Subject: [Iot-onboarding] How to locate the EST server on a network?

From: "M. Ranganathan" <[email-masked]>
Date: Tue, 14 Jan 2020 11:55:04 -0500

Hello,

I am experimenting with EST. How does a device find the address of the
EST server on a network so it can do a "simple enroll" ?

Thanks,

Ranga

-- 
M. Ranganathan

---

From: Toerless Eckert <[email-masked]>
Date: Tue, 14 Jan 2020 18:37:28 +0100

EST is not an automated secure enrollment protocol. Thats the one key piece
missing from it, and the reason why we are writing the BRSKI
specification effectively extends EST with automated enrollment.

EST is sufficient for secure automated renewal / key rollover, but
only for insecure automated initial enrolment. For secure automated
enrolment you would need BRSKI.

If you want to use BRSKI, you would use the DNS-SD service name
brski-registrar, see BRSKI draft section 8.6. If you just want to
do EST alone (again, that would only result in insecure "duckling"
initial enrolment but sufficient for renewal/rekeying), the
service name in DNS is "est". The ACP draft specifies the service
names for discovery via GRASP, which i guess might not be your
fist choice outside of ANIMA today ;-).

Beyond that, there are no standardized discovery mechanisms for
EST/BRSKI registrar AFAIK, but i think setting up DNS-SD RRs is
also today the most easily done service registration mechanism.
I wouldn't recommend hacking around with DHCP anymore for this
unless you must support a system setup without DNS available.

Cheers
    Toerless

On Tue, Jan 14, 2020 at 11:55:04AM -0500, M. Ranganathan wrote:
> Iot-onboarding mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/iot-onboarding

-- 
---
[email-masked]

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 15 Jan 2020 07:44:03 +1300

Hi Ranga,

> The ACP draft specifies the service

Definitely not for production. But for pure experimentation, if you like, it wouldn't be hard to put some code together, if you don't have a DNSSD option and you do enjoy Python hacking. Let me know if you want to do that, because I've written very similar code already.

Regards
   Brian Carpenter

---

From: Michael Richardson <[email-masked]>
Date: Tue, 14 Jan 2020 16:20:01 -0500

Toerless Eckert <[email-masked]> wrote:
    > brski-registrar, see BRSKI draft section 8.6. If you just want to do
    > EST alone (again, that would only result in insecure "duckling" initial
    > enrolment but sufficient for renewal/rekeying), the service name in DNS
    > is "est". The ACP draft specifies the service names for discovery via
    > GRASP, which i guess might not be your fist choice outside of ANIMA
    > today ;-).

DNS-SD is an optional thing for BRSKI!
The MTI is a GRASP DULL message to find the join proxy.

If you don't have a device->network trust issue (because your wires carry
implicit trust), then you can use EST with IDevID to do enrollment of an LDevID.
DNS-SD is a very good way.

Owen and Rifaat's Cloud Registrar document provides a number of other
interesting options too.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-