Subject: [Anima-bootstrap] Notes 150902-anima-bootstrap.txt

From: Toerless Eckert <[email-masked]>
Date: Wed, 2 Sep 2015 07:42:20 -0700

Participants:
 Kent Watson
 Robert Cragie
 Michael Behringer
 Toerless Eckert

TODO:

  Editors: Max/Michael: can you please communicate on the mailing list
    agenda for the next two weeks, toerless will be on PTO

  Kent - working on updating zeroconf draft

  Toerless: working on finalizing proposal for signaling of ES for ANIMA bootstrap
    (see below)

Notes:

    Kent: work for bootstrap potentially going on in CORE WG
      -> Ask Andy Berman.  Using COMI protocol

    Toerless/Robert: discussing possible signaling mechanism for EST during
       initial bootstrap. Toerless suggesting TCP-proxy (on mailing list),
       Robert explaining past work on other WG, pointing to EAP-TLS/EAP-TTLS

       - EAP-TLS can not be used to exchange EST messages, only initial TSL
         authentication.
       - EAP-TTLS could do this, but no known deployments. Might be intrusive
         if this is the only place where/when EAP is used in ANIMA.
      
       Reporting from Max'es suggestion
         May need to consider to make ANIMA compatible with NAC (Network Access
         Control) framework. Aka: Initially network ports may be closed and
         require 802.1x authentication - this originally lead to the thought
         that enrollment should be via EAP which is part of 802.1x.

         Better modular approach:
         - Make ANIMA devices support 802.1x. Whenever necessary have them
           first authenticate via 802.1x (with their IDevID redential).
         - Other side is then permitting access to a quarantine network
           where ONLY the ANIMA enrollment protocol would be permitted.
         - then run ANIMA enrollment == TCP proxy.

         Need to vet this with NAC experts -> Brian Weis