Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

proposed text from errata 6648 #151

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open

proposed text from errata 6648 #151

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b880553
proposed text from errata 6648
mcr Feb 20, 2024
c887ece
fix typo
mcr Feb 21, 2024
987e41d
add missing word
mcr Feb 21, 2024
dce7ccf
upcase Registrar
mcr Feb 21, 2024
815339e
upcase registrar
mcr Feb 21, 2024
09521c7
clarify SNI non-use
mcr Feb 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 16 additions & 5 deletions dtbootstrap-anima-keyinfra.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1738,12 +1738,23 @@ locator3 = [O_IPv6_LOCATOR, fe80::1234, 41, nil]]]></artwork>
</t>
<t>
Use of TLS 1.3 (or newer) is encouraged.
TLS 1.2 or newer is REQUIRED on the Pledge side.
TLS 1.3 (or newer) SHOULD be available on the Registrar server interface,
and the Registrar client interface, but TLS 1.2 MAY be used.
TLS 1.3 (or newer) SHOULD be available on the MASA server interface, but TLS
1.2 MAY be used.
TLS 1.2 or newer is REQUIRED on the pledge side.
TLS 1.3 (or newer) SHOULD be available on the registrar server
interface, and the registrar client interface, but TLS 1.2 MAY
be used.
When TLS 1.3 is used the use of Server Name Indicator (SNI,
mcr marked this conversation as resolved.
Show resolved Hide resolved
<xref target="RFC6066" />) is not required, per <xref
target="RFC8446" /> section 9.2, this
mcr marked this conversation as resolved.
Show resolved Hide resolved
specification is an application profile specification.
Copy link
Member Author

@mcr mcr Feb 20, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
When TLS 1.3 is used the use of Server Name Indicator (SNI,
<xref target="RFC6066" />) is not required, per <xref
target="RFC8446" /> section 9.2, this
specification is an application profile specification.
While the use of a Server Name Indication (SNI) is not required per this (<xref target="RFC8446" />, Section 9.2) application profile specification, pledges MAY include one.
Registrars MUST ignore any SNI that they see.

(This aligns with BRSKI-CLOUD needs)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggesting to change to "Server Name Indication (SNI)" (i.e. use the official term) and to use lowercase on "application profile specification" and for "pledges". (Conforms to RFC 8995 caps use)

We can also commit this suggestion soon to allow further wordsmithing.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

( I can't commit my own suggestion, it seems)

</t>

<t>
A pledge connects to the Registrar using only an IP address and it will
mcr marked this conversation as resolved.
Show resolved Hide resolved
not have any idea of a correct SNI value.
This also implies that the Registrar interface may not be virtual
mcr marked this conversation as resolved.
Show resolved Hide resolved
hosted using SNI.
mcr marked this conversation as resolved.
Show resolved Hide resolved
</t>

<t>
Establishment of the BRSKI-EST TLS connection is as
specified in EST <xref target="RFC7030"/> section 4.1.1 "Bootstrap
Expand Down