Subject: [Anima] Several questions about draft-pritikin-anima-bootstrapping-keyinfra

From: "Liubing (Leo)" <[email-masked]>
Date: Thu, 5 Feb 2015 18:14:47 +0000

Hi,

I'm reading the draft. Here are several primary questions. 

1. In 3.2
"...or a device can
   auto-select itself to take on this function, using a detection
   mechanism to resolve potential conflicts and setup communication with
   the Domain Certification Authority.  An automated Registrar selection
   processes is not detailed here"
Will this mechanism be in the future version, or another dedicated draft?

2. Regarding to Cloud Service
In Abstract, it is called "a vendor based cloud service"; then in the formal text, it is called "third-party cloud service".
I'm a little confused, does the MASA support bootstrapping the devices from other vendors or not? And must the MASA operated by the vendors?

3. In 4.1.1
"IEEE 802.1X  Where the New Entity can be cast as the "supplicant" and
      the Proxy is the "authenticator".  The bootstrapping protocol
      messages are encapsulated as EAP methods.  The "authenticator"
      reencapsulates the EAPOL frames and forwards them to the
      "Authentication Server", which provides Registrar functionalities."
When there is no Proxy, will 802.1x also fit in the scenario?

Best regards,
Bing

---

From: "Michael Behringer (mbehring)" <[email-masked]>
Date: Thu, 12 Feb 2015 16:37:17 +0000

Thanks for your feedback, Liubing. Inline...

> -----Original Message-----
> From: Anima [mailto:[email-masked]] On Behalf Of Liubing (Leo)
> Sent: 05 February 2015 19:15
> To: [email-masked]
> Subject: [Anima] Several questions about draft-pritikin-anima-
> bootstrapping-keyinfra
> 
> Hi,
> 

My current feeling is that the details aren't really relevant right now, and I would leave it as is. The current revision (coming) labels it clearly as "out of scope" for now, to be clear. Open to suggestions. 

> In Abstract, it is called "a vendor based cloud service"; then in the formal
> text, it is called "third-party cloud service".
> I'm a little confused, does the MASA support bootstrapping the devices
> from other vendors or not? And must the MASA operated by the vendors?

I believe the next revision makes this clear, and also doesn't mention the word "cloud" any more (on request of Brian). It's now called an "Internet based  MASA service", or short "MASA service".  

Bottom line: The 802.1ar credentials we suggest to use can be put by either. We see the primary use case in the vendor providing hardware assurance for his devices. But an integrator can fulfil the same function, and is the more likely scenario in certain markets. 

So, if a network operator buys devices from say 2 vendors, he would use the MASA services of each for their respective devices. Where an integrator does some pre-staging, he could provide the trust anchors, and then the network might only require a single MASA server (from that integrator). 

Tried to be clearer in the doc now. 

> When there is no Proxy, will 802.1x also fit in the scenario?

Well, .1x requires an authenticator. So my take would be that you require a proxy in this case. 

The next version of the document is imminent - bear with us!

Thanks for your comments!
Michael

> Best regards,
> Bing
> 
> _______________________________________________
> Anima mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/anima