF0n7yK3K7FFCNXdug Dqc0wXERzBP1Ux5gzcSOyCzHzNA7y2zZ51Sxtkg6RMhxNkOTGQzeFl2Yn7diKrPJ QxjmC0u9xh6QULzRt4Mflbw++U7zVQ== =pS42 -----END PGP SIGNATURE----- --=-=-=--