Subject: [netconf] Adoption-suitability for draft-kwatsen-netconf-sztp-csr

From: Kent Watsen <[email-masked]>
Date: Wed, 5 Aug 2020 22:19:09 +0000

NETCONF WG,

Per the previous email sent moments ago, the chairs would like to solicit input on the following draft:

   Title: Conveying a CSR in an SZTP Bootstrapping Request
   Link: https://tools.ietf.org/html/draft-kwatsen-netconf-sztp-csr
   Abstract:

      This draft extends the "get-bootstrapping-data" RPC defined in
      RFC 8572 to include an optional certificate signing request (CSR),
      enabling a bootstrapping device to additionally obtain an identity
      certificate (e.g., an LDevID, from IEEE 802.1AR) as part of the
      "onboarding information" response provided in the RPC-reply.

In particular, please discuss adoption-suitability as it regards to the following questions:

    1) is the problem important for the NETCONF WG to solve?
    2) is the draft a suitable basis for the work?

PS: this message is itself not an adoption poll, but rather an attempt to gauge interest/support for a potential future adoption poll.

NETCONF Chairs

---

From: Kent Watsen <[email-masked]>
Date: Fri, 7 Aug 2020 21:02:01 +0000

[as a contributor and co-author]

Per the request below:

I believe that it is important to enable the SZTP bootstrapping process to be able to configure an LDevID certificate.  As the presentation mentioned, it is the ONLY way to enable use cases whereby the device must join a dynamically-provisioned network slice.  The ability to do this was requested by a 3rd-party (my co-authors may have more to say about this).

And I believe that the NETCONF WG is the appropriate WG for this work, having defined RFC 8572 (SZTP).

I believe the current version of the draft is a more than a reasonable start.  I would say that it's practically ready for Last Call (all sections were filled in), but I’m aware that my co-authors believe that one or two more CSR-types should be added to reflect real-world CA deployments.

3) regarding Juergen’s questions:

  a) I am willing to substantially review the drafts.
  b) I am willing to contribute to the discussion of any issue.
  c) I plan to implement the technology defined.

Kent

>    Link: https://tools.ietf.org/html/ <https://tools.ietf.org/html/>draft-kwatsen-netconf-sztp-csr
>    Abstract:
> 
> _______________________________________________
> netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf

---

From: Russ Housley <[email-masked]>
Date: Sat, 8 Aug 2020 12:18:48 -0400

>     1) is the problem important for the NETCONF WG to solve?

I believe that it is important to configure an LDevID certificate as part of the bootstrap, and authentication based on the IDevID seems like the most pragmatic way to do so.

>     2) is the draft a suitable basis for the work?

As a co-author I am biased; however, I think this is a good start at the work to be done.  I am aware of one implementation that is underway.

If adopted, I am willing to continue to work on the document as a co-author.

Russ

---

From: Andy Bierman <[email-masked]>
Date: Mon, 10 Aug 2020 12:40:23 -0700

Hi,

I am trying to understand the problem addressed in this draft.
It appears to be a well-constrained enhancement to SZTP to provide
more data in the get-bootstrapping-info RPC.

It is not clear that NETCONF WG is the right place for this draft, but
given the co-authors involved I think it will get sufficient security area
review.

I am willing to review the draft (wrt/ RESTCONF related issues).
I may implement it in the future, but no plans now.

Andy

On Wed, Aug 5, 2020 at 3:19 PM Kent Watsen <[email-masked]> wrote:

> PS: this message is itself not an adoption poll, but rather an attempt to
> gauge interest/support for a potential future adoption poll.
>
> NETCONF Chairs

---

From: Mahesh Jethanandani <[email-masked]>
Date: Mon, 10 Aug 2020 14:58:31 -0700

Hi Andy,

> On Aug 10, 2020, at 12:40 PM, Andy Bierman <[email-masked]> wrote:
> 
> Hi,
> 
> given the co-authors involved I think it will get sufficient security area review.

The charter for NETCONF WG includes ZTP, and this comes as a natural extension of that item. Every WG and draft has to address security considerations, which this draft tries to do, and the co-authors, who are security experts, have agreed to review the draft. Therefore, I feel that NETCONF WG would be a natural place for this draft to progress.

