Subject: [Anima] I-D Action: draft-ietf-anima-constrained-voucher-10.txt

From: [email-masked]
Date: Sun, 21 Feb 2021 11:31:03 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Autonomic Networking Integrated Model and Approach WG of the IETF.

        Title           : Constrained Voucher Artifacts for Bootstrapping Protocols
        Authors         : Michael Richardson
                          Peter van der Stok
                          Panos Kampanakis
                          Esko Dijk
	Filename        : draft-ietf-anima-constrained-voucher-10.txt
	Pages           : 50
	Date            : 2021-02-20

Abstract:
   This document defines a protocol to securely assign a Pledge to an
   owner and to enroll it into the owner's network.  The protocol uses
   an artifact that is signed by the Pledge's manufacturer.  This
   artifact is known as a "voucher".

   This document builds upon the work in [RFC8366] and [BRSKI], but
   defines an encoding of the voucher in CBOR rather than JSON, and
   enables the Pledge to perform its transactions using CoAP rather than
   HTTPS.

   The use of Raw Public Keys instead of X.509 certificates for security
   operations is also explained.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-anima-constrained-voucher/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-anima-constrained-voucher-10
https://datatracker.ietf.org/doc/html/draft-ietf-anima-constrained-voucher-10

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-anima-constrained-voucher-10

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Michael Richardson <[email-masked]>
Date: Sun, 21 Feb 2021 15:33:47 -0500

1. We have added Esko Dijk as an author.  Esko has been instrumental in
   getting this document focused and moving forward.  Thank you!

2. We reduced the number of mandatory exchanges, trying to optimize for
   common cases of small PKIs with common usage patterns.
   This makes the /crts optional in many cases.
   We changed /crts from returning application/pkcs7-mime;smime-type=certs-only
   to returning application/pkix-cert (for which we need a CoAP type code).

3. we removed the CoAP version of requestauditlog, as that is part of the
   BRSKI-MASA, (northbound) communication, which is always HTTPS, and is
   always non-constrained.

4. while we obligate the Registrar to support discovery via GET /.well-known/core?rt=brski*
   we do not obligate the pledge to use that, and mandate that the /.well-known/brski/xx
   targets are already supported by the Registrar.

5. We clarify how the desired pining by the MASA is to be signaled, and how
   it is to work for pinning of RPK.

6. We have excised all text relating to CMS signed CBOR.
   That involved returning the early allocation of CT=1.2.840.113549.1.9.16.1.46.

If you have not read the document recently, now would be a good time.
We have 17 open issues at https://github.com/anima-wg/constrained-voucher/issues
and we expect to close them in the next ~6 weeks.

I see in reviewing the diff that there is a mistake in figure 1, with the use
of "Int"ermediate CA. We have concluded on using the term "Sub"ordinate CA.
Figure 2 gets that right.

[email-masked] wrote:
    >         Title : Constrained Voucher Artifacts for Bootstrapping
    > Protocols Authors : Michael Richardson Peter van der Stok Panos
    > Kampanakis Esko Dijk Filename :
    > draft-ietf-anima-constrained-voucher-10.txt Pages : 50 Date :

    > Abstract: This document defines a protocol to securely assign a Pledge
    > to an owner and to enroll it into the owner's network.  The protocol
    > uses an artifact that is signed by the Pledge's manufacturer.  This

...

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide