[Anima] functional differences for constrained voucher

2018-07-24 Thread Michael Richardson
key, while constrained vouchers are (optionally) pinned to a Raw Public Key. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca

Re: [Anima] Revision of scope of MASA in the BRSKI - Reg

2018-07-16 Thread Michael Richardson
and other protocols don't just use a certificate, but they use the related private key to sign part of the transaction. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@san

Re: [Anima] Revision of scope of MASA in the BRSKI - Reg

2018-07-16 Thread Michael Richardson
etwork. So please explain. > On 12.07.18 17:12, Michael Richardson wrote: > Eliot Lear wrote: >> involved. What a manufacturer wants to avoid is a pledge joining a >> network where the MASA just does the logging and does no validation, >> withou

Re: [Anima] Revision of scope of MASA in the BRSKI - Reg

2018-07-16 Thread Michael Richardson
I should post under correct name) How to pick the PANID is not specified yet. Mostly the same as picking an SSID. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@san

Re: [Anima] Revision of scope of MASA in the BRSKI - Reg

2018-07-07 Thread Michael Richardson
the device a second time. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ -- Michael Richardson , Sandelman Software

Re: [Anima] Revision of scope of MASA in the BRSKI - Reg

2018-07-12 Thread Michael Richardson
") that is different from the MASA's desire. The MASA *is* the expression manufacturer's desire. If the manufacturer has sales channel information that indicates the Pledge is on the wrong network, it should not issue a voucher. So the situation you describe makes no sense to me. -- Michael Ri

Re: [Anima] documenting SID usage in IETF specification

2018-09-11 Thread Michael Richardson
rmative way of doing things — the conventions > we use for this may evolve faster than the rest of the technical > content of draft-ietf-core-sid. I don't want a prescription either, but rather a BCP that evolves. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting

Re: [Anima] Proto 41 [Shepherd review draft-ietf-anima-bootstrapping-keyinfra-09]

2018-03-06 Thread Michael Richardson
future values that are not in that registry, a new registry for > values outside the range 0..255 will be needed. "not in that registry", and IPV6=41, is in that registry. While there a bunch which probably are nonsense to use (e.g, PRM) a bunch are relatively clear: SCTP, RDP

Re: [Anima] Proposal of enhancing the BRSKI example scope with CMP

2018-02-28 Thread Michael Richardson
d offices: > Berlin and Munich, Germany; Commercial registries: Berlin > Charlottenburg, HRB 12300, Munich, HRB 6684; WEEE-Reg.-No. DE 23691322 > ___ Anima mailing list > Anima@ietf.org https://www.ietf.org/mailman/listinfo/a

[Anima] BRSKI -- does pledge or registrar create serial-number?

2018-03-15 Thread Michael Richardson
. If section 2.3.1 should be applied on the pledge, then we should perhaps say that more clearly in that section. The VOUCHER YANG says that the field is mandatory. -- Michael Richardson <mcr+i...@sandelman.ca>, Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Descriptio

Re: [Anima] BRSKI discovery implementation report [I-D Action: draft-ietf-anima-bootstrapping-keyinfra-12.txt]

2018-03-15 Thread Michael Richardson
; again? I'm not sure, I thought that the objective-value was what we were looking for. I.e. if some device is trying to find a place to backup 1GB, then it might have an objective of "KERNEL:DUMP" with an objective-value of 1073741824. Since we don't care what the dimension of the objective,

Re: [Anima] An IOT DIR review of draft-ietf-anima-autonomic-control-plane

2018-03-15 Thread Michael Richardson
if we have lot a connection to a parent. The occurance of an IKEv2 negotiation also provides a very strong signal of that there is a new peer. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network ar

[Anima] BRSKI -- does pledge or registrar create serial-number?

