Subject: [Anima] BRSKI -- does pledge or registrar create serial-number?

From: Michael Richardson <[email-masked]>
Date: Wed, 14 Mar 2018 09:44:46 -0400

Based upon private emails about interoperation attempts, I opened:
      https://github.com/anima-wg/anima-bootstrap/issues/47

https://tools.ietf.org/html/draft-ietf-anima-bootstrapping-keyinfra-12#section-2.3.1
explains how a serial-number voucher field is derived from the IDevID fields.

It does not say which party does this. The Pledge can do it when it forms
it's voucher-request. However, if the pledge does not do so, is it valid to
send a voucher-request without a serial-number field, and assume that the
Registrar will do the same thing to find the serial-number from the IDevID?

The problem with having any entity other than the Pledge do the calculation
is that it's the Pledge that will be comparing the resulting voucher, and as
there are multiple ways to produce the serial-number, and they might not be
identical, a voucher could be issued that the Pledge can not verify.

If section 2.3.1 should be applied on the pledge, then we should perhaps say
that more clearly in that section.
The VOUCHER YANG says that the field is mandatory.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Michael Richardson <[email-masked]>
Date: Thu, 15 Mar 2018 08:01:29 +0000

---

From: Michael Richardson <[email-masked]>
Date: Sun, 18 Mar 2018 09:45:03 +0000

Brian Weis (bew) <[email-masked]> wrote:
    > So I’ve been trolling through the code, and discovered that the http
    > application/* headers do not match the latest release. I also hadn’t realized
    > that the Pledge can send either "application/json” (unsigned) or
    > "application/voucher-cms+json” (signed) vouchers. I’ve changed the
    > unsigned string to match the draft. But this raises a question:

    > If the Pledge sends an unsigned Voucher, I would expect the Registrar to
    > forward it in the MASA server as the "prior-signed-voucher”. But in fact
    > it’s not signed, and I see elsewhere that the Registrar is supposed to
    > send it signed.  From Section 3 of -12:

    > The "prior-signed-voucher-request" leaf is be used in Registrar
    > voucher-requests to the Pledge voucher-request.  It contains the
    > encoded (signed form) of the Pledge voucher-request.

    > What is the correct behavior?

I've opened this as issue:
     https://github.com/anima-wg/anima-bootstrap/issues/48

---

From: Michael Richardson <[email-masked]>
Date: Sun, 18 Mar 2018 09:47:46 +0000

Brian Weis (bew) <[email-masked]> wrote:
    > Another unrelated question. What is the correct media type response for
    > the authorization log? Section 5.7 doesn’t seem to say. I assume that the
    > response is unsigned JSON, so the http headers should say “application/json”.
    > Is that right?

    > (For some reason my code has the response sent as a CMS signed object,
    > but that seems to be incorrect.)

Opened as:
       https://github.com/anima-wg/anima-bootstrap/issues/49

I think that you are correct, it should be application/json.
The results should be not be signed in any way.