[dtn] FW: [EXT] Re: [Acme] I-D Action: draft-ietf-acme-dtnnodeid-12.txt

["Sipos, Brian J." <[e-mail]>]

DTN WGers,

An ACME document (referenced below) related to validate the ownership of a BP Node ID is going through last call and receiving some feedback from DTN folks on the ACME mailing list ([e-mail] <mailto:[e-mail]> ) would be helpful for chairs and AD to be confident that the document is in good shape. Keep in mind that this mechanism (and doc) is in the Experimental category, so the goal is to have a validation method which is usable and testable, not necessarily one which has solved for all possible conditions and topologies.

 

There was some specific focus on whether Section 4 “Bundle Integrity Gateway” has a reasonable set of requirements. Specifically the requirement that an integrity gateway verify the authenticity of the source through some means below (or outside of) the BP layer. The analogy to DKIM email signing should be helpful in understanding what is proposed here, though while DKIM relies on configuration being distributed via DNS the BP integrity gateway requires out-of-band configuration of which nodes are allowed to sign on behalf of which sources.

 

Any feedback on the current state or suggestions for improving reader’s understanding of what is being proposed is helpful. Nothing being proposed here should be truly novel, just combining existing techniques and applying it to BP Node IDs and BP transport. But these kinds of improved automation are valuable for scalable and dynamic networks.

Thank you,

Brian S.

 

 

From: Acme <[e-mail]> On Behalf Of Deb Cooley
Sent: Friday, January 12, 2024 7:01 AM
To: [e-mail]
Cc: [e-mail]
Subject: [EXT] Re: [Acme] I-D Action: draft-ietf-acme-dtnnodeid-12.txt

 


APL external email warning: Verify sender [e-mail] <mailto:[e-mail]>  before clicking links or attachments

 

This is the beginning of a two week WGLC for this draft, which will end on 26 Jan.  

 

Please review and comment.  

 

Deb C 

ACME WG Chair 

 

On Thu, Jan 11, 2024 at 4:26 PM <[e-mail] <mailto:[e-mail]> > wrote:

Internet-Draft draft-ietf-acme-dtnnodeid-12.txt is now available. It is a work
item of the Automated Certificate Management Environment (ACME) WG of the
IETF.

   Title:   Automated Certificate Management Environment (ACME) Delay-Tolerant Networking (DTN) Node ID Validation Extension
   Author:  Brian Sipos
   Name:    draft-ietf-acme-dtnnodeid-12.txt
   Pages:   31
   Dates:   2024-01-11

Abstract:

   This document specifies an extension to the Automated Certificate
   Management Environment (ACME) protocol which allows an ACME server to
   validate the Delay-Tolerant Networking (DTN) Node ID for an ACME
   client.  A DTN Node ID is an identifier used in the Bundle Protocol
   (BP) to name a "singleton endpoint", one which is registered on a
   single BP node.  The DTN Node ID is encoded as a certificate Subject
   Alternative Name (SAN) of type otherName with a name form of
   BundleEID and as an ACME Identifier type "bundleEID".

The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-ietf-acme-dtnnodeid/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-ietf-acme-dtnnodeid-12.html

A diff from the previous version is available at:
https://author-tools.ietf.org/iddiff?url2=draft-ietf-acme-dtnnodeid-12

Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts


_______________________________________________
Acme mailing list
[e-mail] <mailto:[e-mail]> 
https://www.ietf.org/mailman/listinfo/acme