Dear all, We just updated BRSKI-PRM to address review comments from SECDIR, GenART and DNSDIR as well as the IANA Expert review: - addressed nits received from the GenART review - addressed comment from IANA to update contact for service name registration from IESG to IETF Chair in Section 10.2 - SECDIR review: included reasoning for short lived certificates in Section 6.1 - SECDIR review: enhanced reasoning for optional TLS usage in Section 7.1 - SECDIR review: added hint for handling if the accept header is not used in Section 7.1 and Section 7.2 - SECDIR review: added hint for response body encoding in Section 7.1 and Section 7.2 - SECDIR review: added hint regarding IDevID and LDevID validity in Section 9 - DNSDIR review: renamed Section 10.2 to Service Name and Transport Protocol Port Number Registry - from IANA expert review: included registered service names in headings
Best regards Steffen -----Original Message----- From: internet-dra...@ietf.org <internet-dra...@ietf.org> Sent: Tuesday, February 11, 2025 6:16 PM To: Michael C. Richardson <mcr+i...@sandelman.ca>; Eliot Lear <l...@cisco.com>; Michael Richardson <mcr+i...@sandelman.ca>; Fries, Steffen (FT RPD CST) <steffen.fr...@siemens.com>; Werner, Thomas (FT RPD CST SEA-DE) <thomas-wer...@siemens.com> Subject: New Version Notification for draft-ietf-anima-brski-prm-18.txt A new version of Internet-Draft draft-ietf-anima-brski-prm-18.txt has been successfully submitted by Steffen Fries and posted to the IETF repository. Name: draft-ietf-anima-brski-prm Revision: 18 Title: BRSKI with Pledge in Responder Mode (BRSKI-PRM) Date: 2025-02-11 Group: anima Pages: 117 URL: https://www.ietf.org/archive/id/draft-ietf-anima-brski-prm-18.txt Status: https://datatracker.ietf.org/doc/draft-ietf-anima-brski-prm/ HTML: https://www.ietf.org/archive/id/draft-ietf-anima-brski-prm-18.html HTMLized: https://datatracker.ietf.org/doc/html/draft-ietf-anima-brski-prm Diff: https://author-tools.ietf.org/iddiff?url2=draft-ietf-anima-brski-prm-18 Abstract: This document defines enhancements to Bootstrapping a Remote Secure Key Infrastructure (BRSKI, RFC8995) to enable bootstrapping in domains featuring no or only limited connectivity between a pledge and the domain registrar. It specifically changes the interaction model from a pledge-initiated mode, as used in BRSKI, to a pledge- responding mode, where the pledge is in server role. For this, BRSKI with Pledge in Responder Mode (BRSKI-PRM) introduces new endpoints for the Domain Registrar and pledge, and a new component, the Registrar-Agent, which facilitates the communication between pledge and registrar during the bootstrapping phase. To establish the trust relation between pledge and registrar, BRSKI-PRM relies on object security rather than transport security. The approach defined here is agnostic to the enrollment protocol that connects the domain registrar to the Key Infrastructure (e.g., domain CA). The IETF Secretariat _______________________________________________ Anima mailing list -- anima@ietf.org To unsubscribe send an email to anima-le...@ietf.org
