Re: [Netconf] I-D Action: draft-ietf-netconf-zerotouch-20.txt

[Xufeng Liu <[e-mail]>]

Support for publication. The authors have resolve the comments raised recently..

Thanks,
- Xufeng

> -----Original Message-----
> From: Netconf [mailto:[e-mail]] On Behalf Of Kent Watsen
> Sent: Wednesday, February 28, 2018 4:21 PM
> To: [e-mail]
> Subject: Re: [Netconf] I-D Action: draft-ietf-netconf-zerotouch-20.txt
> 
> 
> This update addresses all the LC comments, as well as items discussed after the
> Last Call.  The diff looks large and, in some places, difficult to read (mostly due
> to rendering issues).  Please see the change log for a complete list of changes.
> 
> I believe that the draft is now ready to published.
> 
> That said, I wanted to throw out one thing to the WG, to see if anyone thinks it's
> worth pursuing. The issue is as follows:
> 
> 1) The draft defines three CMS-based artifacts that each resist tampering
> through the use of a signatures, but none of which protect privacy through the
> use of encryption.
> 
> 2) The information contained within these artifacts may be considered sensitive
> in some environments, especially when placing signed onboarding-information
> on a removable storage device.
> 
> 3) It would be relatively easy for us to extend the draft to also support
> encryption as (a) CMS already supports encryption (i.e., the result is still a CMS
> structure) and (b) the draft can easily explain that the encryption uses the public
> key from the client certificate's certificate (e.g., the IDevID cert).
> 
> If we don't do it now, how hard would it be to add later?  I think that the text at
> the very end of Section 3.1 would make it a tricky add.  This text is currently very
> specific about the top-most content-type being the OID id-signedData, whereas
> in this case we'd want it to be the OID id-encryptedData.
> 
> Any thoughts on this?  If nothing else, add a Security Consideration noting the
> possibility for unwanted disclosure of information?
> 
> Thanks,
> Kent // author
> 
> 
> =====
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Network Configuration WG of the IETF.
> 
>         Title           : Zero Touch Provisioning for Networking Devices
>         Authors         : Kent Watsen
>                           Mikael Abrahamsson
>                           Ian Farrer
> 	Filename        : draft-ietf-netconf-zerotouch-20.txt
> 	Pages           : 80
> 	Date            : 2018-02-27
> 
> Abstract:
>    This draft presents a technique to securely provision a networking
>    device when it is booting in a factory-default state.  Variations in
>    the solution enables it to be used on both public and private
>    networks.  The provisioning steps are able to update the boot image,
>    commit an initial configuration, and execute arbitrary scripts to
>    address auxiliary needs.  The updated device is subsequently able to
>    establish secure connections with other systems.  For instance, a
>    device may establish NETCONF [RFC6241] and/or RESTCONF [RFC8040]
>    connections with deployment-specific network management systems.
> 
> 
> The IETF datatracker status page for this draft is:
> https://urldefense.proofpoint.com/v2/url?u=https-
> 3A__datatracker.ietf.org_doc_draft-2Dietf-2Dnetconf-
> 2Dzerotouch_&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-
> ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=wl
> 9ec4YJanRPyQNR2VOtG8P2uc3lCco8GMEZjCwV1fI&s=YtaCDlahlDcdzpcJMJWW
> wCq4U1C86VTnBPuAng3iiAQ&e=
> 
> There are also htmlized versions available at:
> https://urldefense.proofpoint.com/v2/url?u=https-
> 3A__tools.ietf.org_html_draft-2Dietf-2Dnetconf-2Dzerotouch-
> 2D20&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-
> ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=wl
> 9ec4YJanRPyQNR2VOtG8P2uc3lCco8GMEZjCwV1fI&s=w2t3Leq_NTZ-gqhq-
> 73T5UIOtVPDlGp3uIjSvDJ6GFw&e=
> https://urldefense.proofpoint.com/v2/url?u=https-
> 3A__datatracker.ietf.org_doc_html_draft-2Dietf-2Dnetconf-2Dzerotouch-
> 2D20&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-
> ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=wl
> 9ec4YJanRPyQNR2VOtG8P2uc3lCco8GMEZjCwV1fI&s=LLo_vD0rJGdGqk1TczIHt
> WLc4HcaTrL4cSMzd2bDxsM&e=
> 
> A diff from the previous version is available at:
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_rfcdiff-
> 3Furl2-3Ddraft-2Dietf-2Dnetconf-2Dzerotouch-
> 2D20&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-
> ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=wl
> 9ec4YJanRPyQNR2VOtG8P2uc3lCco8GMEZjCwV1fI&s=ut59EsQnGVgPg4P5693ly
> k76burJw9gYK678Emllg1c&e=
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> https://urldefense.proofpoint.com/v2/url?u=ftp-3A__ftp.ietf.org_internet-
> 2Ddrafts_&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-
> ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=wl
> 9ec4YJanRPyQNR2VOtG8P2uc3lCco8GMEZjCwV1fI&s=lvqR8pmK1dsncN89PZymi
> yiQ5fiGZ3VU-DLM46y-tz4&e=
> 
> _______________________________________________
> Netconf mailing list
> [e-mail]
> https://urldefense.proofpoint.com/v2/url?u=https-
> 3A__www.ietf.org_mailman_listinfo_netconf&d=DwICAg&c=HAkYuh63rsuhr6Sc
> bfh0UjBXeMK-
> ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=wl
> 9ec4YJanRPyQNR2VOtG8P2uc3lCco8GMEZjCwV1fI&s=J-
> whUo3CptmTuqi4KtpPbfEWzqpHu2jAzQqJRc41vBg&e=
> 
> 
> _______________________________________________
> Netconf mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/netconf