2018-03-14 Thread Michael Richardson
. If section 2.3.1 should be applied on the pledge, then we should perhaps say that more clearly in that section. The VOUCHER YANG says that the field is mandatory. -- Michael Richardson <mcr+i...@sandelman.ca>, Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Descriptio

Re: [Anima] I-D Action: draft-ietf-anima-bootstrapping-keyinfra-13.txt

2018-03-27 Thread Michael Richardson
> So I think the "SHOULD NOT" clause has to go. Perhaps you > mean: > This value MUST NOT be used for any future Registration attempt. Edited as you suggest! -- Michael Richardson <mcr+i...@sandelman.ca>, Sandelman Software Works -= IPv6 IoT consulting

Re: [Anima] Shepherd review draft-ietf-anima-bootstrapping-keyinfra-09

2018-03-26 Thread Michael Richardson
ntries in that list? > b) It would be good to create subsections for each registray mentioned so > that one can see from the table of content what registries are impacted. Don't we already have that? We are only creating one registry. > c) Probably need a summary of updates this

Re: [Anima] Shepherd review draft-ietf-anima-bootstrapping-keyinfra-09

2018-03-26 Thread Michael Richardson
Brian E Carpenter <brian.e.carpen...@gmail.com> wrote: > I definitely recommend replacing lower-case "may" in a case like > the one below. Agreed. > Perhaps: >>> , and MUST NOT be >>> enabled unless the JRC indicates support for th

Re: [Anima] Shepherd review draft-ietf-anima-bootstrapping-keyinfra-09

2018-03-26 Thread Michael Richardson
two in an appropriate section > of BRSKI as a very explicit example how BRSKI can be reused outside the > complete ANIMA scope (also add draft-ietf-netconf-zerotouch as an > informational > reference). I would prefer to let ietf-netconf-zerotouch do tha

Re: [Anima] dns-sd [was Shepherd review draft-ietf-anima-bootstrapping-keyinfra-09]

2018-03-26 Thread Michael Richardson
Brian E Carpenter <brian.e.carpen...@gmail.com> wrote: > On 27/03/2018 08:11, Michael Richardson wrote: > ... >> >> > d) Add section to request brksi-proxy and brski-registrar to >> > IANA service name registry. >> >> I

Re: [Anima] BRSKI pledge cert/key/script stuff

2018-03-18 Thread Michael Richardson
should be not be signed in any way. -- Michael Richardson <mcr+i...@sandelman.ca>, Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anima@ietf.org https://www.ietf.org/mailman/listinfo/anima

Re: [Anima] BRSKI pledge cert/key/script stuff

2018-03-18 Thread Michael Richardson
ns the > encoded (signed form) of the Pledge voucher-request. > What is the correct behavior? I've opened this as issue: https://github.com/anima-wg/anima-bootstrap/issues/48 -- Michael Richardson <mcr+i...@sandelman.ca>, Sandelman Software Wo

[Anima] constrained voucher

2018-03-21 Thread Michael Richardson
uchers may be transported in the [I-D.vanderstok-ace-coap-est] protocol. -- Michael Richardson <mcr+i...@sandelman.ca>, Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anim

Re: [Anima] Shepherd review draft-ietf-anima-bootstrapping-keyinfra-09 (part 4?)

2018-03-20 Thread Michael Richardson
e really want people to read 6125, not just guess. > Aka: for the less PKIX/Websecurity initiated readers like me, writing out > what is actually implied could make the sentence easier to parse > (instead of having to read more of RFC6125. But, I want you to read 6

Re: [Anima] "professionally managed" and the reference model

2018-03-01 Thread Michael Richardson
se networks. Am I more likely to use ANIMA than HOMENET protocols in *MY* home? Maybe. That's why we didn't write "home" or "enterprise" networks. Having said this, there is interest in trying to find a way to make BRSKI work in a HOMENET. The problem is that X=JRC, and

Re: [Anima] Proposal of enhancing the BRSKI example scope with CMP

2018-03-01 Thread Michael Richardson
Fries, Steffen <steffen.fr...@siemens.com> wrote: >> <brian.e.carpen...@gmail.com> wrote: >> >> On 01/03/2018 11:46, Michael Richardson wrote: ... >>>> Even though the BRSKI document is already advanced, we would like to >>&

Re: [Anima] Shepherd review draft-ietf-anima-bootstrapping-keyinfra-09

2018-03-03 Thread Michael Richardson
gt; Section 2.4.3) 1) > a) Expand CMC. "authenticate any pledge" -> "authenticate (the IDevID > of) any pledge" > b) The document is still very vague on terminology to distinguish > between the initial bootstrap and the (optional) EST server

Re: [Anima] Shepherd review draft-ietf-anima-bootstrapping-keyinfra-09

2018-03-05 Thread Michael Richardson
N fighting to own h'fe80::1234. It seems to me we would have You are solving a problem that does not exist. You are right that IPIP is inadequately described at this point. If only I was accepting a few dozen github pull requests rather than this hundred page long email... I wonder if we could reme

Re: [Anima] Shepherd review draft-ietf-anima-bootstrapping-keyinfra-09

2018-03-05 Thread Michael Richardson
o say "is". > b) There is no text here explaning how a registrar transforms a Pledge > Voucher request to a Registrar voucher request. If explained later, > insert a forward reference. Else. pls add text to explain. I added some text above. > b) I have my doubts that the flow of the document is ideal wit

Re: [Anima] Shepherd review draft-ietf-anima-bootstrapping-keyinfra-09

2018-03-02 Thread Michael Richardson
ot see how the following sentence is that > relevant conclusion. But maybe i am too confused by the sentence structure. I think that it explains why the voucher exists. > Do you mean something like this: > > | Vouchers are signed but not encrypted. This allows registars to maintai

[Anima] FYI: EST COAP, and enrollment interop list

2018-10-14 Thread Michael Richardson
a public IPv4 and/or IPv6 so that we can get traffic to you. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anima@ietf.org https://www.ietf.org/mailman

[Anima] ship and forget use cases for onboarding

2018-10-22 Thread Michael Richardson
aying, let's not invent a problem before we understand who actually has the problem and make sure that the people who can solve the problem are at our table. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anima@ietf.org https://www.ietf.org/mailman/listinfo/anima

Re: [Anima] Fwd: New Version Notification for draft-lear-brski-pop-00.txt

2018-10-22 Thread Michael Richardson
ip-to-holding-company. Holding company leases to end user for period of time. End user identity is never communicated back, and might be very much pseudonymous. I'm thinking about car-rentals, hotel rooms (full of devices), ... -- ] Never tell me the odds! | ipv6

[Anima] HTTP codes from JRC to Pledge

2018-10-23 Thread Michael Richardson
a document collecting experiences. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anima@ietf.org https://www.ietf.org/mailman/listinfo/anima

[Anima] EST (EST-COAP) usage vs BRSKI

2018-10-23 Thread Michael Richardson
operations if we think it's a good idea to let the connection persist. (Caveat, we might actually want to log the telemetry status operation, and perhaps we always return 200 for that) -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =-

[Anima] early allocation for CT for constrained-vouchers

2018-10-30 Thread Michael Richardson
and while we can use a private CT for now, it would be better if we could sort this out in the next 2 or 3 weeks! -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mai

Re: [Anima] Conclusions on ACP and BRSKI?

2018-11-05 Thread Michael Richardson
3, where it turned to micromanagement...} -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anima@ietf.org https://www.ietf.org/mailman/listinfo/anima

Re: [Anima] I-D Action: draft-ietf-anima-bootstrapping-keyinfra-17.txt

2018-11-05 Thread Michael Richardson
ed devices. Supply chain integration ("know your customer") is an additional step that MASA providers and device vendors can explore. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___

Re: [Anima] I-D Action: draft-vanderstok-constrained-anima-dtls-join-proxy-00.txt

2018-10-05 Thread Michael Richardson
sed. I guess that extension could go into this document. If 6tisch, then it would use enhanced beacons. If something else, TBD. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___

Re: [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16

2018-10-02 Thread Michael Richardson
lain things more? We call the owner's trust controller the "Registrar", or sometimes the Join-Registrar/Coordinator. I don't mind calling it a trust controller, but maybe your term has a different meaning. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =-

Re: [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16

2018-10-02 Thread Michael Richardson
to do it correctly sooner. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anima@ietf.org https://www.ietf.org/mailman/listinfo/anima

Re: [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16

2018-10-02 Thread Michael Richardson
nt could have better text here. At one point we discussed an operational considerations document. Is that really what you are asking for? -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature _

Re: [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16

2018-10-01 Thread Michael Richardson
| ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature ___ Anima mailing l

Re: [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16

2018-10-01 Thread Michael Richardson
. What we are doing is making it clear that the tractor is actually owned, and not p0wned. However, I'm not sure that BRSKI has a value for large devices with real user interfaces. Maybe it has value for implements though. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- s

Re: [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16

2018-10-01 Thread Michael Richardson
s, we do not say how they are used. >> This is a pretty important question and we have discussed it at >> length. I remain concerned, but as far as I can see, we have this >> problem already. > if i understand correctly, it creates a new problem, nee

Re: [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16

2018-10-03 Thread Michael Richardson
the APIs that we need to make it deployable. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anima@ietf.org https://www.ietf.org/mailman/listinfo/anima

Re: [Anima] I-D Action: draft-ietf-anima-bootstrapping-keyinfra-18.txt

2019-01-17 Thread Michael Richardson
added the "reviewer-agrees" label (if github allows), or at least a THUMBS UP (which I'm sure github will allow), or you can unicast us. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Descriptio

[Anima] est-coaps clarification on /att and /crts

2018-12-11 Thread Michael Richardson
w the name of the operator. Note that the later info probably is revealed just by doing the TLS handshake. I think that they should be restricted in general, but I'm concerned that there might be some situation I've missed. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT

Re: [Anima] est-coaps clarification on /att and /crts

2018-12-12 Thread Michael Richardson
henticated /crt and /att? We can certainly add that. I'd like to add this. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anima@ietf.org https://www.ietf.org/m

Re: [Anima] est-coaps clarification on /att and /crts

2018-12-12 Thread Michael Richardson
u agree with the key. You don't know, so you hit ^C. So, that's all. We don't intend to issue certificates... yet. I'm also asking if there is some use case where the client might legitimate need the list of trust anchors (/cacerts request) in order so that it can...? (I couldn't think of a use case

Re: [Anima] unsigned voucher requests in BRSKI

2018-12-13 Thread Michael Richardson
Max Pritikin (pritikin) wrote: > > On Dec 11, 2018, at 3:23 PM, Michael Richardson > > wrote: > > > > > > Panos Kampanakis (pkampana) wrote: > >> I was assuming it was mandatory in the current draft, but I was wrong. As > >> you sugges

Re: [Anima] [Ace] est-coaps clarification on /att and /crts

2018-12-11 Thread Michael Richardson
that it should be restricted. Partly, I'm just not sure where the text should go, or if it needs to be said at all. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima maili

Re: [Anima] est-coaps clarification on /att and /crts

2018-12-11 Thread Michael Richardson
ething in EST-COAPS to explain that we do not see a use case for replying to /crts and /att for clients which are not recognized. Is 401 (4.01) or 403 (4.03) more appropriate do you think? -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sa

Re: [Anima] unsigned voucher requests in BRSKI

2018-12-11 Thread Michael Richardson
glad that we agree that it should be consistent. I'm not convinced it's worth having unsigned pledge requests at all. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailin

Re: [Anima] Iotdir telechat review of draft-ietf-anima-bootstrapping-keyinfra-17

2018-12-13 Thread Michael Richardson
> something about the consequences of a poor random source. It does not > need to be a comprehensive as the section dealing with setting time. I've expanded issue #91: https://github.com/anima-wg/anima-bootstrap/issues/91 > > Minor Concerns: next email. -- Michael Richardson ,

[Anima] gen art issue 7: serial-number in voucher issue #95

2018-11-29 Thread Michael Richardson
serial-number is pretty critical. It goes into the certificate and the MASA uses it as it's primary key. So I'm not really sure how to proceed with this comment. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc De

[Anima] security review issue 11: what if MASA refuses to provide a voucher #88

2018-11-29 Thread Michael Richardson
t's a bug that the MASA can be used to prevent resale. I'd love to resolve the situation, but I don't know how. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anima

[Anima] dealing with many the secdir and genart comments

2018-11-29 Thread Michael Richardson
the Reply-To. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/ | ruby on rails[ -- Michael Richardson , Sandelma

Re: [Anima] Iotdir telechat review of draft-ietf-anima-bootstrapping-keyinfra-17

2018-12-04 Thread Michael Richardson
Thank you Russ! I will turn your comments into issues, attempting to de-duplicate against what we already have. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing

