Subject: [Anima] I-D Action: draft-ietf-anima-bootstrapping-keyinfra-04.txt

From: [email-masked]
Date: Mon, 31 Oct 2016 11:18:38 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Autonomic Networking Integrated Model and Approach of the IETF.

        Title           : Bootstrapping Remote Secure Key Infrastructures (BRSKI)
        Authors         : Max Pritikin
                          Michael C. Richardson
                          Michael H. Behringer
                          Steinthor Bjarnason
                          Kent Watsen
	Filename        : draft-ietf-anima-bootstrapping-keyinfra-04.txt
	Pages           : 47
	Date            : 2016-10-31

Abstract:
   This document specifies automated bootstrapping of a remote secure
   key infrastructure (BRSKI) using vendor installed X.509 certificate,
   in combination with a vendor authorized service on the Internet.
   Bootstrapping a new device can occur using a routable address and a
   cloud service, or using only link-local connectivity, or on limited/
   disconnected networks.  Support for lower security models, including
   devices with minimal identity, is described for legacy reasons but
   not encouraged.  Bootstrapping is complete when the cryptographic
   identity of the new key infrastructure is successfully deployed to
   the device but the established secure connection can be used to
   deploy a locally issued certificate to the device as well.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-anima-bootstrapping-keyinfra/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-anima-bootstrapping-keyinfra-04

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-anima-bootstrapping-keyinfra-04

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 1 Nov 2016 12:40:36 +1300

Hi,

This is about the bootstrapping draft, but I will start by quoting Toerless
from another thread:

On 01/11/2016 11:18, Toerless Eckert wrote:
> On Mon, Oct 31, 2016 at 01:23:36PM +1300, Brian E Carpenter wrote:
>>> I am confused about the reason for this discussion. It seems you are trying
>>> to figure out how to minimize the impact of the insecure multicast piece of GRASP,
>>> but in the context of ANIMA this question would be irrelevant, because we are
>>> not doing any insecure GRASP in BRSKY or ACP with current draft - the use of
>>> insecure GRASP was removed in those drafts before Berlin because of the majority
>>> of the bootstrap teams choice for DNS-SD/mDNS. 
>>
>> Which, I have to point out, is not a consensus position; design teams propose,
>> they don't decide. I'm waiting to see the next draft before I raise this issue on
>> the WG list.
> 
> Right. I guess we've now posted all drafts we can before the deadline, so
> let me change this mail threads subject to get the discussion started.
> 
> Current state:
> 
> a) The bootstrap design team mayority did conclude that mDNS is the best option
>    for discovery of bootstrap proxy by the pledge (link-local). I'll still have
>    to read in more detail through the document to see how well the text discusses
>    all the reasons why.

To be clear, I have no objection to mDNS being mandatory to implement for
BRSKI proxies and/or registrars. This will allow the BRSKI mechanism to be
used in a wider context than just an Anima-conformant autonomous network (AN),
because any joining node (pledge) can then discover a registrar or proxy
via mDNS.

However, I belive that the Anima solution will be incoherent unles GRASP
mechanisms are *also* mandatory for BRSKI proxies and/or registrars. In this
case it will be possible for autonomic nodes that wish to join the AN to
use GRASP with no need for mDNS. If we don't do this, the Anima solution
will not be complete in itself. Especially during the early formation
of an AN after a cold start, this is a problem.

So specifically I want bootstrapping-keyinfra to specify that
- registrars and proxies MUST be disoverable by both mDNS/DNS-SD
and GRASP.
- pledges MUST use one of these two mechanisms

There are some details to be worked out, because there are several
ways to use GRASP for this purpose, but we need to get the question
settled as a matter of principle first.

I do believe that the security issues are very similar. Both mDNS
and GRASP involve link-local multicast and its intrinsic security
and privacy issues. The information that would communicated by
multicast would be pretty much the same in both cases.

Unfortunately I will not be in Seoul to argue this point, so
it would be nice to settle it by email.

Regards
   Brian