From nobody Tue May 11 05:52:13 2021 Return-Path: X-Original-To: iotops@ietf.org Delivered-To: iotops@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 43E063A16CD; Tue, 11 May 2021 05:52:02 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Meeting Session Request Tool To: Cc: alexey.melnikov@isode.com, iotops-chairs@ietf.org, iotops@ietf.org, warren@kumari.net X-Test-IDTracker: no X-IETF-IDTracker: 7.28.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <162073752226.5565.12193274947600626607@ietfa.amsl.com> Date: Tue, 11 May 2021 05:52:02 -0700 Archived-At: Subject: [Iotops] iotops - New Meeting Session Request for IETF 111 X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 May 2021 12:52:11 -0000 A new meeting session request has just been submitted by Alexey Melnikov, a Chair of the iotops working group. --------------------------------------------------------- Working Group Name: IOT Operations Area Name: Operations and Management Area Session Requester: Alexey Melnikov Number of Sessions: 1 Length of Session(s): 1 Hour Number of Attendees: 100 Conflicts to Avoid: Chair Conflict: dmarc emailcore opsawg extra jmap Technology Overlap: ace anima cbor core drip lake lpwan lwig roll suit teep 6lo 6tisch Key Participant Conflict: rats People who must be present: Alexey Melnikov Warren "Ace" Kumari Henk Birkholz Resources Requested: Special Requests: --------------------------------------------------------- From nobody Thu May 13 17:22:55 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1BA933A1A41; Thu, 13 May 2021 17:22:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xbbqauy93p7u; Thu, 13 May 2021 17:22:49 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C5273A1A3F; Thu, 13 May 2021 17:22:49 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 509923913F; Thu, 13 May 2021 20:31:54 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id dKfuYomuPoCj; Thu, 13 May 2021 20:31:53 -0400 (EDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id DDE1B39132; Thu, 13 May 2021 20:31:52 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 63FE5688; Thu, 13 May 2021 20:22:46 -0400 (EDT) From: Michael Richardson To: "Salz\, Rich" , "uta\@ietf.org" , iotops@ietf.org, anima@ietf.org In-Reply-To: <42739D1C-004F-4DAD-8023-8E9731B46E05@cisco.com> References: <413CBCFE-1FDF-458E-9F0E-E3D58F86E5D9@bluepopcorn.net> <8A41ED29-2448-4633-AC45-33DE98A6BC81@akamai.com> <7B51BB81-1C9D-4B2F-AF83-1E528E620AE7@cisco.com> <42739D1C-004F-4DAD-8023-8E9731B46E05@cisco.com> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: [Iotops] BRSKI and IDevID (non-!)issues with draft-ietf-uta-use-san X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 May 2021 00:22:54 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I read the document before it was adopted (before SECDISPATCH), and I didn't see any problems with it. I have re-read it in the context of IoT or enterprise (routers) devices that might contain long-lived IDevID (sometimes called Manufacturer Installed Certificates, confusingly appreviated "MIC"). CISCO calls them Secure Unique Device Identifier (SUDI), and there are many other manufacturers with their own interesting names. I believe that the CHIP/MATTER effort also mandates such a thing for the purposes of identity and device attestation. In BRSKI (about to be RFC8995) TLS connections are initiated from a client (the pledge) to a Registrar. The TLS connections make use of ClientCertificates for identification. RFC6125 rules are not relevant to validation of the client certificate. If a CN=3D, emailAddress=3D or DC=3D was present in the ClientCertificate i= t would not be used as part of the validation in a compliant Registrar. The Registrar cares about the X520SerialNumber (aka "serialNumber=3D") only. In the other direction, the pledge does not initially validate the Registrar ServerCertificate at all. It is taken as given, provisionally, until such time as the pledge gets corroboration from an RFC8366 voucher. In general, the Registrar certificate is issued from a private (enterprise) PKI, and the corroboration depends upon a sales relationship with the vendor (the MASA). RFC6125 DNS-ID validations may occur in the MASA, depending upon policy. The new rules from use-san should apply without a problem, if any 6125 validation (vs explicit pinning) was used. The Registrar->MASA connection is already explicitely RFC6125 DNS-ID only. In summary, I don't see anything in use-san that will affect BRSKI. It may be that Cisco and other manufacturers use their certificates in other ways, and I can't speak for whether they might be affected. Some nits: > While not discussed in [RFC6125] this section also implicitly > prohibits the use of the Domain Component or emailAddress RDN's. 1) it seems like, since it's mentioned here, that it's not "implicit" at al= l. It seems rather explicit to me. 2) I think that the deprecation of a sequence of "DC=3D" probably warrants a sentence of its own. 3) I'm unclear how emailAddress was used when a DNS name was desired. Were there rules that allowed the client to say, "connect to example.com" and then validation was okay if the certificate says emailAddress=3Dfoo@= example.com? If so, then I think that this situation should be more clearly deprecate= d. 4) I suggest that section 3 "The New Rules" should be in positive language only. Most of the language is what not to do. I think that this is important to list, but I suggest it be split up into a section "Do this" and a section "Do not do this" =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmCdwtYACgkQgItw+93Q 3WUaZwgAl+cYXQIHF+OOqXDX6IFeRCt8xEMtcimiB3MVqy9INareZeVAk0EfuAqO rAIYDb/wOoigFvqVHkVVH39Ape6j1jtJwi50LFXAj1fHR0K8f5evKrtJAyIKGvX8 /CH9jbIMxT8cWOw7lvaQg8GjJuOCMLdDf2U52rCKWUj7zgTzc2FFW9sTwSi776SQ dEI6KBQcdqpY03m1CTY5AvJ9YWasZDrG3p1ZeajsXp/v7c9OvZK3IPMmYMjJDPqk iOAYFDnZCDvhtYx/N/vMhqZnXhCQcp+uhbEJ4SH7FdhK6FMfIvgjVTF9ktb5e+k+ rcnQEpy82KXFProRDRolduUavHc6pA== =Ufqq -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu May 13 17:39:21 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DEC573A1AC4; Thu, 13 May 2021 17:39:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bQHzR_zmTaju; Thu, 13 May 2021 17:39:16 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8B5143A1ABD; Thu, 13 May 2021 17:39:16 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 53B4538980; Thu, 13 May 2021 20:48:21 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id MVBINPpgjufy; Thu, 13 May 2021 20:48:17 -0400 (EDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id B370039089; Thu, 13 May 2021 20:48:17 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 2F774688; Thu, 13 May 2021 20:39:11 -0400 (EDT) From: Michael Richardson To: Eliot Lear , Brian Smith , Jim Fenton , "Salz\, Rich" , "uta\@ietf.org" , iotops@ietf.org In-Reply-To: <42739D1C-004F-4DAD-8023-8E9731B46E05@cisco.com> References: <413CBCFE-1FDF-458E-9F0E-E3D58F86E5D9@bluepopcorn.net> <8A41ED29-2448-4633-AC45-33DE98A6BC81@akamai.com> <7B51BB81-1C9D-4B2F-AF83-1E528E620AE7@cisco.com> <42739D1C-004F-4DAD-8023-8E9731B46E05@cisco.com> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Iotops] [Uta] How should we change draft-ietf-use-san? X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 May 2021 00:39:21 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sorry that this email is three weeks old. I felt that it deserved a proper reply. Eliot Lear wrote: > The issue for me is library support. If libraries take the doc too > seriously, it screws the apps that really need to do the right thing > for their use cases. I partly agree. There are two parties here: 1) the validating end 2) the long-lived certificate end The long-lived certificate end might have a SAN-less (an "insane certificat= e"?) certificate, but it does not typically validate that. So, the thing that we are worried about is the validating end that is subje= ct to regular updates. It might be built decades after the certificate end. Note that it needs a trust anchor to be able to validate the long-lived-cer= tificate, or nothing works. Can we agree that this is therefore *not* a simple call to "libcurl"? I've been through this on Android and iOS and once you need to introduce the new trust anchor, you get into the much more harry aspects of the API. The parts of the API where you actually have to say how to you are validati= ng. It seems extremely unlikely that it would be validating with CN-ID in that case. (Many of us in IoTSF ManySecured WG are trying to find a way to easi= ly validate via current DNS-ID rules) What I'm saying is that I think that your strawman does not hold water. (Is that the right idiom?) > Let's turn the question around, because perhaps I am missing somethin= g. > Bearing in mind that there are literally hundreds of millions of > devices with long-lived certificates fielded today, what advice would > you give to those who support applications that have to interact with > them? What harm comes to any use case for there to be a non-default > library flag, as Victor mentioned there is with OpenSSL? The default is that you get the stock verification function. The non-default case is that you provide your own verification function. There actually isn't really anything else in between. > Causing the app developers to write their own X.509 validation code = =E2=80=93 It's where they already are. > To Jim=E2=80=99s point, maybe it would be possible to say that the fl= ag should > be unavailable for certs issued after a certain date, but that date > would have to be well into the future, and coordinated at least with > IEEE. That seems like a lot of work for something that, as Rich > rightly alludes, is really a vendor decision to intelligently make. Should some of these non-DNS-ID (and also non-CN-ID) verifications become common place, I can see that one might want to have a policy OID in a CA certificate that informed a library how it "ought" to verify. Perhaps that is already a thing.... probably... (I remember drinking a lot during pki4ipsec WG, but not much else about it) Eliot Lear wrote: > Actually, according to 802.1AR-2009, the subject MUST contain requires > a DN with serial number, and it may contain a SAN (e.g., don=E2=80=99= t count on > it). That=E2=80=99s the major concern. To me, the rest is really ne= gotiable. I have built IDevID certificates with SANs, with via public anchors, but they aren't long-lived. So the only way we get into trouble is when the application specifies a private trust anchor, asks for CN-ID/DNS-ID validation, and the certificate is long-lived. CABFORUM trust anchors are supposed to be limited to 13 months now (if issues after September 2020), and I believe that this duration is now getting baked into browsers, and I assume some libraries. (someone will correct me if I'm wrong) So, *today* in order to combine: a) long-lived IDevID signed by private-CA b) CN-ID verification c) private-trust anchor The application developer already needed to tweak flags. =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmCdxq4ACgkQgItw+93Q 3WXlggf/d54hAOZ3kIXRBMYQdp+S9EuqiJurjg9F6kp4FgShKnZurj5PVR2qQNkH 3KOmeccb6rfBBAXWw/Qaq7XRbR7DajuhR5CmmI+nKUpDRTvUMlkiffs62akSM6Mv VX4ib+Ffj+rXGzIRpF/2stdAKKQX1BTkKm0yXQ0Q1a1QcT8+/5RcAJmoi7rXlVeC lMpgjBRVZtRZyBflNi2Lf9P7ilrIicqxvsZarV7aFM8DrwZYtEoQVmU8JWaM8n2V C89PeA4oJl41u9Xa8sqpTTnUY9Uz8CSGnxP0+Qf8L6vXv203imDtWNpJ341u/cTo loge86wroCuX0OCJVg5RsnuvjkbJVg== =omRC -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu May 13 18:05:29 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E33D73A1B93; Thu, 13 May 2021 18:05:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.797 X-Spam-Level: X-Spam-Status: No, score=-2.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.698, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q8hWorh_eEMU; Thu, 13 May 2021 18:05:23 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 99EC63A1B8F; Thu, 13 May 2021 18:05:23 -0700 (PDT) Received: from pps.filterd (m0050093.ppops.net [127.0.0.1]) by m0050093.ppops.net-00190b01. (8.16.0.43/8.16.0.43) with SMTP id 14E13jmj025756; Fri, 14 May 2021 02:05:21 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=JohOSi0v65hGDwZMvqKbCxD5DvhybuRpZYHvAhUwYZk=; b=W/biutMEQNO3G3UQEM3ca5mEoz2+t7RWIzQZTJpQ0gLlcMMiBlKTPsYfOVF3ZSNWida9 EQs1IVAbVwKkNMS+bwGqF+ytFYEvrA0Co2Qz5CiLvGY/ylyrf7+ZV4Dt30sJEOO2+CQe NhkJmA8S/dAJ3coyb7boqp45tNgAhwEfSZytNgnkF4I9Pi9FfP6SUfEIW+tLgaEfkyQ1 U0CKqbiejBLxipt+mnqWmUXLsz/+/EHSfnEUhv+JGyRkGkzpGmT7r/dyNVxOTyO7ntl+ OihOmtYwe1slQCeIuPyw7lhbAKiThqGVOyJMYdvxBS9HDC85zesM8AsJbJ6YEQ15PNbE eg== Received: from prod-mail-ppoint1 (prod-mail-ppoint1.akamai.com [184.51.33.18] (may be forged)) by m0050093.ppops.net-00190b01. with ESMTP id 38hexns2ek-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 14 May 2021 02:05:21 +0100 Received: from pps.filterd (prod-mail-ppoint1.akamai.com [127.0.0.1]) by prod-mail-ppoint1.akamai.com (8.16.1.2/8.16.1.2) with SMTP id 14E0nnFV029816; Thu, 13 May 2021 21:05:20 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.33]) by prod-mail-ppoint1.akamai.com with ESMTP id 38gpn0334x-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Thu, 13 May 2021 21:05:20 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb3.msg.corp.akamai.com (172.27.123.103) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 13 May 2021 21:05:19 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1497.012; Thu, 13 May 2021 21:05:19 -0400 From: "Salz, Rich" To: Michael Richardson , "uta@ietf.org" , "iotops@ietf.org" , "anima@ietf.org" Thread-Topic: BRSKI and IDevID (non-!)issues with draft-ietf-uta-use-san Thread-Index: AQHXSFdGgV14Ql3VUE2U7b/F50fuPariKbuA Date: Fri, 14 May 2021 01:05:19 +0000 Message-ID: <6DD419B7-7A75-4B7D-80AE-2746CF74A0C2@akamai.com> References: <413CBCFE-1FDF-458E-9F0E-E3D58F86E5D9@bluepopcorn.net> <8A41ED29-2448-4633-AC45-33DE98A6BC81@akamai.com> <7B51BB81-1C9D-4B2F-AF83-1E528E620AE7@cisco.com> <42739D1C-004F-4DAD-8023-8E9731B46E05@cisco.com> <15280.1620951766@localhost> In-Reply-To: <15280.1620951766@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.49.21050201 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.27.118.139] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391, 18.0.761 definitions=2021-05-13_16:2021-05-12, 2021-05-13 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 spamscore=0 mlxlogscore=999 suspectscore=0 bulkscore=0 adultscore=0 phishscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000 definitions=main-2105140001 X-Proofpoint-ORIG-GUID: bR3-8NZ5JvASj4xtMMQhQT-ZMliTGWNk X-Proofpoint-GUID: bR3-8NZ5JvASj4xtMMQhQT-ZMliTGWNk X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391, 18.0.761 definitions=2021-05-13_16:2021-05-12, 2021-05-13 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 priorityscore=1501 adultscore=0 lowpriorityscore=0 malwarescore=0 mlxscore=0 bulkscore=0 impostorscore=0 spamscore=0 suspectscore=0 mlxlogscore=992 clxscore=1011 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000 definitions=main-2105140003 X-Agari-Authentication-Results: mx.akamai.com; spf=${SPFResult} (sender IP is 184.51.33.18) smtp.mailfrom=rsalz@akamai.com smtp.helo=prod-mail-ppoint1 Archived-At: Subject: Re: [Iotops] BRSKI and IDevID (non-!)issues with draft-ietf-uta-use-san X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 May 2021 01:05:28 -0000 PiAgICBJbiBzdW1tYXJ5LCBJIGRvbid0IHNlZSBhbnl0aGluZyBpbiB1c2Utc2FuIHRoYXQgd2ls bCBhZmZlY3QgQlJTS0kuDQoNClRoYXQgaXMgZ3JlYXQgdG8gaGVhciwgdGhhbmtzIGZvciB0aGUg Y2FyZWZ1bCBhbmFseXNpcy4NCg0KPiAgICBTb21lIG5pdHM6DQoNCkFsbCBsb29rIGxpa2UgZ29v ZCB0aGluZ3MgdG8gZG8sIEknbGwgbWFrZSBhIFBSIHNvb25pc2guDQoNCldoYXQgZG8geW91IHRo aW5rIG9mIGp1c3QgcmV3cml0aW5nIHRoaXMgdG8gY29tcGxldGVseSByZXBsYWNlIDYxMjUsIHJh dGhlciB0aGFuIHRyeWluZyB0byBiZSBhICJkaWZmIFJGQyI/DQoNCg== From nobody Thu May 13 23:53:01 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C3313A2635; Thu, 13 May 2021 23:52:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -11.899 X-Spam-Level: X-Spam-Status: No, score=-11.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_NONE=0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 45xkMQxo1Tbo; Thu, 13 May 2021 23:52:43 -0700 (PDT) Received: from aer-iport-3.cisco.com (aer-iport-3.cisco.com [173.38.203.53]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A1F823A2629; Thu, 13 May 2021 23:52:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4570; q=dns/txt; s=iport; t=1620975163; x=1622184763; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=+5jCRNzanRLjskmNRX5GFTGuehlhCFwlGEGolH5tvTw=; b=ipYz8yhiUB/Avn2JIs49zBPChHALBMRODMzkX/2MkB1HaknL//DzJYxr bQti67vZCW4ofkWA5NUzZHRsHnhtXAvXouTMdry7PJEXkQD75Whk1DS6Z ZUfkFaFwamdac+VJxxd+ZxgdlAbGVTBJ5YpXft3ERgAZYlCSBqFLds0OC A=; X-Files: signature.asc : 488 X-IPAS-Result: =?us-ascii?q?A0ADAQDQHZ5g/xbLJq1RCRsBAQEBAQEBAQUBAQESAQEBA?= =?us-ascii?q?wMBAQGCF4MiVgEnEjGER4kEiH4DnQwEBwEBAQoDAQEtFAQBAYFbgnQCgXUmO?= =?us-ascii?q?BMCBAEBAQEDAgMBAQEBBQEBBQEBAQIBBgRxE4VQDYZEAQEBAwEjBEsHBQsLD?= =?us-ascii?q?AwqAgI9GgYTgnEBgmYhpzp6fzOBAYRjhSEQgTqBU4wQQ4INgRUnHIJfPoJhB?= =?us-ascii?q?IEyg0M2gi0EgkVlBFUfAWM/XQWRXByLPYEqnSSDIINKgUmEbpNDBSODWYFBj?= =?us-ascii?q?3GQLp8olR9lhAoCBAYFAhaBayMrgS4zGggbFTsqAYI+CTUSGQ6SD4pfPwMvO?= =?us-ascii?q?AIGAQkBAQMJikstghgBAQ?= IronPort-HdrOrdr: A9a23:j307NKG0EXxFoHWgpLqE7ceALOsnbusQ8zAXPo5KOH9om62j+/ xG88576faZslwssTQb+exoRpPsfZqsz/FICOAqVN/IYOClghrMEGgI1+XfKlPbak/DH5ZmpM Ndm2wUMqyXMbC85vyKhzWFLw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="5.82,299,1613433600"; d="asc'?scan'208";a="33570436" Received: from aer-iport-nat.cisco.com (HELO aer-core-1.cisco.com) ([173.38.203.22]) by aer-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 14 May 2021 06:52:38 +0000 Received: from smtpclient.apple ([10.61.144.21]) by aer-core-1.cisco.com (8.15.2/8.15.2) with ESMTPS id 14E6qbPQ002764 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 14 May 2021 06:52:37 GMT From: Eliot Lear Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_7FF024FA-EC88-456D-B2BC-D9A9FC03E584"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.80.0.2.43\)) Date: Fri, 14 May 2021 08:52:36 +0200 In-Reply-To: <15280.1620951766@localhost> Cc: "Salz, Rich" , "uta@ietf.org" , iotops@ietf.org, anima@ietf.org To: Michael Richardson References: <413CBCFE-1FDF-458E-9F0E-E3D58F86E5D9@bluepopcorn.net> <8A41ED29-2448-4633-AC45-33DE98A6BC81@akamai.com> <7B51BB81-1C9D-4B2F-AF83-1E528E620AE7@cisco.com> <42739D1C-004F-4DAD-8023-8E9731B46E05@cisco.com> <15280.1620951766@localhost> X-Mailer: Apple Mail (2.3654.80.0.2.43) X-Outbound-SMTP-Client: 10.61.144.21, [10.61.144.21] X-Outbound-Node: aer-core-1.cisco.com Archived-At: Subject: Re: [Iotops] BRSKI and IDevID (non-!)issues with draft-ietf-uta-use-san X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 May 2021 06:52:59 -0000 --Apple-Mail=_7FF024FA-EC88-456D-B2BC-D9A9FC03E584 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi, I think we=E2=80=99re past this, but just to be clear: There are a VAST number of devices that run off of iDevIDs: they never = transition off of them. I=E2=80=99m not a fan, but that=E2=80=99s what = they do. Eliot > On 14 May 2021, at 02:22, Michael Richardson = wrote: >=20 > Signed PGP part >=20 > I read the document before it was adopted (before SECDISPATCH), and I = didn't > see any problems with it. >=20 > I have re-read it in the context of IoT or enterprise (routers) = devices that > might contain long-lived IDevID (sometimes called Manufacturer = Installed > Certificates, confusingly appreviated "MIC"). > CISCO calls them Secure Unique Device Identifier (SUDI), and there are = many > other manufacturers with their own interesting names. > I believe that the CHIP/MATTER effort also mandates such a thing for = the > purposes of identity and device attestation. >=20 > In BRSKI (about to be RFC8995) TLS connections are initiated from a = client > (the pledge) to a Registrar. The TLS connections make use of > ClientCertificates for identification. RFC6125 rules are not relevant > to validation of the client certificate. > If a CN=3D, emailAddress=3D or DC=3D was present in the = ClientCertificate it would > not be used as part of the validation in a compliant Registrar. > The Registrar cares about the X520SerialNumber (aka "serialNumber=3D") = only. >=20 > In the other direction, the pledge does not initially validate the = Registrar > ServerCertificate at all. It is taken as given, provisionally, until = such > time as the pledge gets corroboration from an RFC8366 voucher. In = general, > the Registrar certificate is issued from a private (enterprise) PKI, = and the > corroboration depends upon a sales relationship with the vendor (the = MASA). >=20 > RFC6125 DNS-ID validations may occur in the MASA, depending upon = policy. > The new rules from use-san should apply