Re: [Iot-onboarding] FW: New Version Notification for draft-friel-anima-brski-cloud-00.txt

[Michael Richardson <[e-mail]>]

Owen Friel (ofriel) <[e-mail]> wrote:
    > FYI, as discussed earlier on the thread, published first cut of the default BRSKI cloud registrar draft.

Thanks for starting this document.  I will send pull requests once I know
where you put it...


I think that there are a few high-level things that need to be clearer.
0) Why isn't is RFC8572 (SZTP) needs to be clearer.

1) what does it mean to onboard to the cloud only.  While it is nice for the
   IETF to make a standard for a manufacturer to interoperate with itself,
   we should recognize that we don't need to.  This is basically how every
   single home-IoT device that calls home works today.

2) we should clarify some reasons why the device can not find the local
   registrar.  One reason is that it's not local. I.e. a device being
   bootstrapped at some other location.

3) the device already has network connectivity.  Probably from a wire!!!
   (maybe from an open WiFi though)
   It's not core enterprise/ISP routing/switching equipment.

4) there is probably a significant difference between a 301 redirect before
   the voucher request and one that occurs after a voucher is issued.
   A redirect before request would be based upon the TLS Client Certificate
   identity.
   
   A redirect that occured during the voucher-request would be curious, and
   I'm not sure what purpose it would serve, so I want to ignore this.
   
   A redirect in the form a voucher, is a different thing, pointing the
   pledge to an EST server with which to continue.
   
   In fact, I would suggest that these are two MAJOR different modes, and
   might even be different documents/protocols.  The argument for not being
   separate is that it might be on a per-device basis that it makes the
   decision.

5) I think that this mechanism can never work without some amount of
   supply-chain integration, otherwise the cloud MASA has no idea who the
   correct customer is.  This is also implies that it doesn't work for the
   various "HomeDepot" retail situations.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [