Subject: [Anima] MichaelR: section 5.1.1 question (draft-ietf-anima-autonomic-control-plane-05)

From: Toerless Eckert <[email-masked]>
Date: Mon, 6 Mar 2017 23:00:30 +0100

Michael:

I remember from Berlin that you wanted to suggest a better format/encoding
for the AN domain certificate to indicate a pledge/devices ACP address. I
have not seen a followup re. this item (i apologize in case i have overlooked
an email re. this).

If you still would like to see this improved on,  i would appreciate if you could
try to do this before the dealine (friday) so we can incooperate it.

Cheers
    Toerless

---

From: Michael Richardson <[email-masked]>
Date: Fri, 17 Mar 2017 09:56:04 -0400

Toerless Eckert <[email-masked]> wrote:
    > I remember from Berlin that you wanted to suggest a better
    > format/encoding for the AN domain certificate to indicate a
    > pledge/devices ACP address. I have not seen a followup re. this item (i
    > apologize in case i have overlooked an email re. this).

Hi. sorry to have not replied to your email.

My thought was that we should have an actual subjectAltName otherName
entry.  I had originally proposed defining a new OID for the IID
part of the address, leaving the upper bits up to the RPL PIO.

There are other options are to use the subjectAltName iPAddress choice.
See https://tools.ietf.org/html/rfc5280#section-4.2.1.6

I think that I proposed text that would allocate an EUI64 OID for the
certificate.  (I have operational code using mbedtls (client) and openssl (CA)
to do things using an OID from my ORG_SANDELMAN (46930) PEN.)

If the WG has consensus on this, then I'll dig the text up.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        | network architect  [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [