A Voucher Artifact for Bootstrapping Protocols
RFC 8366

Received changes through RFC Editor sync (changed abstract to 'This document defines a strategy to securely assign a pledge to an owner using an artifact signed, directly or indirectly, by the pledge's manufacturer. This artifact is known as a "voucher".

This document defines an artifact format as a YANG-defined JSON document that has been signed using a Cryptographic Message Syntax (CMS) structure. Other YANG-derived formats are possible. The voucher artifact is normally generated by the pledge's manufacturer (i.e., the Manufacturer Authorized Signing Authority (MASA)).

This document only defines the voucher artifact, leaving it to other documents to describe specialized protocols for accessing it.')

Received changes through RFC Editor sync (changed abstract to 'This document defines a strategy to securely assign a pledge to an
owner using an artifact signed, directly or indirectly, by the
pledge's manufacturer.  This artifact is known as a "voucher".  This document defines an artifact format as a YANG-defined JSON
document that has been signed using a Cryptographic Message Syntax
(CMS) structure.  Other YANG-derived formats are possible.  The
voucher artifact is normally generated by the pledge's manufacturer
(i.e., the Manufacturer Authorized Signing Authority (MASA)).  This document only defines the voucher artifact, leaving it to other
documents to describe specialized protocols for accessing it.')

Received changes through RFC Editor sync (created alias RFC 8366, changed title to 'A Voucher Artifact for Bootstrapping Protocols', changed abstract to 'This document defines a strategy to securely assign a pledge to an owner using an artifact signed, directly or indirectly, by the pledge's manufacturer. This artifact is known as a "voucher".', changed pages to 23, changed standardization level to Proposed Standard, changed state to RFC, added RFC published event at 2018-05-09, changed IESG state to RFC Published)

[Ballot comment]
Some nits, coming from Joe Clarke as OPS DIR reviewer.

Section 2:

Old Text:

The MAS concept is explained in more detail in...

New Text:

The MASA concept is explained in more detail in...

(Note: MAS => MASA)

Old Text:

Registrar  See Join Registrar

New Text:

Registrar:  See Join Registrar

(Note: colon added)

[Ballot comment]
Thanks to the authors and working group participants for their work on this document. I have a somewhat major and handful of minor suggestions for improvement.

The larger comment is: section 5 talks about a variety of potential alternate formats and mentions a couple of techniques that might be used to differentiate among them. I'll note that these techniques relate to MIME types and related data (filename extensions). The fact that *this* document doesn't define a MIME type for the CMS-signed-JSON variant will make it difficult and/or awkward for these future formats to employ these techniques. For example, if I were to define a COSE-signed-CBOR format and say "use HTTP Content-Type header fields to tell this apart from CMS-signed-JSON", I would be in the somewhat odd position of having to define the MIME-type for CMS-signed-JSON in *that* document, or of coming up with a very short update to the anima-voucher document that does nothing other than define its MIME type.

It seems that adding a single sentence to section 5 ("To facilitate these techniques, this document registers a MIME type for CMS-signed JSON in section 8.4") plus a registration of a new MIME type along with its filename extension (e.g., "application/voucher-cms+json" and ".vcj") in that new section 8.4 would make life much easier for anyone who wants to define the alternate formats envisioned by section 5.


Section 2:
      Securely imprinting is a primary focus of this document [imprinting].

This is a pretty awkward citation. Suggest maybe changing it to:
      Securely imprinting is a primary focus of [imprinting].

(It's also not entirely clear that the cited article covers *securely* imprinting, so you may consider rephrasing the sentence entirely)

Section 2:
  Authentication of Join Registrar:  Indicates how the Pledge can
      authenticate the Join Registrar.  This might include an indication
      of the private PKIX (Public Key Infrastructure using X.509) trust
      anchor used by the Registrar, or an indication of a public PKIX
      trust anchor and additional CN-ID or DNS-ID information to
      complete authentication.