[Anima] a multiplicity of pinned certificates

2018-12-02 Thread Michael Richardson
f we do it quickly. Destinguishing between arrays of 1-element and single-items isn't that difficult in the serializations we have. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@

[Anima] underspecification in handling of unsigned voucher requests

2018-12-03 Thread Michael Richardson
ity' + assertion and associated 'proximity-registrar-cert' need to be + verified to be correct. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list An

Re: [Anima] [Gen-art] dealing with many the secdir and genart comments [on draft-ietf-anima-bootstrapping-keyinfra]

2018-12-03 Thread Michael Richardson
ly. My sense in writing the words was that there were more words needed. But I didn't know what else I could nail down scope-wise, so I stopped. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anima@ietf.org https://www.ietf.org/mailman/listinfo/anima

[Anima] adding pledge-voucher-request for unsigned requests

2018-12-03 Thread Michael Richardson
ed artifact +is include in a base64 format. It is not illegal for attributes +unknown to a registrar to be included by the pledge. + + + +-- pledge-voucher-request? binary -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =-

Re: [Anima] BRSKI support for asynchronous processing

2018-12-02 Thread Michael Richardson
new protocol in the form of extensions to 8366 processing. I think it also requires the Registrar to contact the OASA (overriding the MASA URL in the IDevID), but maybe you have another idea. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- si

Re: [Anima] [Gen-art] dealing with many the secdir and genart comments [on draft-ietf-anima-bootstrapping-keyinfra]

2018-12-02 Thread Michael Richardson
Brian E Carpenter wrote: >> The authors seriously believe that this will result in an attempt to >> boil the ocean. Yes, BRSKI is exciting for many and opens many doors, >> but in the context of the *ANIMA* Charter, we strongly think that this >> document should leave the oceans

Re: [Anima] BRSKI support for asynchronous processing

2018-12-02 Thread Michael Richardson
, leaving the IDevID also available. This seems mechanically easy, but seems to open many issues. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.s

Re: [Anima] BRSKI support for asynchronous processing

2018-12-02 Thread Michael Richardson
ams other than what your IT department expects you to use for email.} -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anima@ietf.org https://www.ietf.org/mailman/listinfo/anima

Re: [Anima] unsigned voucher requests in BRSKI

2018-12-08 Thread Michael Richardson
document that anything of the pledge requests goes upwards. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anima@ietf.org https://www.ietf.org/mailman/listinfo/anima

[Anima] BRSKI use in IoT enrollment

2018-11-29 Thread Michael Richardson
t to renew the liason process from their end. Rüst will be speaking at the https://iotsfconference.com/. I am also presenting, my slides are at: http://www.sandelman.ca/SSW/talks/iotsf2018-brski/ -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael

[Anima] unsigned voucher requests in BRSKI

2018-11-25 Thread Michael Richardson
Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ -- Michael Richardson , Sandelman Software Works -=

Re: [Anima] early allocation for CT for constrained-vouchers

2018-11-20 Thread Michael Richardson
hi, is there any progress on this? Additionally, I thought that I asked for an early allocation of id-mod-MASAURLExtn2016(TBD) from the pkix(7) id-mod(0) Registry. this is for BRSKI, section 7.2. Michael Richardson wrote: > WG chairs, would you please consider asking Ignas and I

Re: [Anima] Fwd: I-D Action: draft-carpenter-limited-domains-03.txt

2018-09-12 Thread Michael Richardson
Brian E Carpenter wrote: > Discussion welcome, perhaps on int-a...@ietf.org. okay, I'll go read the document if it's relevant... but you CC'ed here is the ACP a limited domain? Or does ANIMA make it more practical in some way to support limited domains? -- Michael Richard

[Anima] explainining pinned-domain-subject-public-key-info

2018-09-11 Thread Michael Richardson
internet-dra...@ietf.org wrote: > A new version of I-D, draft-ietf-anima-constrained-voucher-02.txt has > been successfully submitted by Michael Richardson and posted to the > IETF repository. > Diff: > https://www.ietf.org/rfcdiff?url2=draft-ietf-anima-constra

