A Voucher Artifact for Bootstrapping Protocols
RFC 8366
|
| Document |
Type |
|
RFC - Proposed Standard
(May 2018; No errata)
|
|
Last updated |
|
2018-05-22
|
|
Replaces |
|
draft-kwatsen-anima-voucher
|
|
Stream |
|
IETF
|
|
Formats |
|
plain text
pdf
html
bibtex
|
|
Reviews |
|
|
|
Additional URLs |
|
|
| Stream |
WG state
|
|
Submitted to IESG for Publication
|
|
Document shepherd |
|
Sheng Jiang
|
|
Shepherd write-up |
|
Show
(last changed 2017-08-27)
|
| IESG |
IESG state |
|
RFC 8366 (Proposed Standard)
|
|
Consensus Boilerplate |
|
Yes
|
|
Telechat date |
|
|
|
Responsible AD |
|
Terry Manderson
|
|
Send notices to |
|
"Sheng Jiang" <jiangsheng@huawei.com>
|
| IANA |
IANA review state |
|
IANA OK - Actions Needed
|
|
IANA action state |
|
RFC-Ed-Ack
|
Internet Engineering Task Force (IETF) K. Watsen
Request for Comments: 8366 Juniper Networks
Category: Standards Track M. Richardson
ISSN: 2070-1721 Sandelman Software
M. Pritikin
Cisco Systems
T. Eckert
Huawei
May 2018
A Voucher Artifact for Bootstrapping Protocols
Abstract
This document defines a strategy to securely assign a pledge to an
owner using an artifact signed, directly or indirectly, by the
pledge's manufacturer. This artifact is known as a "voucher".
This document defines an artifact format as a YANG-defined JSON
document that has been signed using a Cryptographic Message Syntax
(CMS) structure. Other YANG-derived formats are possible. The
voucher artifact is normally generated by the pledge's manufacturer
(i.e., the Manufacturer Authorized Signing Authority (MASA)).
This document only defines the voucher artifact, leaving it to other
documents to describe specialized protocols for accessing it.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 7841.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
https://www.rfc-editor.org/info/rfc8366.
Watsen, et al. Standards Track [Page 1]
RFC 8366 Voucher Profile May 2018
Copyright Notice
Copyright (c) 2018 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Requirements Language . . . . . . . . . . . . . . . . . . . . 5
4. Survey of Voucher Types . . . . . . . . . . . . . . . . . . . 5
5. Voucher Artifact . . . . . . . . . . . . . . . . . . . . . . 7
5.1. Tree Diagram . . . . . . . . . . . . . . . . . . . . . . 8
5.2. Examples . . . . . . . . . . . . . . . . . . . . . . . . 8
5.3. YANG Module . . . . . . . . . . . . . . . . . . . . . . . 9
5.4. CMS Format Voucher Artifact . . . . . . . . . . . . . . . 15
6. Design Considerations . . . . . . . . . . . . . . . . . . . . 16
6.1. Renewals Instead of Revocations . . . . . . . . . . . . . 16
6.2. Voucher Per Pledge . . . . . . . . . . . . . . . . . . . 17
7. Security Considerations . . . . . . . . . . . . . . . . . . . 17
7.1. Clock Sensitivity . . . . . . . . . . . . . . . . . . . . 17
7.2. Protect Voucher PKI in HSM . . . . . . . . . . . . . . . 17
7.3. Test Domain Certificate Validity When Signing . . . . . . 17
7.4. YANG Module Security Considerations . . . . . . . . . . . 18
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 18
8.1. The IETF XML Registry . . . . . . . . . . . . . . . . . . 18
8.2. The YANG Module Names Registry . . . . . . . . . . . . . 19
8.3. The Media Types Registry . . . . . . . . . . . . . . . . 19
8.4. The SMI Security for S/MIME CMS Content Type Registry . . 20
9. References . . . . . . . . . . . . . . . . . . . . . . . . . 20
9.1. Normative References . . . . . . . . . . . . . . . . . . 20
9.2. Informative References . . . . . . . . . . . . . . . . . 21
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 23
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 23
Watsen, et al. Standards Track [Page 2]
RFC 8366 Voucher Profile May 2018
Show full document text