I think a citation here to RFC6125 would be helpful to the user in understanding the meaning of CN-ID and DNS-ID.


Section 7.1: I think it would be useful to explicitly point out that a device that might have a MITM registrar could also have an MITM attack against any attempts to use an unauthenticated network protocol (such as NTP) to retrieve a time; and that such network-retreived times cannot be trusted for voucher verification purposes.

[Ballot comment]
Just some editorial comments:

- Abstract: I suspect readers will not understand the meaning of "pledge". The abstract should be understandable without referencing the terminology section.

-4, definition of Assertion Basis" : is "secure root of trust of measurement" a term of art, or a typo?

-7.1, first paragraph: s/understand/understanding

[Ballot comment]
Thank you for addressing Russ' Gen Art comments.  With that, I'm wondering if a recommended signature algorithm should be specified.  This change had the work go from just supporting RSA to including other (and better) choices. 

Thanks,
Kathleen

[Ballot comment]
The document is generally fine, but first references to CN-ID and DNS-ID need a reference to RFC 6125, as these terms are not defined anywhere in the document. X.690 also needs a reference.

Nit In 7.1, first sentence:

has no understand ==> has no understanding

(Via drafts-lastcall@iana.org): IESG/Authors/WG Chairs:

The IANA Services Operator has completed its review of draft-ietf-anima-voucher-05. If any part of this review is inaccurate, please let us know.

The IANA Services Operator understands that, upon approval of this document, there are two actions which we must complete.

First, in the ns registry on the IETF XML registry page located at:

https://www.iana.org/assignments/xml-registry/

a single, new registration will be made as follows:

ID: yang:ietf-voucher
URI: urn:ietf:params:xml:ns:yang:ietf-voucher
Filename: [ TBD-at-registration ]
Reference: [ RFC-to-be ]

Because this registry requires Expert Review [RFC8126] for registration, we've contacted the IESG-designated expert in a separate ticket to request approval. Expert review should be completed before your document can be approved for publication as an RFC.

Second, in the YANG Module Names registry on the YANG Parameters page located at:

https://www.iana.org/assignments/yang-parameters/

a single new, registration will be made as follows:

Name: ietf-voucher
Namespace: urn:ietf:params:xml:ns:yang:ietf-voucher
Prefix: vch
Module:
Reference: [ RFC-to-be ]

The IANA Services Operator understands that these two actions are the only ones required to be completed upon approval of this document.

Note:  The actions requested in this document will not be completed until the document has been approved for publication as an RFC. This message is only to confirm what actions will be performed.


Thank you,

Sabrina Tanamal
IANA Services Specialist

The following Last Call announcement was sent out (ends 2017-10-12):

From: The IESG
To: IETF-Announce
CC: draft-ietf-anima-voucher@ietf.org, anima-chairs@ietf.org, Sheng Jiang , terry.manderson@icann.org, anima@ietf.org, jiangsheng@huawei.com
Reply-To: ietf@ietf.org
Sender:
Subject: Last Call:  (Voucher Profile for Bootstrapping Protocols) to Proposed Standard


The IESG has received a request from the Autonomic Networking Integrated
Model and Approach WG (anima) to consider the following document: - 'Voucher
Profile for Bootstrapping Protocols'
  as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits final
comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2017-10-12. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the beginning of
the Subject line to allow automated sorting.

Abstract


  This document defines a strategy to securely assign a pledge to an
  owner, using an artifact signed, directly or indirectly, by the
  pledge's manufacturer.  This artifact is known as a "voucher".

  The voucher artifact is a YANG-defined JSON document that has (by
  default) been signed using a PKCS#7 structure.  The voucher artifact
  is normally generated by the pledge's manufacturer or delegate (i.e.
  the Manufacturer Authorized Signing Authority).

  This document only defines the voucher artifact, leaving it to other
  documents to describe specialized protocols for accessing it.