[Anima] documenting SID usage in IETF specification

2018-09-11 Thread Michael Richardson
| | 100,000 | 1,000,000,000 | Specification Required | +-+---++ ^-- seem to be too many zeros -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___

[Anima] lack of clarity on CSR attributes required for ACP use of BRSKI

2019-01-26 Thread Michael Richardson
r than rfc822Name SANs, and I don't think we ever want more than one. I would strongly suggest that maybe we want to do this with CBOR instead. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___

Re: [Anima] I-D Action: draft-ietf-anima-constrained-voucher-03.txt

2019-03-25 Thread Michael Richardson
er Artifacts for Bootstrapping > Protocols Authors : Michael Richardson Peter van der Stok Panos > Kampanakis Filename : draft-ietf-anima-constrained-voucher-03.txt Pages I have slightly rushed to post this -03. The examples are not updated as much as I'd like, and I have three more issues

[Anima] BRSKI -- examples of IDevID with HardwareModuleName

2019-04-03 Thread Michael Richardson
eed to be converted into a serial-number of "type string". The following methods are used depending on the first available IDevID certificate field (attempted in this order): -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consultin

Re: [Anima] ANIMA: re-charter last call (until 4/19/2019)

2019-04-05 Thread Michael Richardson
Other than that, I'm very happy with the charter. I put those edits into the wiki, and I also fixed a few spelling mistakes. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima

Re: [Anima] ANIMA: re-charter last call (until 4/19/2019)

2019-04-07 Thread Michael Richardson
6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature ___ Anima mailing list Anima

[Anima] early allocation of MASA URL OID

2019-02-24 Thread Michael Richardson
OID 1.3.6.1.4.1.46930.2, but will check for both in the Registrar for a few months. (This likely means reworking many example/test IDevIDs over time)} -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature

[Anima] $transport-proto in BRSKI

2019-03-01 Thread Michael Richardson
know why we have a $ on transport-proto. Maybe it's a typo. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails

Re: [Anima] Fwd: I-D Action: draft-carpenter-anima-l2acp-scenarios-00.txt

2019-02-27 Thread Michael Richardson
, or does this mean it uses L2 technologies like MACSEC to create a tunnel for L3 packets? i.e. does L3 multicast appear to just work because it more layer-2 tricks? -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP

Re: [Anima] Fwd: I-D Action: draft-carpenter-anima-l2acp-scenarios-00.txt

2019-02-27 Thread Michael Richardson
t that it's not in scope > for this particular draft. In other words, more IPv4-inspired L2-tricks to maintain the illusion there is a big-blue cable with AUI taps on it. And continued inability to see L2 switches, or creatively route around L2 failures :-) -- Michael Richardson , Sandelman

Re: [Anima] Fwd: I-D Action: draft-carpenter-anima-l2acp-scenarios-00.txt

2019-02-27 Thread Michael Richardson
replacing IPsec with MACsec or another encrypted L2VPN protocol which is already in silicon, right? > As for emulating classic Ethernet, yes, that is how the world works > today in many places. Yes. -- ] Never tell me the odds! | ipv6 mesh networks [

Re: [Anima] Potential Milestones for ANIMA new charter

2019-03-16 Thread Michael Richardson
will need some additional real-world experience. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anima@ietf.org https://www.ietf.org/mailman/listinfo/anima

Re: [Anima] $transport-proto in BRSKI

2019-03-08 Thread Michael Richardson
e $transport-proto above indicates the method... > Otherwise, fwiw I'm happy with bootstrapping-keyinfra-19. I noticed that extra $ when reading the diff, and removed it. I will put them all it back: I found another location where it belongs. -- Michael Richardson , Sandelman Software Wor

Re: [Anima] Latest draft charter text of ANIMA

2019-03-18 Thread Michael Richardson
down) ANIMA rather than recharter it. I recognize that such an action might have negative consequences to how various people are able to participate. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature _

Re: [Anima] Primary ANIMA Agenda for IETF104

2019-03-18 Thread Michael Richardson
co-chairs Perhaps we could subdivide this item into three sub-items so that we can be sure to get through it? Could Toerless post his slides sooner? Is the intent for it to be mostly mic line? -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.as

