Hi all,
I just submitted an update of BRSKI-PRM (04). It addresses several of the
comments we received from Esko's review and some more:
* addressed #41, #48, #49, #32
* addressed issue #40, 58, 57, 56, 52
* addressed issues #60, 30, 29, 38, 37, 34, 30, 24, 25, 26, 28, 53
* Simplified YANG definition by augmenting the voucher request from RFC
8995 instead of redefining it.
* Added explanation for terminology "endpoint" used in this document, issue
#16
* Added clarification that registrar-agent may collect PVR or PER or both
in one run, issue #17
* Added a statement that nonceless voucher may be accepted, issue #18
* Simplified structure in section Section 3.1, issue #19
* Removed join proxy in Figure 1 and added explanatory text, issue #20
* Added description of pledge-CAcerts endpoint plus further handling
of providing a wrapped CA certs response to the pledge in section
Section 5.5.3; also added new required registrar endpoint (section
Section 5.5.2 and IANA considerations) for the registrar to
provide a wrapped CA certs response, issue #21
* utilized defined abbreviations in the document consistently, issue#22
* Reworked text on discovery according to issue #23 to clarify scope and
handling
* Added several clarifications based on review comments
We will address the remaining issues in the next version of the document.
Best regards
Steffen
-----Original Message-----
From: [email protected] <[email protected]>
Sent: Freitag, 8. Juli 2022 17:21
To: Michael C. Richardson <[email protected]>; Eliot Lear <[email protected]>;
Michael Richardson <[email protected]>; Fries, Steffen (T CST)
<[email protected]>; Werner, Thomas (T CST SEA-DE)
<[email protected]>
Subject: New Version Notification for draft-ietf-anima-brski-prm-04.txt
A new version of I-D, draft-ietf-anima-brski-prm-04.txt has been successfully
submitted by Steffen Fries and posted to the IETF repository.
Name: draft-ietf-anima-brski-prm
Revision: 04
Title: BRSKI with Pledge in Responder Mode (BRSKI-PRM)
Document date: 2022-07-08
Group: anima
Pages: 61
URL:
https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Farchive%2Fid%2Fdraft-ietf-anima-brski-prm-04.txt&data=05%7C01%7Csteffen.fries%40siemens.com%7C99e6df4cdb294b1a50ba08da60f57a12%7C38ae3bcd95794fd4addab42e1495d55a%7C1%7C0%7C637928904745433420%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=PwQR0lY%2FglpGlvUjmQY6sWHXOj9ZygM0VPqwN87VP0o%3D&reserved=0
Status:
https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-anima-brski-prm%2F&data=05%7C01%7Csteffen.fries%40siemens.com%7C99e6df4cdb294b1a50ba08da60f57a12%7C38ae3bcd95794fd4addab42e1495d55a%7C1%7C0%7C637928904745433420%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=zSqZkfcbIYoBFgv3GYXwr7Ds6sZCbAJfDUWezexVCWg%3D&reserved=0
Htmlized:
https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-anima-brski-prm&data=05%7C01%7Csteffen.fries%40siemens.com%7C99e6df4cdb294b1a50ba08da60f57a12%7C38ae3bcd95794fd4addab42e1495d55a%7C1%7C0%7C637928904745433420%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=8UnQMS9eh1WN0yJHWtw%2Bex7e%2BKQrAiJ3FYlms13IYPE%3D&reserved=0
Diff:
https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Frfcdiff%3Furl2%3Ddraft-ietf-anima-brski-prm-04&data=05%7C01%7Csteffen.fries%40siemens.com%7C99e6df4cdb294b1a50ba08da60f57a12%7C38ae3bcd95794fd4addab42e1495d55a%7C1%7C0%7C637928904745433420%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=INvov4I0Dy83Zj04QH2uTlbKmzQeyqsmRqKEv4I%2BBs8%3D&reserved=0
Abstract:
This document defines enhancements to bootstrapping a remote secure
key infrastructure (BRSKI, [RFC8995]) to facilitate bootstrapping in
domains featuring no or only timely limited connectivity between a
pledge and the domain registrar. It specifically targets situations,
in which the interaction model changes from a pledge-initiator-mode,
as used in BRSKI, to a pledge-responder-mode as described in this
document. To support both, BRSKI-PRM introduces a new registrar-
agent component, which facilitates the communication between pledge
and registrar during the bootstrapping phase. For the establishment
of a trust relation between pledge and domain registrar, BRSKI-PRM
relies on the exchange of authenticated self-contained objects
(signature-wrapped objects). The defined approach is agnostic
regarding the utilized enrollment protocol, deployed by the domain
registrar to communicate with the Domain CA.
The IETF Secretariat
_______________________________________________
Anima mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/anima
