Subject: [Anima-bootstrap] AN Group Key

From: Brian E Carpenter <[email-masked]>
Date: Sun, 23 Oct 2016 13:21:06 +1300

This is perhaps a bit of a side track, but is there a way to leverage the
BRSKI registrar to securely distribute a Group Key? If every node in an AN
domain had the same Group Key, we could make GRASP multicast secure.

(I never followed the MSEC work, but it looks mighty complex.)

Regards
   Brian Carpenter

---

From: "Max Pritikin (pritikin)" <[email-masked]>
Date: Mon, 24 Oct 2016 17:32:43 +0000

BRSKI bootstraps a public key identity for the domain. It then rolls into a local certificate distribution but as currently noted in s5.7:

   The prior sections provide functionality for the New Entity to obtain
   a trust anchor representative of the Domain.  The following section
   describe using EST to obtain a locally issued PKI certificate.  The
   New Entity MAY perform alternative enrollment methods or proceed to
   use its IDevID credential indefinately, but those that leverage the
   discovered Registrar to proceed with certificate enrollment MUST
   implement the following EST choices.

The exact wording here could be adjusted. The point is that once the domain trust anchor is bootstrapped a mandatory to implement, or highly recommended interoperable approach, to identifying the device be implemented. 

One could branch off here into a group key method or could distribute the certs and use them to engage with a group key model. 

- max

> On Oct 22, 2016, at 5:21 PM, Brian E Carpenter <[email-masked]> wrote:
> 
> _______________________________________________
> Anima-bootstrap mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/anima-bootstrap

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 25 Oct 2016 07:57:33 +1300

Hi Max,

Thanks. I don't propose anything for now, but maybe this could be an idea for
future work. Since GRASP does rely on link-local multicast, it would be good
to have some idea of how to secure it (if the ACP doesn't take care of
it for us).

Regards
   Brian