Re: [Anima] Call for agenda ANIMA @ IETF 104, Prague

2019-03-12 Thread Michael Richardson
; different component than a local domain registrar. In that aspect it > has a different scope than draft-richardson-anima-smarkaklink. I think this discussion should be interesting! -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael

Re: [Anima] I-D Action: draft-ietf-anima-bootstrapping-keyinfra-19.txt

2019-03-07 Thread Michael Richardson
echnology like: https://en.wikipedia.org/wiki/Physical_unclonable_function but ultimately, that's just another way to do TPM, so skirts the question. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consultin

Re: [Anima] Call for agenda ANIMA @ IETF 104, Prague

2019-03-11 Thread Michael Richardson
ver-discovery --> some details are still TBD. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anima@ietf.org https://www.ietf.org/mailman/listinfo/anima

Re: [Anima] proposed anima charter (was; Re: New work item proposal / agenda request)

2019-02-19 Thread Michael Richardson
guess the goal is not to forget it, but not to go down a rathole. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anima@ietf.org https://www.ietf.org/mailman

Re: [Anima] Logging vouchers use case

2019-02-19 Thread Michael Richardson
ganathan >> > >> > >> >> -- >> M. Ranganathan >> ___ >> Anima mailing list >> Anima@ietf.org >> https://www.ietf.org/mailman/listinfo/anima > __

[Anima] implementer question about BRSKI telemetry return(s)

2019-05-17 Thread Michael Richardson
to the MASA that the voucher was accepted by asking for the audit log. That's fine in a success situation, but not as useful in a fail situation. I feel that we are missing something here. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP

Re: [Anima] Pinning of raw public keys in Constrained Vouchers

2019-05-27 Thread Michael Richardson
te the strengh required here. It's a CBOR value, so it has a length, and I suppose we could define a way to truncate the value in a standard direction, and then decide later. I think that a non-truncated hash ought to be as strong as sending the key itself, and having two cod

[Anima] early allocation for id-ct-animaCBORVoucher

2019-05-27 Thread Michael Richardson
op testing that is already ongoing. Can this go to an early allocation? Thank you. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Anima mailing list Anima@ietf.org https://www.ietf.o

[Anima] constrained voucher examples updated --- voucher looks wrong

2019-05-26 Thread Michael Richardson
ng of the registrar's DER encoded certificate, rather than the DER encoding itself. This is clearly wrong, but I do it consistently and tolerantly so I don't notice. I will be fixing this. However, the signature on the resulting object should be correct, even if the contents are semantically wrong

[Anima] Pinning of raw public keys in Constrained Vouchers

2019-05-26 Thread Michael Richardson
PKI encoding, but I suppose an attacker might find a way to prepad with nonsense DER. Please help me decide if this is a useful thing to do. If it's useful, is it useful enough to drop the pinned-domain-subject-key-info? -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consult

Re: [Anima] Pinning of raw public keys in Constrained Vouchers

2019-06-02 Thread Michael Richardson
On 2019-05-26 11:54 p.m., Jim Schaad wrote: Couldn't we send a hash of identity in (2) and (3), and to do this we need a new element in the constrained voucher. This I've given the mouthful name of: proximity-registrar-sha256-of-subject-public-key-info and:

Re: [Anima] teap-brski

2019-06-04 Thread Michael Richardson
would find this acceptable, but perhaps some would not. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails

Re: [Anima] Last Call: (Bootstrapping Remote Secure Key Infrastructures (BRSKI)) to Proposed Standard

2019-06-03 Thread Michael Richardson
Fries, Steffen wrote: > Yes, definitely. This would help. Thanks. https://github.com/anima-wg/anima-bootstrap/blob/master/component-diagram.txt edited, will be in -21. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description:

Re: [Anima] Last Call: (Bootstrapping Remote Secure Key Infrastructures (BRSKI)) to Proposed Standard

2019-06-10 Thread Michael Richardson
Brian E Carpenter wrote: >> Eric Rescorla wrote: >> >> You're right that in theory subdomains are unrealistic examples, but does >> >> that >> >> matter for an illustrative example? >> >> > Why not instead use two domain names that end in .example? E.g., >> >

<    1   2   3   4   5   6   7   8   9   10   >