Re: [Netconf] zerotouch/11: Ownership Voucher – formally define?

[Kent Watsen <[e-mail]>]

Another update.  This issue was discussed for about an hour this morning with ANIMA folks (Michael sent minutes).  One thing that came out of it, for us at least, is that there is a need to formally define an ownership voucher format so that:

  1. so that a DNS-SD response can apply to multiple vendor devices
  2. so that the voucher can be viewed outside of the bootstrapping infrastructure (e.g., for debugging)

So, to the question asked by the subject line, the answer seems to be “yes” (please object within a week if you disagree).  Of course, now we have to do the hard part of defining what that format is, and to what extent it’s shared with the ANIMA solution.  This will be discussed further in next week’s ANIMA call, stay tuned!

Thanks,
Kent


From: Netconf <[e-mail]> on behalf of Kent Watsen <[e-mail]>
Date: Wednesday, June 29, 2016 at 7:11 PM
To: "[e-mail]" <[e-mail]>
Subject: Re: [Netconf] zerotouch/11: Ownership Voucher – formally define?


Update: This issue has been discussed with the ANIMA folks.  The current proposal is:

OLD:
   module: ietf-zerotouch-ownership-voucher
      +--rw voucher
         +--rw owner-id      string
         +--rw unique-id*    string
         +--rw created-on    yang:date-and-time
         +--rw expires-on?   yang:date-and-time
         +--rw signature     string

NEW:
     module: ietf-zerotouch-ownership-voucher
      +--rw voucher
         +--rw owner-id           string
         +--rw unique-id*         string                    // ANIMA would always have just 1 list entry
         +--rw nonce?             unit64                    // only ANIMA would use this nonce field
         +--rw verification-type  enum {verified, logged)   // NETCONF would always be VERIFIED
         +--rw created-on         yang:date-and-time
         +--rw expires-on?        yang:date-and-time

As compared to ANIMA’s current ‘voucher’ format:
   {
   "nonce":"<64bit nonce value>",
   "serialnumber":"<string value>",    --> unique-id
   "domainID":<domainID value>        --> owner-id
    }


This one likely needs more discussion, but would love to hear opinions now...

Kent



From: Netconf <[e-mail]> on behalf of Kent Watsen <[e-mail]>
Date: Wednesday, May 11, 2016 at 6:57 PM
To: "[e-mail]" <[e-mail]>
Subject: [Netconf] zerotouch/11: Ownership Voucher – formally define?


https://github.com/netconf-wg/zero-touch/issues/11

This issue regards the format of the ownership voucher.  The current draft defines the ownership voucher as a vendor-specific format, but there may be a desire to define a normative format, so that it helps with DNS-SD as well as with the ANIMA bootstrapping approach.

Currently this item is on the ANIMA bootstrapping team's agenda to discuss in an upcoming meeting.  It's probably best to defer discussion on this issue until after the ANIMA folks have discussed it.  I will send an update to the list with the results of that discussion as soon as I can.



Regards,

Kent