The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-anima-voucher/

IESG discussion can be tracked via
https://datatracker.ietf.org/doc/draft-ietf-anima-voucher/ballot/


No IPR declarations have been submitted directly on this I-D.

Document Writeup, template from IESG area on ietf.org, dated August 10, 2017.

draft-ietf-anima-voucher-05 write-up

(1) What type of RFC is being requested (BCP, Proposed Standard, Internet
Standard, Informational, Experimental, or Historic)? Why is this the proper type
of RFC? Is this type of RFC indicated in the title page header?

  Standards Track.  The document defines a strategy to securely assign
  a pledge to an owner, using an artifact signed, directly or indirectly,
  by the pledge's manufacturer.
 
(2) The IESG approval announcement includes a Document Announcement
Write-Up. Please provide such a Document Announcement Write-Up. Recent examples
can be found in the "Action" announcements for approved documents. The approval
announcement contains the following sections:

Technical Summary:
Relevant content can frequently be found in the abstract
and/or introduction of the document. If not, this may be
an indication that there are deficiencies in the abstract
or introduction.

  This document defines a strategy to securely assign a pledge to an
  owner, using an artifact signed, directly or indirectly, by the
  pledge's manufacturer. This artifact is known as a "voucher". This
  document only defines the voucher artifact, leaving it to other
  documents to describe specialized protocols for accessing it.

Working Group Summary:
Was there anything in WG process that is worth noting? For example,
was there controversy about particular points or were there decisions
where the consensus was particularly rough?

  This document was called draft-kwatsen-anima-voucher prior to its
  adoption. There was unanimous support for it in favor of adoption and
  none against), so this document was adopted in January, 2017, as a
  accompanying document along with another ANIMA WG document
  draft-ietf-anima-bootstrapping-keyinfra, which have been adopted in
  Auguest 2015. It is worthy to clarifying that this document is actually
  independent from draft-ietf-anima-bootstrapping-keyinfra. There was
  interest in this work posts since its adoption. There was never any
  opposition for this work.
 
  This document went through a relevant shorter document development
  period (3 months for individual document period, 8 month for WG
  document period). It has been reviewed well.

Document Quality:
Are there existing implementations of the protocol? Have a significant
number of vendors indicated their plan to implement the specification?
Are there any reviewers that merit special mention as having done a
thorough review, e.g., one that resulted in important changes or a
conclusion that the document had no substantive issues? If there was
a MIB Doctor, Media Type or other expert review, what was its course
(briefly)? In the case of a Media Type review, on what date was the
request posted?

  This document went through multiple reviews by multiple WGs (ANIMA,
  6tisch, NETCONF) participants.  And this document went through a
  cross-group WGLC, which did receive comments to help improving the
  document. So far, there is no existing implementations.

Personnel:

Who is the Document Shepherd? Who is the Responsible Area Director?

  Sheng Jiang is the document shepherd.
  Terry Manderson is the responsible AD.
 
(3) Briefly describe the review of this document that was performed by the
Document Shepherd. If this version of the document is not ready for publication,
please explain why the document is being forwarded to the IESG.

  I reviewed this document thorough once for -02 versions (and had
  other minor comments from time to time):
 
  https://www.ietf.org/mail-archive/web/anima/current/msg02585.html 
 
  The issues raised in my reviews were promptly addressed by authors
  in -03 version along with the comments from other ANIMA WG members. 
  This document -05 version is ready for publication in my opinion.
 
(4) Does the document Shepherd have any concerns about the depth or breadth of
the reviews that have been performed?

  No.
 
(5) Do portions of the document need review from a particular or from broader
perspective, e.g., security, operational complexity, AAA, DNS, DHCP, XML, or
internationalization? If so, describe the review that took place.

  No.
 
(6) Describe any specific concerns or issues that the Document Shepherd has with
this document that the Responsible Area Director and/or the IESG should be aware
of? For example, perhaps he or she is uncomfortable with certain parts of the
document, or has concerns whether there really is a need for it. In any event,
if the WG has discussed those issues and has indicated that it still wishes to
advance the document, detail those concerns here.

