You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -427,7 +427,7 @@ The {{cBRSKI}} document has defined a version of {{RFC8995}} that is usable over
427
427
This mechanism uses a mobile Registrar agent that works to collect and transfer signed artifacts via physical travel from one network to another.
428
428
429
429
Both {{cBRSKI}} and {{PRM}} require extensions to the Voucher Request and the resulting Voucher. The new Attributes are required to carry the additional data and describe the extended semantics.
430
-
In addition {{cBRSKI}} uses the serialization mechanism described in {{RFC9254}} to produce significantly more compact artifacts.
430
+
In addition, {{cBRSKI}} uses the serialization mechanism described in {{RFC9254}} to produce significantly more compact artifacts.
431
431
432
432
When the process to define {{cBRSKI}} and {{PRM}} was started, there was a belief that the appropriate process was to use the {{RFC7950}} _augment_ mechanism to further extend both the Voucher Request {{RFC8995}} and Voucher {{RFC8366}} artifacts.
433
433
However, {{PRM}} needs to extend an enumerated type with additional values and _augment_ can not do this, so that was initially the impetus for this document.
@@ -449,7 +449,7 @@ The difficulty with this approach is that the semantics of the definitions neede
449
449
The `voucher-request` module definition that was in {{RFC8995}} Sections 3.2 (tree diagram) and 3.4 (YANG module) is now included in this document.
450
450
There is a change to it: the '`idevid-issuer`' Attribute MUST be included in a Registrar Voucher Request (RVR).
451
451
Like the '`serial-number`' value in the RVR, the '`idevid-issuer`' value in the RVR is to be taken from the Pledge's (IDevID) client certificate.
452
-
In some variations of BRSKI, such as {{PRM}}, there is no direct TLS connection between Pledge and Registrar. Therefore the Pledge's IDevID certificate cannot be extracted from the TLS connection, so those variations define a different channel binding process and may deviate from the above requirement.
452
+
In some variations of BRSKI, such as {{PRM}}, there is no direct TLS connection between Pledge and Registrar. Therefore, the Pledge's IDevID certificate cannot be extracted from the TLS connection, so those variations define a different channel binding process and may deviate from the above requirement.
453
453
454
454
A Registrar MUST apply the following rules for the value of the '`idevid-issuer`' Attribute in the given order:
455
455
@@ -790,7 +790,8 @@ Note that {{RFC9254}} does not strictly require use of SIDs: instead of a SID va
790
790
be used. But this would significantly increase the size of the Voucher Data.
791
791
792
792
Instead, a manufacturer MAY use the '`manufacturer-private`' Attribute to put any content they wish.
793
-
In CBOR serialization, if a plain CBOR map would be used, it would be subject to delta encoding: so use of this Attribute requires that the contents are bstr-encoded (Major type 2).
793
+
In CBOR serialization, if a plain CBOR map would be used, it would be subject to delta encoding: so use of this Attribute requires that the contents are bstr-encoded
794
+
{{RFC8949@CBOR, Section 3.1}} (Major type 2).
794
795
In JSON serialization, delta encoding does not get in the way, and the manufacturer MAY use any encoding that is convenient for them, but base64URL encoding {{?RFC4648, Section 5}} is RECOMMENDED.
0 commit comments