Bootstrapping Remote Secure Key Infrastructures (BRSKI)
draft-richardson-anima-brski-renamed-00
|
Document |
Type |
|
Active Internet-Draft (individual)
|
|
Authors |
|
Max Pritikin
,
Michael Richardson
,
Toerless Eckert
,
Michael Behringer
,
Kent Watsen
|
|
Last updated |
|
2020-08-11
|
|
Stream |
|
(None)
|
|
Intended RFC status |
|
(None)
|
|
Formats |
|
plain text
html
xml
pdf
htmlized (tools)
htmlized
bibtex
|
|
Yang Validation |
|
☯
0 errors, 0 warnings.
draft-richardson-anima-brski-renamed-00.txt:
xym 0.4.10:
Extracting 'ietf-voucher-request@2018-02-14.yang'
Removed 0 empty lines
Extracting 'proxygrasp.cddl'
Extracting 'jrcgrasp.cddl'
Extracting 'auditlog.cddl'
Extracting 'enrollstatus.cddl'
Extracting 'vendor.key'
Extracting 'vendor.cert'
Extracting 'masa.key'
Extracting 'masa.cert'
Extracting 'ownerca_secp384r1.key'
Extracting 'ownerca_secp384r1.cert'
Extracting 'jrc_prime256v1.key'
Extracting 'jrc_prime256v1.cert'
Extracting 'idevid_00-D0-E5-F2-00-02.key'
Extracting 'idevid_00-D0-E5-F2-00-02.cert'
Extracting 'vr_00-D0-E5-F2-00-02.b64'
Extracting 'parboiled_vr_00-D0-E5-F2-00-02.b64'
Extracting 'voucher_00-D0-E5-F2-00-02.b64'
ietf-voucher-request@2018-02-14.yang:
pyang 2.4.0: pyang --verbose --ietf -p {libs} {model}:
# module search path: a/www/ietf-ftp/yang/rfcmod/:/a/www/ietf-ftp/yang/draftmod/:/a/www/ietf-ftp/yang/ianamod/:/a/www/ietf-ftp/yang/catalogmod/:.:/var/lib/wwwrun/yang/modules:/a/www/ietf-datatracker/7.24.0/env/share/yang/modules
# read ietf-voucher-request@2018-02-14.yang (CL)
# read /a/www/ietf-ftp/yang/rfcmod/ietf-restconf.yang
# read /a/www/ietf-datatracker/7.24.0/env/share/yang/modules/ietf/ietf-restconf.yang
# read /a/www/ietf-datatracker/7.24.0/env/share/yang/modules/ietf/ietf-voucher.yang
# read /a/www/ietf-ftp/yang/rfcmod/ietf-voucher@2018-05-09.yang
# read /a/www/ietf-datatracker/7.24.0/env/share/yang/modules/ietf/ietf-yang-types.yang
# read /a/www/ietf-ftp/yang/catalogmod/ietf-yang-types@2020-07-06.yang
yanglint SO 1.6.7: yanglint --verbose -p {tmplib} -p {rfclib} -p {draftlib} -p {ianalib} -p {cataloglib} {model} -i:
No validation errors
|
|
Additional Resources |
|
|
Stream |
Stream state |
|
(No stream defined) |
|
Consensus Boilerplate |
|
Unknown
|
|
RFC Editor Note |
|
(None)
|
IESG |
IESG state |
|
I-D Exists
|
|
Telechat date |
|
|
|
Responsible AD |
|
(None)
|
|
Send notices to |
|
(None)
|
ANIMA WG M. Pritikin
Internet-Draft Cisco
Intended status: Standards Track M. Richardson
Expires: 12 February 2021 Sandelman
T.T.E. Eckert
Futurewei USA
M.H. Behringer
K.W. Watsen
Watsen Networks
11 August 2020
Bootstrapping Remote Secure Key Infrastructures (BRSKI)
draft-richardson-anima-brski-renamed-00
Abstract
This document specifies automated bootstrapping of an Autonomic
Control Plane. To do this a Secure Key Infrastructure is
bootstrapped. This is done using manufacturer-installed X.509
certificates, in combination with a manufacturer's authorizing
service, both online and offline. We call this process the
Bootstrapping Remote Secure Key Infrastructure (BRSKI) protocol.
Bootstrapping a new device can occur using a routable address and a
cloud service, or using only link-local connectivity, or on limited/
disconnected networks. Support for deployment models with less
stringent security requirements is included. Bootstrapping is
complete when the cryptographic identity of the new key
infrastructure is successfully deployed to the device. The
established secure connection can be used to deploy a locally issued
certificate to the device as well.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
Pritikin, et al. Expires 12 February 2021 [Page 1]
Internet-Draft BRSKI August 2020
This Internet-Draft will expire on 12 February 2021.
Copyright Notice
Copyright (c) 2020 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Simplified BSD License text
as described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 5
1.1. Prior Bootstrapping Approaches . . . . . . . . . . . . . 6
1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 8
1.3. Scope of solution . . . . . . . . . . . . . . . . . . . . 11
1.3.1. Support environment . . . . . . . . . . . . . . . . . 11
1.3.2. Constrained environments . . . . . . . . . . . . . . 11
1.3.3. Network Access Controls . . . . . . . . . . . . . . . 12
1.3.4. Bootstrapping is not Booting . . . . . . . . . . . . 12
1.4. Leveraging the new key infrastructure / next steps . . . 12
1.5. Requirements for Autonomic Network Infrastructure (ANI)
devices . . . . . . . . . . . . . . . . . . . . . . . . . 13
2. Architectural Overview . . . . . . . . . . . . . . . . . . . 13
2.1. Behavior of a Pledge . . . . . . . . . . . . . . . . . . 15
2.2. Secure Imprinting using Vouchers . . . . . . . . . . . . 16
2.3. Initial Device Identifier . . . . . . . . . . . . . . . . 17
2.3.1. Identification of the Pledge . . . . . . . . . . . . 18
2.3.2. MASA URI extension . . . . . . . . . . . . . . . . . 18
2.4. Protocol Flow . . . . . . . . . . . . . . . . . . . . . . 20
2.5. Architectural Components . . . . . . . . . . . . . . . . 23
2.5.1. Pledge . . . . . . . . . . . . . . . . . . . . . . . 23
2.5.2. Join Proxy . . . . . . . . . . . . . . . . . . . . . 23
2.5.3. Domain Registrar . . . . . . . . . . . . . . . . . . 23
Show full document text