without a problem, if any 6125 > validation (vs explicit pinning) was used. > The Registrar->MASA connection is already explicitely RFC6125 DNS-ID = only. >=20 > In summary, I don't see anything in use-san that will affect BRSKI. >=20 > It may be that Cisco and other manufacturers use their certificates in = other > ways, and I can't speak for whether they might be affected. >=20 >=20 > Some nits: >=20 >> While not discussed in [RFC6125] this section also implicitly >> prohibits the use of the Domain Component or emailAddress RDN's. >=20 > 1) it seems like, since it's mentioned here, that it's not "implicit" = at all. > It seems rather explicit to me. >=20 > 2) I think that the deprecation of a sequence of "DC=3D" probably = warrants a > sentence of its own. >=20 > 3) I'm unclear how emailAddress was used when a DNS name was desired. > Were there rules that allowed the client to say, "connect to = example.com" > and then validation was okay if the certificate says = emailAddress=3Dfoo@example.com? > If so, then I think that this situation should be more clearly = deprecated. >=20 > 4) I suggest that section 3 "The New Rules" should be in positive = language > only. Most of the language is what not to do. I think that this is > important to list, but I suggest it be split up into a section "Do = this" > and a section "Do not do this" >=20 > -- > Michael Richardson . o O ( IPv6 I=C3=B8T = consulting ) > Sandelman Software Works Inc, Ottawa and Worldwide >=20 >=20 >=20 >=20 >=20 >=20 --Apple-Mail=_7FF024FA-EC88-456D-B2BC-D9A9FC03E584 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAmCeHjUACgkQh7ZrRtnS ejP+bAf+Iia5wLkKx+DTII2pRv2h/6AJj0GlIDl9T00/MVRUV527ORDDxVWH9sW9 RVZaBmvj2Qi76peZHIQomxlq+qx7b0rv1XD+xsa5AQ0iXbgGlp7iDpvT5qEXBN3V 5SdaVY17avCvGAG3sV2qJoyJCPH4iBMl5MGS7GgRzy8ZFfvbdqhuvpBMOkvOG8J8 Fgdp441jD+AP6P2xrmnYgx1YT3CQOAWM2G4++g+eO5lfwamDhXVnFoX9AuqCfK2L t5aaqw9Bh8ZMOYpV1Tj2f+3C4V0pERh+NrUXnOCcyI8E8510WKubIwQhYe7e/g6Y ZBwFEs+F/XOZhKVxvJRdpL533HV97A== =k9Q4 -----END PGP SIGNATURE----- --Apple-Mail=_7FF024FA-EC88-456D-B2BC-D9A9FC03E584-- From nobody Fri May 14 07:02:54 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFA1A3A33F1; Fri, 14 May 2021 07:02:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.797 X-Spam-Level: X-Spam-Status: No, score=-2.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.698, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TEbLPvUK8hsN; Fri, 14 May 2021 07:02:48 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0238D3A33F2; Fri, 14 May 2021 07:02:47 -0700 (PDT) Received: from pps.filterd (m0050102.ppops.net [127.0.0.1]) by m0050102.ppops.net-00190b01. (8.16.0.43/8.16.0.43) with SMTP id 14EE1HZ2003244; Fri, 14 May 2021 15:02:43 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=yysxgYy83A5QbPJD4LR7s6H4xE4bKvR0lCSrhOjKCNo=; b=KVZG5lYOwWCL/+UHOEuSuobrtUalejxEEkhhiZBZAbCT59WWQ8zWyGE+VNbcRVSWN+Ad jFOmde4GeVUtQoF2LiYGvI80YzA7LXiKoRwMNJFxeWvZ/72dyoC6lYkive0LbJ63407L sjNi7agaHLzs5fgIAw7tF6nwSfyQqSTklrvo8R7WgrEOO9OffL14Mp910iDh/PjuBUrZ jOJl1kNFIgtryiiwZ2X8TxkKBU6S8sL8+3ykki3gadVc2jDMAif1eneNCRsGaXyWq/fB CFCGOtukyeq+jSMofSNZxUMbRoArAWTvopJFzo4V1kq/bH+i7Sy6ODJFdjMHZnE+k0tx FA== Received: from prod-mail-ppoint6 (prod-mail-ppoint6.akamai.com [184.51.33.61] (may be forged)) by m0050102.ppops.net-00190b01. with ESMTP id 38hhtwjp2r-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 14 May 2021 15:02:42 +0100 Received: from pps.filterd (prod-mail-ppoint6.akamai.com [127.0.0.1]) by prod-mail-ppoint6.akamai.com (8.16.1.2/8.16.1.2) with SMTP id 14EE2NX9031674; Fri, 14 May 2021 10:02:41 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.53]) by prod-mail-ppoint6.akamai.com with ESMTP id 38gpmpcj33-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Fri, 14 May 2021 10:02:41 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb6.msg.corp.akamai.com (172.27.123.65) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Fri, 14 May 2021 10:02:41 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1497.012; Fri, 14 May 2021 10:02:40 -0400 From: "Salz, Rich" To: Eliot Lear , Michael Richardson CC: "uta@ietf.org" , "iotops@ietf.org" , "anima@ietf.org" Thread-Topic: [Iotops] BRSKI and IDevID (non-!)issues with draft-ietf-uta-use-san Thread-Index: AQHXSFdGgV14Ql3VUE2U7b/F50fuParizdEAgAA1GgA= Date: Fri, 14 May 2021 14:02:39 +0000 Message-ID: <6F770550-8636-4353-BDBD-2C2376447168@akamai.com> References: <413CBCFE-1FDF-458E-9F0E-E3D58F86E5D9@bluepopcorn.net> <8A41ED29-2448-4633-AC45-33DE98A6BC81@akamai.com> <7B51BB81-1C9D-4B2F-AF83-1E528E620AE7@cisco.com> <42739D1C-004F-4DAD-8023-8E9731B46E05@cisco.com> <15280.1620951766@localhost> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.49.21050201 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.27.118.139] Content-Type: text/plain; charset="utf-8" Content-ID: <9D04E0C6ECF4FF45AB2750572BFB5740@akamai.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391, 18.0.761 definitions=2021-05-14_06:2021-05-12, 2021-05-14 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 mlxlogscore=999 suspectscore=0 bulkscore=0 adultscore=0 mlxscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000 definitions=main-2105140113 X-Proofpoint-ORIG-GUID: jYgPYpfGqJlWR7Ey2EleXO3M8Bvxlgon X-Proofpoint-GUID: jYgPYpfGqJlWR7Ey2EleXO3M8Bvxlgon X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391, 18.0.761 definitions=2021-05-14_06:2021-05-12, 2021-05-14 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 adultscore=0 clxscore=1015 bulkscore=0 phishscore=0 malwarescore=0 spamscore=0 mlxscore=0 impostorscore=0 priorityscore=1501 mlxlogscore=970 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000 definitions=main-2105140113 X-Agari-Authentication-Results: mx.akamai.com; spf=${SPFResult} (sender IP is 184.51.33.61) smtp.mailfrom=rsalz@akamai.com smtp.helo=prod-mail-ppoint6 Archived-At: Subject: Re: [Iotops] BRSKI and IDevID (non-!)issues with draft-ietf-uta-use-san X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 May 2021 14:02:53 -0000 PiAgICBUaGVyZSBhcmUgYSBWQVNUIG51bWJlciBvZiBkZXZpY2VzIHRoYXQgcnVuIG9mZiBvZiBp RGV2SURzOiB0aGV5IG5ldmVyIHRyYW5zaXRpb24gb2ZmIG9mIHRoZW0uICBJ4oCZbSBub3QgYSBm YW4sIGJ1dCB0aGF04oCZcyB3aGF0IHRoZXkgZG8uDQoNCk9rYXksIHNvIHRoaXMgZHJhZnQgZG9l c24ndCBhcHBseSB0byB0aGVtLiAgVGhlcmUgZG9lc24ndCBzZWVtIHRvIGJlIGEgcHJvYmxlbSB3 aXRoLCBzYXksIG5vdCB1c2luZyBUTFMgMS4zIGluIGNhc2VzLCBvciBub3QgdXNpbmcgRUNESCBp biBzb21lIGNhc2VzLCBzbyB3aHkgaXMgdGhpcyBkcmFmdCBkaWZmZXJlbnQgZnJvbSB0aG9zZSBz aXR1YXRpb24/ICANCg0K From nobody Fri May 14 07:08:27 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E672C3A3418; Fri, 14 May 2021 07:08:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.599 X-Spam-Level: X-Spam-Status: No, score=-9.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_NONE=0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1kzoD-LwOXCu; Fri, 14 May 2021 07:08:18 -0700 (PDT) Received: from aer-iport-3.cisco.com (aer-iport-3.cisco.com [173.38.203.53]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 771823A3416; Fri, 14 May 2021 07:08:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1583; q=dns/txt; s=iport; t=1621001297; x=1622210897; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=jXcaF4EmQEu69/DHXNzbs0Kg0TIZY7du8rcBpCfYWVk=; b=j3pZB9CuwDK0w0dlc0sjcmcwcaZXTLZreUkGNG+hlHSAfzyUHPRLoY5A A8KfWLjFF5xaelOareW29w7+6wyXo3Q10XLe6bhtZG74eeUy/wGQx6rSc DlnHyLLzZxk9QY/LpSVJEK07b005EQWLWHXS36xStso0yzwcv92tfU2KB w=; X-Files: signature.asc : 488 X-IPAS-Result: =?us-ascii?q?A0AVAAB/gp5g/xbLJq1aGgEBAQEBAQEBAQEDAQEBARIBA?= =?us-ascii?q?QEBAgIBAQEBggYCAQEBAQsBg3cBJxIxhEeJBIkCnQwEBwEBAQoDAQFBBAEBh?= =?us-ascii?q?E8CgXUmNwYOAgQBAQEBAwIDAQEBAQUBAQUBAQECAQYEcROFXYZEAQEBAwEjV?= =?us-ascii?q?gULCwwMKgICPRoGE4JxAYJmIad1eoEygQGEY4UgEIE6AYFSiBmDd0OCDYEVJ?= =?us-ascii?q?xyCXz6HWjaCLQSBVYFZdWM/n0GdJIMgg0qBSZgxBSODR6FytSyECgIEBgUCF?= =?us-ascii?q?oFqJIFZMxoIGxVlAYI+PhIZDpxuPwMvOAIGAQkBAQMJikstghgBAQ?= IronPort-HdrOrdr: A9a23:t8Hi1aFFSlxva1dtpLqE7ceALOsnbusQ8zAXPo5KOH9om62j+/ xG88576faZslwssTQb+exoRpPsfZqsz/FICOAqVN/IYOClghrMEGgI1+XfKlPbak/DH5ZmpM Ndm2wUMqyXMbC85vyKhzWFLw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="5.82,300,1613433600"; d="asc'?scan'208";a="33579439" Received: from aer-iport-nat.cisco.com (HELO aer-core-3.cisco.com) ([173.38.203.22]) by aer-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 14 May 2021 14:08:13 +0000 Received: from smtpclient.apple ([10.61.144.21]) by aer-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id 14EE8C4V025837 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 14 May 2021 14:08:12 GMT From: Eliot Lear Message-Id: <0346569E-B1CB-4CE5-AD26-D2E21798A1D5@cisco.com> Content-Type: multipart/signed; boundary="Apple-Mail=_81E547FA-E704-457C-BE9C-19F61144BC80"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.80.0.2.43\)) Date: Fri, 14 May 2021 16:08:11 +0200 In-Reply-To: <6F770550-8636-4353-BDBD-2C2376447168@akamai.com> Cc: Michael Richardson , "uta@ietf.org" , "iotops@ietf.org" , "anima@ietf.org" To: "Salz, Rich" References: <413CBCFE-1FDF-458E-9F0E-E3D58F86E5D9@bluepopcorn.net> <8A41ED29-2448-4633-AC45-33DE98A6BC81@akamai.com> <7B51BB81-1C9D-4B2F-AF83-1E528E620AE7@cisco.com> <42739D1C-004F-4DAD-8023-8E9731B46E05@cisco.com> <15280.1620951766@localhost> <6F770550-8636-4353-BDBD-2C2376447168@akamai.com> X-Mailer: Apple Mail (2.3654.80.0.2.43) X-Outbound-SMTP-Client: 10.61.144.21, [10.61.144.21] X-Outbound-Node: aer-core-3.cisco.com Archived-At: Subject: Re: [Iotops] BRSKI and IDevID (non-!)issues with draft-ietf-uta-use-san X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 May 2021 14:08:23 -0000 --Apple-Mail=_81E547FA-E704-457C-BE9C-19F61144BC80 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Rich, As I wrote, I think we=E2=80=99re past it, because this is about = domain/IP address validation and not client cert validation. Correct? Eliot > On 14 May 2021, at 16:02, Salz, Rich wrote: >=20 >> There are a VAST number of devices that run off of iDevIDs: they = never transition off of them. I=E2=80=99m not a fan, but that=E2=80=99s = what they do. >=20 > Okay, so this draft doesn't apply to them. There doesn't seem to be a = problem with, say, not using TLS 1.3 in cases, or not using ECDH in some = cases, so why is this draft different from those situation? >=20 --Apple-Mail=_81E547FA-E704-457C-BE9C-19F61144BC80 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAmCehEsACgkQh7ZrRtnS ejPU/AgAmxUckTLD6H7mglVT4egUUGYl2yzahPtePLo4zxzaUo9Dqr+r1WbCXG+o zExY7oLXqctrZQrTWuYrV4DyvsH86IQA3qbDEuKPfd6oiuR9RvPjed5nykXxWfm3 dj5FNEVH0yiUMDkYZHJOiQm3DOTLjI/gIk1VjI5+X4PD0GCZdv2seJcm92dNAS1j Z/3HtoxlTq+DtD7J4izSyU0VER8eGCuQnI1KCcf73OpYr8AOiVgglIIN29Kkv+Qo 3Gy4TjwZHec5ccyUU3Fqis4pcA4YW2z+I2H0IABrROMC/81yCm17ebteAqdYSL3S ilBtTD6cppXzXmChWf8iPPUvN7/Xpg== =FuWF -----END PGP SIGNATURE----- --Apple-Mail=_81E547FA-E704-457C-BE9C-19F61144BC80-- From nobody Fri May 14 08:14:51 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E1F063A364C; Fri, 14 May 2021 08:14:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.797 X-Spam-Level: X-Spam-Status: No, score=-2.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.698, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NGwO_Iex48X4; Fri, 14 May 2021 08:14:43 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 596583A364D; Fri, 14 May 2021 08:14:43 -0700 (PDT) Received: from pps.filterd (m0050102.ppops.net [127.0.0.1]) by m0050102.ppops.net-00190b01. (8.16.0.43/8.16.0.43) with SMTP id 14EFEYct007653; Fri, 14 May 2021 16:14:39 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=M1JhzweIrY4nkAHN4231iniTccPGRUVLWDicxHK1JLw=; b=kQXmzMLPYzFp+4ZRauf3Kb8WriOPWKeUt7FhTTp4RBauY16qcFd0YIqaZ53K1OhM5hv7 cZY5phNPDFiqFf4x/LCukJ7L1vVkAcURhukz04/sVJV79BNLhgva0FPPSIdcmuWY2zJi XvulNqzc2XwAfVgwVVZ9YusjpNOQFXYF+qwiNNis1yX9O/FPaA2CfJWkzvqb+HHh3nb6 K7dtzVAdqBV1rjGkO56pV8ROFfV1+tmnkAE29VD8wi84c/RLT6MV8+Y0UyEVO4exrpXX LHrgCiwOvY6HzZF6KEotFcIy/VUQJlBhQAP0o8/yRpmrDrswNH2OuToYJ2k5EC2+GNp6 eA== Received: from prod-mail-ppoint6 (prod-mail-ppoint6.akamai.com [184.51.33.61] (may be forged)) by m0050102.ppops.net-00190b01. with ESMTP id 38hhtwmgs3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 14 May 2021 16:14:39 +0100 Received: from pps.filterd (prod-mail-ppoint6.akamai.com [127.0.0.1]) by prod-mail-ppoint6.akamai.com (8.16.1.2/8.16.1.2) with SMTP id 14EF66KE020693; Fri, 14 May 2021 11:14:38 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.53]) by prod-mail-ppoint6.akamai.com with ESMTP id 38gpmpcpbu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Fri, 14 May 2021 11:14:38 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb2.msg.corp.akamai.com (172.27.123.102) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Fri, 14 May 2021 11:14:37 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1497.012; Fri, 14 May 2021 11:14:37 -0400 From: "Salz, Rich" To: Eliot Lear CC: Michael Richardson , "uta@ietf.org" , "iotops@ietf.org" , "anima@ietf.org" Thread-Topic: [Iotops] BRSKI and IDevID (non-!)issues with draft-ietf-uta-use-san Thread-Index: AQHXSFdGgV14Ql3VUE2U7b/F50fuParizdEAgAA1GgCAAESZgP//z4EA Date: Fri, 14 May 2021 15:14:36 +0000 Message-ID: References: <413CBCFE-1FDF-458E-9F0E-E3D58F86E5D9@bluepopcorn.net> <8A41ED29-2448-4633-AC45-33DE98A6BC81@akamai.com> <7B51BB81-1C9D-4B2F-AF83-1E528E620AE7@cisco.com> <42739D1C-004F-4DAD-8023-8E9731B46E05@cisco.com> <15280.1620951766@localhost> <6F770550-8636-4353-BDBD-2C2376447168@akamai.com> <0346569E-B1CB-4CE5-AD26-D2E21798A1D5@cisco.com> In-Reply-To: <0346569E-B1CB-4CE5-AD26-D2E21798A1D5@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.49.21050201 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.27.118.139] Content-Type: text/plain; charset="utf-8" Content-ID: <6831999BF3B81A4E9820C1C081781D13@akamai.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391, 18.0.761 definitions=2021-05-14_06:2021-05-12, 2021-05-14 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 mlxlogscore=789 suspectscore=0 bulkscore=0 adultscore=0 mlxscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000 definitions=main-2105140121 X-Proofpoint-ORIG-GUID: 3HmR05QWDQi0qltv9x_qCgqNLftHu4dA X-Proofpoint-GUID: 3HmR05QWDQi0qltv9x_qCgqNLftHu4dA X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391, 18.0.761 definitions=2021-05-14_06:2021-05-12, 2021-05-14 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 adultscore=0 clxscore=1015 bulkscore=0 phishscore=0 malwarescore=0 spamscore=0 mlxscore=0 impostorscore=0 priorityscore=1501 mlxlogscore=732 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000 definitions=main-2105140122 X-Agari-Authentication-Results: mx.akamai.com; spf=${SPFResult} (sender IP is 184.51.33.61) smtp.mailfrom=rsalz@akamai.com smtp.helo=prod-mail-ppoint6 Archived-At: Subject: Re: [Iotops] BRSKI and IDevID (non-!)issues with draft-ietf-uta-use-san X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 May 2021 15:14:50 -0000 PiAgICBBcyBJIHdyb3RlLCBJIHRoaW5rIHdl4oCZcmUgcGFzdCBpdCwgYmVjYXVzZSB0aGlzIGlz IGFib3V0IGRvbWFpbi9JUCBhZGRyZXNzIHZhbGlkYXRpb24gYW5kIG5vdCBjbGllbnQgY2VydCB2 YWxpZGF0aW9uLiAgQ29ycmVjdD8NCg0KQWgsIHJpZ2h0LiAgVGhhbmtzLiAgVG9vIG1hbnkgYmFs bHMgaW4gdGhlIGFpciA6KQ0KDQo= From nobody Fri May 14 11:52:14 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47B003A3C7F; Fri, 14 May 2021 11:52:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vLWVA_oqYN8e; Fri, 14 May 2021 11:52:04 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9FD103A3C7E; Fri, 14 May 2021 11:52:04 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 163A53922D; Fri, 14 May 2021 15:01:10 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id rWZRjQ1YyiPq; Fri, 14 May 2021 15:01:08 -0400 (EDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 27BAF39233; Fri, 14 May 2021 15:01:08 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id BB76C48B; Fri, 14 May 2021 14:51:58 -0400 (EDT) From: Michael Richardson To: "Salz\, Rich" cc: "uta\@ietf.org" , "iotops\@ietf.org" , "anima\@ietf.org" In-Reply-To: <6DD419B7-7A75-4B7D-80AE-2746CF74A0C2@akamai.com> References: <413CBCFE-1FDF-458E-9F0E-E3D58F86E5D9@bluepopcorn.net> <8A41ED29-2448-4633-AC45-33DE98A6BC81@akamai.com> <7B51BB81-1C9D-4B2F-AF83-1E528E620AE7@cisco.com> <42739D1C-004F-4DAD-8023-8E9731B46E05@cisco.com> <15280.1620951766@localhost> <6DD419B7-7A75-4B7D-80AE-2746CF74A0C2@akamai.com> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Iotops] BRSKI and IDevID (non-!)issues with draft-ietf-uta-use-san X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 May 2021 18:52:10 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Salz, Rich wrote: > That is great to hear, thanks for the careful analysis. >> Some nits: > All look like good things to do, I'll make a PR soonish. > What do you think of just rewriting this to completely replace 6125, > rather than trying to be a "diff RFC"? If you mean, rfc6125bis, then it seems like it would risk opening wounds. But, wholesale, "replace section X with ...." might be useful. =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmCexs4ACgkQgItw+93Q 3WWKwAf/XIn22vgaw9MSUuzbJ4QM4COARNAInc68nH3vb+v7NjBpYwyia2RKQbM9 Q2yMKRh8g7Mg850N4eGJm74yy4nXp7LldQgXwGyGakQPuPztTaWssNiwFs7QY4UO i93AbJGX6QmKplimGbpAcO/7PnF16lgSmO6NJgHDjgmhtmAql9jlAPzJIrL33yxo nc4AFFbbNCxLbEImhdNUfWJD8N5ILEqwxSb5DcOAIXwctYxvBu7ty8oPY7ie65Fv oPSUOmA+o/KqbbT8MuWLmxKEDwzcMOhOFGpkK+OeEaKG2DRFmTAn79UrOPmIt2VF NVMWimuSacYv7LLnSip8PYyHdulIGA== =KeSR -----END PGP SIGNATURE----- --=-=-=-- From nobody Sat May 15 15:50:44 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5F693A1F4D; Sat, 15 May 2021 15:50:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fcOJ_X857znl; Sat, 15 May 2021 15:50:34 -0700 (PDT) Received: from mail-yb1-xb33.google.com (mail-yb1-xb33.google.com [IPv6:2607:f8b0:4864:20::b33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D737D3A1F49; Sat, 15 May 2021 15:50:33 -0700 (PDT) Received: by mail-yb1-xb33.google.com with SMTP id m9so3718830ybm.3; Sat, 15 May 2021 15:50:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=GH3RsFWpwVo0qLfHH/lK92xqIjeeQiW+c/GOnXOk83Y=; b=NjizHwOkM6eojvk3AA0QtKXGySQrMKsIogGstaNLnzKrXMPNNIMr8E1ZTnZerITTHJ JDq023yCglpV9sNFBH0ziIJX5RRmwx3eQo0QBBuBplWs+1xDWOy6+xtQbKAjGoY6DsZU GpUlqRhzWNqPfRUHzc3808PFprVGlLJ0Ied6LqTsWHnh9gpREb4RjdP2KU6e5mAzfKK6 g4dxz7so3e+x7OdOiZQfgz6S09xuLgVsUtHSeZisIyR4duFjlQeZ1XpDpsnG1eBxUIXU /M6jkyaDYiVCRop0vgMa/OiUD4SWvpdqq5+c42SbIEEPi3CzKo7067vEYn4sHwUe3X5d wS0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=GH3RsFWpwVo0qLfHH/lK92xqIjeeQiW+c/GOnXOk83Y=; b=uZofaPYMMjuXdKGSz3m2IO0nN94QYTt3v5/mtZm5/yQy2fbRhPUiyT9GaXq0xt/e32 Th3qzUybp5ITX+fBSUZyIj8QLYQiI5rD2kllvWoit3u1GyZTCqR/Sngvutd9ixUtH1CX wqo6/GKS6yDCkU0vpwWTaAneKNyktZ9GVE2ueraIr4xwRXHPxRsn/+PFDMsL8nNaVDDt MUPIe4kviCQ7pGp0zJbDuS8P4uI7OcyEd+4xdpMwj8kB9DEjKvAUvLJ9OrUxZlyYyr1k 8X4qBle5/c+UXFHnCBOMoYbX54iMJ6FuO4cRBv5/uemsj+L6Jc8fhVurKoxo+JvDptx5 Btcw== X-Gm-Message-State: AOAM53009QXHVXrAH8LWaYxO9tLq5hVKAv0x159omNUkc21guNJFP8rW VR68VySHnb5NF0oxPLzDDBUGvyanDDcSL/zpolg= X-Google-Smtp-Source: ABdhPJx+Aa01fmS5e+MUtiz+FHjATPYUYL0BhDXMV8FTMT66m29TTC64iYSrVF5BSvP6+kwE6eHywc1NTFyIY9oIPuM= X-Received: by 2002:a25:8e0e:: with SMTP id p14mr37811730ybl.84.1621119032524; Sat, 15 May 2021 15:50:32 -0700 (PDT) MIME-Version: 1.0 References: <413CBCFE-1FDF-458E-9F0E-E3D58F86E5D9@bluepopcorn.net> <8A41ED29-2448-4633-AC45-33DE98A6BC81@akamai.com> <7B51BB81-1C9D-4B2F-AF83-1E528E620AE7@cisco.com> <42739D1C-004F-4DAD-8023-8E9731B46E05@cisco.com> <15280.1620951766@localhost> <6DD419B7-7A75-4B7D-80AE-2746CF74A0C2@akamai.com> <9772.1621018318@localhost> In-Reply-To: <9772.1621018318@localhost> From: Spencer Dawkins at IETF Date: Sat, 15 May 2021 17:50:05 -0500 Message-ID: To: Michael Richardson Cc: "Salz, Rich" , "uta@ietf.org" , "anima@ietf.org" , "iotops@ietf.org" Content-Type: multipart/alternative; boundary="00000000000012836105c2663011" Archived-At: Subject: Re: [Iotops] BRSKI and IDevID (non-!)issues with draft-ietf-uta-use-san X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 15 May 2021 22:50:39 -0000 --00000000000012836105c2663011 Content-Type: text/plain; charset="UTF-8" For what it's worth, On Fri, May 14, 2021 at 1:52 PM Michael Richardson wrote: > > Salz, Rich wrote: > > That is great to hear, thanks for the careful analysis. > > >> Some nits: > > > All look like good things to do, I'll make a PR soonish. > > > What do you think of just rewriting this to completely replace 6125, > > rather than trying to be a "diff RFC"? > > If you mean, rfc6125bis, then it seems like it would risk opening wounds. > But, wholesale, "replace section X with ...." might be useful. > I'd absolutely run this past the responsible AD. The IESG's view of patch RFCs versus diff RFCs varies over time, and I discovered late in my third term that the IESG didn't have a common understanding of what we should do in this case - and embarrassingly, I was in the rough. Datatracker references on request, or you can trust me on this one ... Best, Spencer --00000000000012836105c2663011 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
For what=C2=A0it's worth,=C2=A0
=
On Fri= , May 14, 2021 at 1:52 PM Michael Richardson <mcr+ietf@sandelman.ca> wrote:

Salz, Rich <rsalz@= akamai.com> wrote:
=C2=A0 =C2=A0 > That is great to hear, thanks for the careful analysis.<= br>
=C2=A0 =C2=A0 >> Some nits:

=C2=A0 =C2=A0 > All look like good things to do, I'll make a PR soon= ish.

=C2=A0 =C2=A0 > What do you think of just rewriting this to completely r= eplace 6125,
=C2=A0 =C2=A0 > rather than trying to be a "diff RFC"?

If you mean, rfc6125bis, then it seems like it would risk opening wounds. But, wholesale, "replace section X with ...."=C2=A0 might be usef= ul.

I'd absolutely run this past th= e responsible AD. The IESG's=C2=A0view of patch RFCs versus diff RFCs v= aries over time, and I discovered late in my third term that the IESG didn&= #39;t have a common understanding of what we should do in this case - and e= mbarrassingly, I was in the rough.=C2=A0

Datatrack= er references on request, or you can trust me on this one ...=C2=A0=C2=A0

Best,=C2=A0

Spencer
<= /div>
--00000000000012836105c2663011-- From nobody Wed May 26 10:54:39 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 768E43A003E for ; Wed, 26 May 2021 10:54:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, MSGID_FROM_MTA_HEADER=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fraunhofer.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nbq5a0sL-eCl for ; Wed, 26 May 2021 10:54:35 -0700 (PDT) Received: from mail-edgeDD24.fraunhofer.de (mail-edgeDD24.fraunhofer.de [192.102.167.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 246443A003C for ; Wed, 26 May 2021 10:54:31 -0700 (PDT) IronPort-SDR: /GAJhMe/pSM9nblzfPQYxQ511XG84IRhMvb4BGRBJMcrayOkeisEeI0QtE+OFmI5xiDy4Sx1XU UHegPvnbN7PQ== IronPort-PHdr: =?us-ascii?q?A9a23=3ArZddxxOUrJplEmd6r2Ul6nfnWUAX0o4cdiYU5?= =?us-ascii?q?4YpzbVUfffr85fjORnZ4vNgxB/MUJ7A4v1Jw+zRr+j7WGMG7JrA1RJKcJFFW?= =?us-ascii?q?xIfz8lDmQsmDZ2EBFH1avnwYH9yEMFLTlQw+Xa9PABcE9r/YFuHpHq04HYSF?= =?us-ascii?q?xzzOBAzKP7yH9vJjtjx2fq75pvTZAtFnnyxbOAaEQ=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A2EUDQD1ia5g/xmnZsBagQmBWYFRUX6?= =?us-ascii?q?BQguEPYNJAQGFOYhBCJosgUKBEQNUCwEBAQEBAQEBAQgBNwgCBAEBAwOFAYF?= =?us-ascii?q?LASU4EwIEAQEBEgEBBgEBAQEBBgQCAoEAhWgNQxYBgnuBCAEBAQEBAQEBAQE?= =?us-ascii?q?BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQUCQUcMMwQTCwYPAQUIAQE4BBQ?= =?us-ascii?q?cAiYCNCsNCAEBHoJPAYJVAw4gAQEDC4wejzQBgToCixmBMoEBggcBAQYEBIJ?= =?us-ascii?q?NgwMYWIFZAwYJAYEGKgGCeosUEIFVRIEVJwwDhC4BgV0CgSYFARIBgziCZIQ?= =?us-ascii?q?FgRGBH5EuRal2LAeBd4EjgSYGC4MghTSTRQUQJINdixmFdAaQYqFRmAsCBAI?= =?us-ascii?q?EBQIOAQEGgWuBDnBNJIMEAQEyUBcCDo42g1mFFIVMcTgCBgEJAQEDCVshhTu?= =?us-ascii?q?CKQGBEAEB?= X-IPAS-Result: =?us-ascii?q?A2EUDQD1ia5g/xmnZsBagQmBWYFRUX6BQguEPYNJAQGFO?= =?us-ascii?q?YhBCJosgUKBEQNUCwEBAQEBAQEBAQgBNwgCBAEBAwOFAYFLASU4EwIEAQEBE?= =?us-ascii?q?gEBBgEBAQEBBgQCAoEAhWgNQxYBgnuBCAEBAQEBAQEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQUCQUcMMwQTCwYPAQUIAQE4BBQcAiYCNCsNCAEBH?= =?us-ascii?q?oJPAYJVAw4gAQEDC4wejzQBgToCixmBMoEBggcBAQYEBIJNgwMYWIFZAwYJA?= =?us-ascii?q?YEGKgGCeosUEIFVRIEVJwwDhC4BgV0CgSYFARIBgziCZIQFgRGBH5EuRal2L?= =?us-ascii?q?AeBd4EjgSYGC4MghTSTRQUQJINdixmFdAaQYqFRmAsCBAIEBQIOAQEGgWuBD?= =?us-ascii?q?nBNJIMEAQEyUBcCDo42g1mFFIVMcTgCBgEJAQEDCVshhTuCKQGBEAEB?= X-IronPort-AV: E=Sophos;i="5.82,331,1613430000"; d="scan'208";a="43070384" Received: from mail-mtadd25.fraunhofer.de ([192.102.167.25]) by mail-edgeDD24.fraunhofer.de with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 May 2021 19:54:29 +0200 IronPort-SDR: 9ev2ovgQG07ZZ8t+Jw0yyD2HQy7HdpWyxoy/2mhV1iih2vPmE7RKhrlqAhZCpxZ5Y2wdq3qFJ9 6VEUvMg8yjgP7xhUsjnDt3ioLAQTm8V0A= IronPort-PHdr: =?us-ascii?q?A9a23=3AxsA33B/0gC0HN/9uWMHoyV9kXcBvk7T5IgBT7?= =?us-ascii?q?YAo2PpCcaWmqpLlOkGXpfBgl0TAUoiT7fVYw/HXvKbtVS1lg96BvXkOfYYKW?= =?us-ascii?q?0oDjsMbzA0tHMDDDlf0f7bmaiUgF5FEU1lot3iwLUlSHpP4YFvf6n2/5DIfA?= =?us-ascii?q?FPxLw1wc//0Bsjclc2q0eC19ZDJJQlF11KA?= IronPort-HdrOrdr: =?us-ascii?q?A9a23=3AmVuCra7SLi+DR4k+/wPXwdqBI+orL9Y04l?= =?us-ascii?q?Q7vn2ZFiY7TiXIrayTdaoguCMc6AxxZJhSo6H6BEDmewKnyXcV2/hoAV7GZm?= =?us-ascii?q?fbUQSTXedfBOfZsl/d8k7Fh5BgPMVbAs9D4bTLZDAQ56aKg3jJLz9J+qj5zE?= =?us-ascii?q?nCv5a6854Cd3APV0gt1XYBNu7NeXcGODWuSKBJX6Z1iaF81nCdUEVSSv7+Km?= =?us-ascii?q?gOXuDFqdGOvonhewQ6Cxku7xTLpS+06ZbheiLokSs2Yndq+/MP4GLFmwv26u?= =?us-ascii?q?GIqPeg0CLR0GfV8tB/hMbh8N1eH8aB4/JlZgkEsjzYJbiJZofy/Azc+IqUmR?= =?us-ascii?q?UXeZj30lod1v1Imj3sljrfm2qu5+GIuwxemkMLyjej8A3eSILCNXcH4vF69P?= =?us-ascii?q?Bkmy3imj0dVeFHodF2Nl2ixu9q5DP77W3ADovzJllXfnTdmwtXrQdFtQ0jbW?= =?us-ascii?q?JZUs4UkbAi?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BKJACYiq5g/z6wYZlaHgEBCxIMQAm?= =?us-ascii?q?BUIFRUQdMK1olQwuEPYNJAQGFOYZPgXIIYAGZS4FCgREDVAsBAwEBAQEBCAE?= =?us-ascii?q?EMwcBAgQBAYUHgUgCJjgTAgQBAQESAQEFAQEBAgEGBHEThWgNQxYBhWwEEws?= =?us-ascii?q?GDwEFCAEBFCQEFBwCJgI0ByQNCAEBHoJPAYJVAw4gAgMLjCKPNAGBOgKLGYE?= =?us-ascii?q?ygQGCBwEBBgQEgk2DBBhYgVkDBgkBgQYqAYJ6iySBVUSBFScMA4QuAYFdAoE?= =?us-ascii?q?mBQESAYM4gmSEBYERgR+RLkWpdiwHgXeBI4EmBguDIIU0k0UFECSDXYsZhXQ?= =?us-ascii?q?GkGKhUZgLAgQCBAUCDgEBBoFrJGlwTSSDBAEBMlAXAg6OHxeDWYUUhUxxOAI?= =?us-ascii?q?GAQkBAQMJWQEBIYU7gikBgRABAQ?= X-IronPort-AV: E=Sophos;i="5.82,331,1613430000"; d="scan'208";a="112048704" Received: from 153-97-176-62.vm.c.fraunhofer.de (HELO mobile.exch.fraunhofer.de) ([153.97.176.62]) by mail-mtaDD25.fraunhofer.de with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 May 2021 19:54:20 +0200 Received: from XCH-HYBRID-02.ads.fraunhofer.de (10.225.8.59) by XCH-HYBRID-01.ads.fraunhofer.de (10.225.8.57) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.858.12; Wed, 26 May 2021 19:54:20 +0200 Received: from EUR04-DB3-obe.outbound.protection.outlook.com (10.225.8.37) by XCH-HYBRID-02.ads.fraunhofer.de (10.225.8.59) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.858.12 via Frontend Transport; Wed, 26 May 2021 19:54:20 +0200 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=j+XH2+zIR2T+7R/UnjRgQo0IKj9GrptiuoPvhgP6dQQcyGPX6UGj/87dh3dZQOEyM9/xpgMQ4niZNw3eUgeAdYABaGzffSc6r0OefsZLcnwHfXD5ili1i+rxaKkUhFZs4CqPoGPfqsnrN9Qps7QM3X81jW6RmDzCqQjljB3I+KGGucdSflkG68FMIrN6muA0k7gXKmDbsxAFIuDSIMkVTTygU6oL1aycNdR7s9CEynj1jhOP1wG0Rw0YZpT5FRfTNGYBG1idD8BOuQk3V4L1BwZMcDbzFiO/IP3w+WkUcITqGeNvCl8IjBQfGO9kRIAVvTCf3kmaiABz+/gcWvmYUg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CY345Xpm/vo2BsJly8UZnFV1FU8WCt5gddsoE2164fc=; b=HsnSbMWUPKeueHnPwHmNagOUt2stRJM8DcPA5fdPhnGNj9ejIhvWArRI8/QgXHaeSsprZz4Wc2x5XgmD/cnaR0tP3ua7SOA5OCrCuVQqbCHWtmxrqNcIRJanjSpK2qiz4uq880DTCtFpX/QAq6hM6VZm/hyIw03ZHM7btwRUycAj6+35Z13cBhXzry4DGDsGY/rD6Wx7N0PsuUf28aDZ0E/iI6KjIfOd+DAjIbg+ccu6XOmO8NvKAiR9/xYgatDJMJHx78FWwjbjIGDvflATHmH9YuQdUZTF586DjlgrkuXV+QSuKM+Xt4WfWM5A9b/C+rPkq4VVvMFmdw/hqYQd6Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=sit.fraunhofer.de; dmarc=pass action=none header.from=sit.fraunhofer.de; dkim=pass header.d=sit.fraunhofer.de; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fraunhofer.onmicrosoft.com; s=selector2-fraunhofer-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CY345Xpm/vo2BsJly8UZnFV1FU8WCt5gddsoE2164fc=; b=fBtJ0a4z8gMo0HbXh9uqkmwh2maUbGjd+IKeQAc3vDAfsQAEpn0L39IQOKatgQPwjVLVlfTyDpDhIntuhdZBlwKIe9pITlehIFxL6IuZ5i0LH0DIoFqpFf201TXBKbuTeZ9jXJ8IblTXC3Jz/ze4ZP7NQXUj4rXpoXe8LGSYl8U= Authentication-Results: ietf.org; dkim=none (message not signed) header.d=none; ietf.org; dmarc=none action=none header.from=sit.fraunhofer.de; Received: from DU2P194MB1709.EURP194.PROD.OUTLOOK.COM (2603:10a6:10:276::9) by DB6P194MB0070.EURP194.PROD.OUTLOOK.COM (2603:10a6:4:c6::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4150.27; Wed, 26 May 2021 17:54:19 +0000 Received: from DU2P194MB1709.EURP194.PROD.OUTLOOK.COM ([fe80::ac4d:c6fc:9d66:ba8f]) by DU2P194MB1709.EURP194.PROD.OUTLOOK.COM ([fe80::ac4d:c6fc:9d66:ba8f%6]) with mapi id 15.20.4173.022; Wed, 26 May 2021 17:54:19 +0000 From: Henk Birkholz To: IOTOPS Working Group Message-ID: Date: Wed, 26 May 2021 19:54:17 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [79.206.151.153] X-ClientProxiedBy: PR0P264CA0267.FRAP264.PROD.OUTLOOK.COM (2603:10a6:100:1::15) To DU2P194MB1709.EURP194.PROD.OUTLOOK.COM (2603:10a6:10:276::9) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from [192.168.16.50] (79.206.151.153) by PR0P264CA0267.FRAP264.PROD.OUTLOOK.COM (2603:10a6:100:1::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4173.20 via Frontend Transport; Wed, 26 May 2021 17:54:19 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: bbbca621-58df-43eb-7469-08d9206f4964 X-MS-TrafficTypeDiagnostic: DB6P194MB0070: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8882; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: AytpyiTN0MZDuXA/a53zWQauVjfYJZxWmoPwTjRHzdU9qpnXdIzJ/Gh0krny4X/1/5o3njrhx5pWmsBLtrKH88D9Q9oo/gYzSmX204452fhX2grVOZwlO2ZriZfAN4d12BDHBe9hcuyUBawm8llTs03tEgJXPivgbHSEAeWKspFD6kXbZyEIcSkPk2RWygEWDXTMHItlYGptYvs+Tf8WURKIMYtgDWKplAlBtL8oD67pHgEkpu1JCVT4f69QbCo4H6ADYl+7Wf1RvC9uO3phhgTgV39seDO2DEu9haZ9+807xC4prbFvZmi7ggxFfUbWHYch23Qoe/Od183fCp9InSQ8PsakQkhLsOHh7DNsOf3DxPFQuInj8TadyxIa+Orfy/Zdifx4LDS8kjCrBNQVuNStG1JAQpddJivZ0ny72j6aBX0U78R5ALDcJMpXvCWjYmpxVrIbLPCGChP6FMMWq5yRPX/jDwdDeRBhf8bwW6LgkuNusXjOc7d2tCoxHdBeuObn8VOHK4gjQfp+gSyypYT0V08KfoZLUnFXxdni22bdBFrfDKPHKT1XhIEhss8+1NU1xfc8T8pq0hKDeIvDvgafHlJ0RmTvqo3Eb1WOZkSnFH5eIkCdC48heGQmA5eRWF92GLM89XWAyT6S3INnuL+zkkncLvFvhtH2kqz88Spg9/RJ2VzGNYP+UXz0CY3pZyO4qHuuEHgeriPALhih4lZkMNDhnhxgBpSqLyXQIuf25dCJXqsqcGzF+6+vKwWmXjeyDdc4IMtqYT/JmELcqARPby8PKjcm30YWmSoa/QSbOff+fzjnfIJk5eQK/rM/4iXb/MQq62RvC69FlLqmFA== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DU2P194MB1709.EURP194.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(4636009)(396003)(346002)(136003)(39850400004)(376002)(366004)(8936002)(38350700002)(86362001)(52116002)(956004)(66476007)(31686004)(83380400001)(186003)(6916009)(478600001)(966005)(2906002)(8676002)(38100700002)(66556008)(31696002)(44832011)(4744005)(2616005)(6486002)(16576012)(316002)(26005)(5660300002)(66946007)(16526019)(43740500002)(45980500001); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData: =?utf-8?B?VlVZUUdLWjFKZE9GeFRlL1pQQlpoQU5tQlBzMmNWMlRYUzdYeWRSZkQ0M2tI?= =?utf-8?B?WFpEUmZqcjI4dStVWFFFRkVXdDJwVzRUajQveFpsVU0yVEhFR3kvbHlON1Vp?= =?utf-8?B?a1BFMEsxZlZGNld0NGVPOTBsZUlXb1NDOUFYSUF6N1NFTXdSZjRoeVdrbTVE?= =?utf-8?B?b3plTUJadUdCQ3lVR1ZBMEQvZFBRZUVjSXJueWJqZUQ3d3lUbUZoa1c2dTVu?= =?utf-8?B?NFV2RW9KVjRLc200TTArcG9tNldZeDU2ckEvUURDVXM3QW9oWE5ZM2UxcjZt?= =?utf-8?B?VzlreVZYM2p5Lzlvb28rU1JSdFlWOXBvQVYxbnduTFNZekJPTnZWMkhaSEFO?= =?utf-8?B?WWcwbFJkMkdObDFYUHFITXZwUHp4THZ5S1N6bFh5Q0QwbnZ4ZkcyY2kxVnpE?= =?utf-8?B?TVdZWUlkQU53VDVGZFZGd25JdDV6dlBhYkdiV1ZwcXJTRk9YYTJNU1p4bzJG?= =?utf-8?B?ZGRya2hBNzVuZTZHd3JzdG8vcWdTNUhIQ1U4SGNQSU8zTmlabG81aURZZmhF?= =?utf-8?B?enpsOTcxVU5UeEhOcXhhbzloT00yU29KVXA4WldnbkZlU0ltdllLU0sveUxM?= =?utf-8?B?NnNURnovRFprakIvc2JKZndzMUlTSjl2TXpHT1F0dC9HNHhIcFlvQWxpR2Vr?= =?utf-8?B?VU1RZHl5K2tjd2ljangvNGJnWGdRMHZwKzJMOU9UR2E2T2RNNUdPclBMVE80?= =?utf-8?B?UXphT2svUzA4aVFESEJVd3I1eU1LdzN0M3FydHIvY1Z5WFJzQ3RzQ3I5MkVI?= =?utf-8?B?NGF5WWV1aW5iaG55Y0VCKzA1TDA4VVhvZkRVb1l5MHRQcmlOMTQrTG1BanRB?= =?utf-8?B?N3NhRytuMXZGeXRvSnFNSFdMTE80UXc3WmVEYWx3Q1ZLR0REeDY0MzVJZC9x?= =?utf-8?B?MHBvbENpeXB1V09xQmJDU1NYVzV4UTl2Tzh0RDJWWnJWK1FOdjVFUExzTGdo?= =?utf-8?B?L0EvbFhxZGtIdVBnaXBtR2F5U0lhTDE0RVdIQkk3WTY3YkVlaW5za0ZBbVpD?= =?utf-8?B?eEFGVVN5VVQ5cFBoOUg2cVpOTXJmWi9XRFZKWHhDL3FRWmU2bkcvREFmZlhK?= =?utf-8?B?Nng5RFZXS0Z4aVpRbm0zRlBqdW1nZFhSWjNhV0JsNmN1cytqNll1RWx4ckQ2?= =?utf-8?B?UHlCREV2M01CMjJzNjh6ZS9YUzRYTE14QTJSSEptUTR6QzZ6ZFk4ZUxtUmxm?= =?utf-8?B?ZkxJWEdjanA3TFFLckVRSzVIa0NQcGhrckd6OHYvOWZ0SjNhMFdVVkF3M3RV?= =?utf-8?B?N3JWQXFpZ200cUlWNHRmdFU2NExjck1JcnY4QzFxNTVYNWJrNHVNSTlvbldn?= =?utf-8?B?ZzVFWDZjS0h4UitlM21tVFBpRFgyRW9IaG9TS2paU3hEVWRNZTAyM3lnaUsw?= =?utf-8?B?VUQ4YTNnMTJ4Z203TzV5bm1CdWJMVUZGWllZQis4YlBsMkpQb1Z2bGQ2em56?= =?utf-8?B?c1hMajVjWW80dnNyUndjdHM3QVQzNkVGUkpERHhoVjhXSjdBSllCdTlpdHdR?= =?utf-8?B?MHNCOUxpczNicVJkNWgyUnNRdDZXTnlnVWJSQlRKRktERk1YdWswNFM5Sll0?= =?utf-8?B?bUNHQ2g4RkhRQ1FGMWVOekdySTd1dnJEV2FyNERpTGp2YVJOdHFWb2p0bjRj?= =?utf-8?B?aWhocHh2NGViTWI0akwwZ2hnZjZuOHhsc3pZLysrdTVLWDVveDlMbXpyazZl?= =?utf-8?B?NHFvV2JkWDh6ODNoYVB6ZUwxOUt1cFZzck9ydlU3aSt1bUg1R2NQR09vQWx1?= =?utf-8?Q?vppO6YaeAUNM6ajsVcX5kB+4e7UhH2a1iszn/Ty?= X-MS-Exchange-CrossTenant-Network-Message-Id: bbbca621-58df-43eb-7469-08d9206f4964 X-MS-Exchange-CrossTenant-AuthSource: DU2P194MB1709.EURP194.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 May 2021 17:54:19.5559 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: f930300c-c97d-4019-be03-add650a171c4 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: glIv2KPiVZck7daRIWzC0OF94wqLAJQuAEdHD8HL0UKs0UxWzGvf4yzzYxqBuROwa3ZJQNo/HIIrGS+Ba2y9SxzDRgMtNPjO+aohk0Ct2os= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6P194MB0070 X-OriginatorOrg: sit.fraunhofer.de Archived-At: Subject: [Iotops] NomCom 2021-2022 Call for Volunteers X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 May 2021 17:54:39 -0000 Dear IOTOPS members, please note that the NomCom 2021-2022 Call for Volunteers started today. > The IETF NomCom appoints people to fill the open slots on the IETF LLC, > IETF Trust, the IAB, and the IESG. > Ten voting members for the NomCom are selected in a verifiably random > way from a pool of volunteers. The more volunteers, the better chance we > have of choosing a random yet representative cross section of the IETF > population. The call's duration is 4 weeks and ends before 23:59 UTC on Wednesday June 23, 2021. Further details can be found in BCP 10 (RFC 8713) and of course the announcement email: > https://mailarchive.ietf.org/arch/msg/ietf-announce/T_WVH96pH-5QVTRqd0yTT1TaPaU/ Viele Grüße, Henk