> On Wed, Aug 5, 2020 at 3:19 PM Kent Watsen <[email-masked] <mailto:[email-masked]>> wrote:
> 
> NETCONF WG,
> 
>    Link: https://tools..ietf.org/html/ <https://tools.ietf.org/html/>draft-kwatsen-netconf-sztp-csr
>    Abstract:
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/netconf <https://www.ietf.org/mailman/listinfo/netconf>

Mahesh Jethanandani
[email-masked]

---

From: Guy Fedorkow <[email-masked]>
Date: Thu, 13 Aug 2020 15:00:59 +0000

I think this work is of value.  We've had Local Device ID's defined in
802.1AR for some time, and some organizations interested in using them, but
we have not had any way to create an LDevID key, other than ad-hoc
manufacturer-defined techniques.

  This work would give network operators a vendor-independent automated,
zero-touch mechanism to create local device identity, and I think the draft
outlines a workable approach.

  I think it should go forward.

/guy fedorkow

From: Kent Watsen <[email-masked] <mailto:[email-masked]> >

Subject: [netconf] Adoption-suitability for draft-kwatsen-netconf-sztp-csr

Date: August 5, 2020 at 6:19:09 PM EDT

To: "[email-masked] <mailto:[email-masked]> " <[email-masked]
<mailto:[email-masked]> >

NETCONF WG,

Per the previous email sent moments ago, the chairs would like to solicit
input on the following draft: 

   Link: https://tools.ietf.org/html/
<https://urldefense.com/v3/__https:/tools.ietf.org/html/__;!!NEt6yMaO-gk!XLb
LrNphNGxMj7dyV0cduDtrRfsFpnzdHJ2AK5X3aPB3oacu79Ua8sJYQghsc1P3aEw$>
draft-kwatsen-netconf-sztp-csr
   Abstract:

In particular, please discuss adoption-suitability as it regards to the
following questions:

NETCONF Chairs

 

Juniper Business Use Only

---

From: Sean Turner <[email-masked]>
Date: Mon, 17 Aug 2020 23:16:20 -0400

>   1) is the problem important for the NETCONF WG to solve?

My reading of the charter puts this squarely in scope for the WG. Configuring an LDevID certificate as part of the bootstrap is important and the most straightforward way to do this is authentication based on IDevID.

>   2) is the draft a suitable basis for the work?

I am a wee bit biased as an author I think this is a good a first draft. It would obviously be good to get some additional eyes on it though.

spt

---

From: "Rob Wilton (rwilton)" <[email-masked]>
Date: Tue, 18 Aug 2020 11:14:13 +0000

Hi,

I believe that this draft offers a simple and very useful extension to sztp. It seems to offer a good starting place for this work.

I would like to see IETF to work on this, and given NETCONF standardized the base draft, this seems a reasonable place to work on this.

Regards,
Rob
[As an individual contributor]

From: netconf <[email-masked]> On Behalf Of Kent Watsen
Sent: 05 August 2020 23:19
To: [email-masked]
Subject: [netconf] Adoption-suitability for draft-kwatsen-netconf-sztp-csr

NETCONF WG,

NETCONF Chairs

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 18 Aug 2020 11:27:43 +0000

I read the draft. I am a security person, and despite having had some participation in Netconf for a while, I still consider myself a beginner.

The credentials of Sean and Russ are impeccable. If they say "this is a good way to add certificate requests" then, factually, it is. I don't have to mention Kent's qualifications here. :)

If this fills a need, and at least the authors feel it does, then the WG should adopt this document. It should progress pretty rapidly.

---

From: "Reshad Rahman (rrahman)" <[email-masked]>
Date: Tue, 18 Aug 2020 12:47:05 +0000

I support adoption of this document by NETCONF WG. The problem is an important one to solve.

Regards,
Reshad.

From: netconf <[email-masked]> on behalf of Kent Watsen <[email-masked]>
Date: Wednesday, August 5, 2020 at 6:21 PM
To: "[email-masked]" <[email-masked]>
Subject: [netconf] Adoption-suitability for draft-kwatsen-netconf-sztp-csr

NETCONF WG,

NETCONF Chairs