You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: draft-ietf-anima-rfc8366bis.md
+11-7Lines changed: 11 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -177,8 +177,8 @@ Since {{RFC8366}} was written, the pattern is to publish YANG modules as two doc
177
177
This allows the YANG module to be updated without replacing all of the context.
178
178
This document does not follow that pattern, but future updates may update only the YANG.
179
179
180
-
This document also introduces an experimental mechanism to support future extensions without requiring the YANG module to be replaced.
181
-
This includes both new IETF Standard mechanisms, as well as a facility for manufacturer private extensions.
180
+
This document introduces a mechanism to support future extensions without requiring the YANG module to be replaced.
181
+
This includes both a new IETF standard mechanism for extensions modeled after the mechanism present in {{?RFC8520}}, as well as a facility for manufacturer private extensions.
182
182
183
183
The lifetimes of vouchers may vary.
184
184
In some onboarding protocols, the vouchers may include a nonce restricting them to a single use, whereas the vouchers in other onboarding protocols may have an
@@ -190,7 +190,8 @@ this document include: {{ZERO-TOUCH}}, {{SECUREJOIN}}, {{BRSKI}} and {{cBRSKI}}.
190
190
191
191
# Terminology
192
192
193
-
This document uses the following terms:
193
+
This document uses and defines the following terms.
194
+
They are used in this document and related documents.
194
195
195
196
(Voucher) Artifact:
196
197
: Used throughout to represent the voucher as instantiated in the form
@@ -200,12 +201,14 @@ Bootstrapping:
200
201
: The process where a Pledge obtains cryptographic key material to identify
201
202
and trust future interactions within a specific domain network. Based on imprinted
202
203
key material provided during the manufacturing process (see: Imprint).
204
+
This term was used in {{RFC8366}}, but has been supplanted by the term Onboarding.
203
205
204
206
Domain:
205
207
: The set of entities or infrastructure under common administrative
206
208
control.
207
209
The goal of the onboarding protocol is to enable a Pledge to
208
210
join a domain and obtain domain specific security credentials.
211
+
This term is not related to the similiar DNS term.
209
212
210
213
Imprint:
211
214
: The process where a device obtains the cryptographic key material to
@@ -241,8 +244,9 @@ Malicious Registrar:
241
244
Onboarding:
242
245
: Onboarding describes the process to provide necessary operational data to a Pledge
243
246
and to complete the process of bringing the Pledge into an operational state.
244
-
This data may be configuration data, or also application-specific cryptographic
247
+
This data may include configuration data, but specifically deals with application-specific cryptographic
245
248
key material (application-specific security credentials).
249
+
Since {{RFC8366}}, this term has replaced the term Bootstrapping.
246
250
247
251
Owner:
248
252
: The entity that controls the private key of the trust anchor conveyed by the voucher.
@@ -255,7 +259,7 @@ Pledge:
255
259
manufacturer.
256
260
257
261
Registrar:
258
-
: See join registrar.
262
+
: See Join Registrar. This term is not related to term DNS Registrar {{?RFC9499}}.
259
263
260
264
TOFU (Trust on First Use):
261
265
: When a Pledge makes no security decisions but rather simply
@@ -295,7 +299,7 @@ domain. The specific information a voucher provides is influenced by the
295
299
onboarding use case.
296
300
297
301
The voucher can convey the following information to
298
-
the join registrar and Pledge:
302
+
the Join Registrar and Pledge:
299
303
300
304
Assertion Basis:
301
305
: Indicates the method that protects
@@ -375,7 +379,7 @@ Ownership Audit Voucher:
375
379
Ownership ID Voucher:
376
380
: Named after inclusion of the Pledge's CN-ID or DNS-ID within the
377
381
voucher. The MASA service mitigates a MiTM registrar by identifying
378
-
the specific registrar (via WebPKI) authorized to own the Pledge.
382
+
the specific Registrar (via WebPKI) authorized to own the Pledge.
379
383
380
384
Bearer Voucher:
381
385
: A Bearer Voucher is named after the inclusion of a registrar ID
0 commit comments