Subject: [Anima] I-D Action: draft-ietf-anima-brski-async-enroll-01.txt

From: [email-masked]
Date: Thu, 07 Jan 2021 06:23:47 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Autonomic Networking Integrated Model and Approach WG of the IETF.

        Title           : Support of asynchronous Enrollment in BRSKI (BRSKI-AE)
        Authors         : Steffen Fries
                          Hendrik Brockhaus
                          Eliot Lear
                          Thomas Werner
	Filename        : draft-ietf-anima-brski-async-enroll-01.txt
	Pages           : 41
	Date            : 2021-01-07

Abstract:
   This document describes enhancements of bootstrapping a remote secure
   key infrastructure (BRSKI) to also operate in domains featuring no or
   only timely limited connectivity between involved components.
   Moreover, newly introduced are methods to perform the BRSKI approach
   in environments, in which the role of the pledge changes to a server
   instead of the client.  This changes the interaction model as the
   pledge is pushed to interact with the registrar instead of pulling
   information from the registrar.  To support both, BRSKI-AE relies on
   the exchange of it authenticated self-contained objects (signature-
   wrapped objects) also for requesting and distributing of domain
   specific device certificates.  The defined approach is agnostic
   regarding the utilized enrollment protocol allowing the application
   of existing and potentially new certificate management protocols.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-anima-brski-async-enroll/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-anima-brski-async-enroll-01
https://datatracker.ietf.org/doc/html/draft-ietf-anima-brski-async-enroll-01

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-anima-brski-async-enroll-01

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Michael Richardson <[email-masked]>
Date: Thu, 07 Jan 2021 17:44:54 -0500

Hi, the BRSKI design team met this morning at "7:30AM EST", i.e. 1230UTC.
We have met most weeks since 2020-10-01.
We are using: https://meet.sandelman.ca/BRSKIDesignTeam (a JITSI instance)
and the password, if asked is "anima".
We meet weekly.

Typical attendees include:
        * Peter van der Stok
        * Ejko Dijk
        * Thomas Werner
        * Aurelio Schellenbaum
        * Steffen Fries
        * Michael Richardson
        * Wei Pan
        * Hendrik Brockhaus
        * Eliot Lear

We are working on the following documents/repositories:

  https://github.com/anima-wg/anima-brski-async-enroll
  https://github.com/anima-wg/constrained-voucher
  https://github.com/anima-wg/constrained-6tisch-anima-dtls-join-proxy.git
and perhaps:
  https://github.com/mcr/anima-jose-voucher

This morning we dealt with:

1) https://www.ietf.org/rfcdiff?url2=draft-ietf-anima-brski-async-enroll-01
That is, the changes that Steffen has done to brski-async-enroll,
specifically section 5.2.  We discussed how we could create an assertion from
the *PLEDGE AGENT* that it in fact has proximity to the PLEDGE.

This section introduces DPP-like QR code using a PSK.
There are many manufacturing challenges with a QR code, which are similar to
those created by an IDevID.
Having the result be a PSK further complicates things as it must now not just
be synchronized, but kept private.
(Though, DPP also requires that the printed public key remain essentially
private, as if it's actually the private part of the keypair)

We agreed that Steffen would post the -01 version above so that we can
have a larger discussion about this.
In particular, Eliot asked about the relationship between the pledge-agent
and the Registrar: what is it?

2) We worked on two of the three currently open pull requests.

a) https://github.com/anima-wg/constrained-voucher/pull/68
   rewrite intro and abstract
   -- make intro text match intention that this is about:
           - constrained voucher
      AND  - constrained BRSKI
   -- probably the title needs to change too.

b) https://github.com/anima-wg/constrained-voucher/pull/69
   Voucher pin considerations

   This adds a diagram about certificate chains and how BRSKI 5.5 says to do
   things, and how that translates to COSE.
   My advice is to put the x5bag in the protected headers, but there are some
   concerns about what things mean.
   We could do some interesting things by assigning semantics to whether
   the certificate is in a protected or unprotected header.  That  might
   not be good.

c) https://github.com/anima-wg/constrained-voucher/pull/67
   clarify BRSKI-EST and BRSKI-MASA protocols

   We did not get to this item.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide