[Netconf] zero touch update plan

[Kent Watsen <[e-mail]>]

I presented in Prague about resolving a privacy issue by defining a secure redirect mechanism.  The mechanism entails the device only receiving back a redirect message to its deployment-specific bootstrap server.  The redirect message would include also an X.509 certificate that the device can subsequently use to authenticate the bootstrap server the device is being redirected to.  This is what I'm calling "secure redirect".

Secure-redirect is fundamentally a transport-level security play.  That is, an authenticated connection to the redirect server (most likely hosted by the device's vendor) provides the trust anchor for an authenticated connection to the deployment-specific bootstrap server.  Because the trust anchor is provided over a trusted connection, it can be trusted.  Likewise, the bootstrap data received from the bootstrap server can also be trusted, because it is provided over a trust connection.  This solution is notable as it does not require the data to be signed in order to be trusted, unlike what's written in the current zerotouch draft.  That is, nothing related to Owner Certificate or Ownership Vouchers is needed for this solution to be secure.

Summarizing, there are two distinct solutions:

1. For when end-to-end transport-level security is possible (i.e., device can route to Internet)
- bootstrap data does not have to be signed

2. For when end-to-end transport-level security is NOT possible (e.g., a private network)
- bootstrap data has to be signed (e.g., Owner Certificate and Ownership Vouchers)

Of course, it's OK to do both at the same time too - i.e., signed data over a secure transport

Anyway, unless anyone objects, I will update the draft along these lines in a few days.

Ciao,
Kent