  There are no outstanding issues.

(7) Has each author confirmed that any and all appropriate IPR disclosures
required for full conformance with the provisions of BCP 78 and BCP 79 have
already been filed. If not, explain why?

  Yes. The authors, Kent Watsen, Michael C. Richardson, Max Pritikin and
  Toerless Eckert have confirmed in writing that they are not aware of any
  IPR, and that any and all appropriate IPR disclosures required for full
  conformance with the provisions of BCP 78 and BCP 79 have already been filed.
 
(8) Has an IPR disclosure been filed that references this document? If so,
summarize any WG discussion and conclusion regarding the IPR disclosures.

  No.
 
(9) How solid is the WG consensus behind this document? Does it represent the
strong concurrence of a few individuals, with others being silent, or does the
WG as a whole understand and agree with it?

  There was broad support for this document. It was reviewed by active WG
  participants.
 
(10) Has anyone threatened an appeal or otherwise indicated extreme discontent?
If so, please summarise the areas of conflict in separate email messages to the
Responsible Area Director. (It should be in a separate email because this
questionnaire is publicly available.)

  No. There was unanimous support for this work and nobody raised any objections.
 
(11) Identify any ID nits the Document Shepherd has found in this document. (See
http://www.ietf.org/tools/idnits/ and the Internet-Drafts
Checklist). Boilerplate checks are not enough; this check needs to be thorough.

  This document is now ID nits clean.
 
(12) Describe how the document meets any required formal review criteria, such
as the MIB Doctor, media type, and URI type reviews.

  No MIB Doctor, media type, URI type or similar apply to this
  document.
 
(13) Have all references within this document been identified as either
normative or informative?

  Yes.

(14) Are there normative references to documents that are not ready for
advancement or are otherwise in an unclear state? If such normative references
exist, what is the plan for their completion?

  No. All normative references are published RFCs.
 
(15) Are there downward normative references references (see RFC 3967)? If so,
list these downward references to support the Area Director in the Last Call
procedure.

  Yes. There are one downard normative references. Normative reference to
  an Informational RFC - RFC 2315, "PKCS #7: Cryptographic Message Syntax
  Version 1.5", which is already in the downref registry
  (https://datatracker.ietf.org/doc/downref/).

(16) Will publication of this document change the status of any existing RFCs?
Are those RFCs listed on the title page header, listed in the abstract, and
discussed in the introduction? If the RFCs are not listed in the Abstract and
Introduction, explain why, and point to the part of the document where the
relationship of this document to the other RFCs is discussed. If this
information is not in the document, explain why the WG considers it unnecessary.

  No. This document does not update any existing RFCs.

(17) Describe the Document Shepherd's review of the IANA considerations section,
especially with regard to its consistency with the body of the document. Confirm
that all protocol extensions that the document makes are associated with the
appropriate reservations in IANA registries. Confirm that any referenced IANA
registries have been clearly identified. Confirm that newly created IANA
registries include a detailed specification of the initial contents for the
registry, that allocations procedures for future registrations are defined, and
a reasonable name for the new registry has been suggested (see RFC 5226).

  IANA is asked to registers a URIs in the IETF XML registry:
  URI: urn:ietf:params:xml:ns:yang:ietf-voucher
 
  IANA is requested to registers a YANG module in the YANG Module Names
  registry: ietf-voucher.
 
  All the necessary information is in the IANA considerations document. It is
  clear enough that the IANA will be able to implement it.
 
(18) List any new IANA registries that require Expert Review for future
allocations. Provide any public guidance that the IESG would find useful in
selecting the IANA Experts for these new registries.

  No such registry is requested in this document.
 
(19) Describe reviews and automated checks performed by the Document Shepherd to
validate sections of the document written in a formal language, such as XML
code, BNF rules, MIB definitions, etc.

  The YANG module has been checked using pyang v1.7.3 abd yanglint 0.12.193.