Re: [Netconf] I-D Action: draft-ietf-netconf-zerotouch-27.txt

[Kent Watsen <[e-mail]>]

Below is the Change Log. Mostly items from Benjamin Kaduk's review.
The last couple items are from what I mentioned in my email on the 21st.

- Added Security Consideration for cascading trust via redirects.
- Modified the get-bootstrapping-data RPC's "nonce" input parameter
  to being a minimum of 16-bytes (used to be 8-bytes).
- Added Security Consideration regarding possible reuse of device's private key.
- Added Security Consideration regarding use of sign-then-encrypt.
- Renamed "Zero Touch"/"zerotouch" throughout. Now uses "SZTP" when referring
  to the draft/solution, and "conveyed" when referring to the bootstrapping artifact.
- Added missing text for "encrypted unsigned conveyed information" case.
- Renamed "untrusted-connection" input parameter to "signed-data-preferred"
- Switch yd:yang-data back to rc:yang-data
- Added a couple features to the bootstrap-server module.

Kent // contributor


-----Original Message-----
From: Netconf <[e-mail]> on behalf of "[e-mail]" <[e-mail]>
Reply-To: NETCONF Working Group <[e-mail]>
Date: Friday, January 4, 2019 at 9:56 PM
To: "[e-mail]" <[e-mail]>
Cc: NETCONF Working Group <[e-mail]>
Subject: [Netconf] I-D Action: draft-ietf-netconf-zerotouch-27.txt


A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Network Configuration WG of the IETF.

        Title           : Secure Zero Touch Provisioning (SZTP)
        Authors         : Kent Watsen
                          Mikael Abrahamsson
                          Ian Farrer
	Filename        : draft-ietf-netconf-zerotouch-27.txt
	Pages           : 96
	Date            : 2019-01-04

Abstract:
   This draft presents a technique to securely provision a networking
   device when it is booting in a factory-default state.  Variations in
   the solution enables it to be used on both public and private
   networks.  The provisioning steps are able to update the boot image,
   commit an initial configuration, and execute arbitrary scripts to
   address auxiliary needs.  The updated device is subsequently able to
   establish secure connections with other systems.  For instance, a
   device may establish NETCONF (RFC 6241) and/or RESTCONF (RFC 8040)
   connections with deployment-specific network management systems.


The IETF datatracker status page for this draft is:
https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dnetconf-2Dzerotouch_&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=_l2PU7UVbo_Ak9ZWZN_xebGb5i-qfx1S9jdVoE1qK_g&s=OaUea_LZeY4aifmnpVSGtmAH6CoxbTQjjXH2VPF0bmQ&e=

There are also htmlized versions available at:
https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_draft-2Dietf-2Dnetconf-2Dzerotouch-2D27&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=_l2PU7UVbo_Ak9ZWZN_xebGb5i-qfx1S9jdVoE1qK_g&s=YsLUoGf-7pADyEyJ5rv8UHfGa8K4iGQpuEcBmiEnoSE&e=
https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_html_draft-2Dietf-2Dnetconf-2Dzerotouch-2D27&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=_l2PU7UVbo_Ak9ZWZN_xebGb5i-qfx1S9jdVoE1qK_g&s=qOon7HY_6eKIPVAoA3KiQ-yMVZAQ4uENeKtrcH-8HGc&e=

A diff from the previous version is available at:
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_rfcdiff-3Furl2-3Ddraft-2Dietf-2Dnetconf-2Dzerotouch-2D27&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=_l2PU7UVbo_Ak9ZWZN_xebGb5i-qfx1S9jdVoE1qK_g&s=w2x30zS5dKMMpm_mBEQBJg8sQYbituxYMiQT7hU3zYE&e=


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
https://urldefense.proofpoint.com/v2/url?u=ftp-3A__ftp.ietf.org_internet-2Ddrafts_&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=_l2PU7UVbo_Ak9ZWZN_xebGb5i-qfx1S9jdVoE1qK_g&s=T3W6IQ0peh9XVENA__bYGCz_KsIdTsrd73ZxQVDASu8&e=

_______________________________________________
Netconf mailing list
[e-mail]
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_netconf&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=_l2PU7UVbo_Ak9ZWZN_xebGb5i-qfx1S9jdVoE1qK_g&s=SxUrO7Qx_ikhB753ZZVpkmp1mrZcKbBUOIumyIbTNMo&e=