Diff: rfc8886v2.xml - rfc8886.xml

	rfc8886v2.xml	rfc8886.xml

	skipping to change at line 40 ¶	skipping to change at line 40 ¶
	<postal>	<postal>
	<street>1133 Innovation Way</street>	<street>1133 Innovation Way</street>
	<city>Sunnyvale</city>	<city>Sunnyvale</city>
	<region>CA</region>	<region>CA</region>
	<code>94089</code>	<code>94089</code>
	<country>United States of America</country>	<country>United States of America</country>
	</postal>	</postal>
	<email>cdoyle@juniper.net</email>	<email>cdoyle@juniper.net</email>
	</address>	</address>
	</author>	</author>

	<date month="August" year="2020"/>	<date month="September" year="2020"/>

	<keyword>autoboot</keyword>	<keyword>autoboot</keyword>
	<keyword>auto-boot</keyword>	<keyword>auto-boot</keyword>
	<keyword>autoinstall</keyword>	<keyword>autoinstall</keyword>
	<keyword>tftp</keyword>	<keyword>tftp</keyword>
	<keyword>install</keyword>	<keyword>install</keyword>
	<keyword>bunny</keyword>	<keyword>bunny</keyword>

	<abstract>	<abstract>


	skipping to change at line 214 ¶	skipping to change at line 214 ¶
	<section numbered="true" toc="default">	<section numbered="true" toc="default">
	<name>Device Key Generation</name>	<name>Device Key Generation</name>
	<t>Each device requires a public-private key pair and for the	<t>Each device requires a public-private key pair and for the
	public part to be published and retrievable by the operator. The	public part to be published and retrievable by the operator. The
	cryptographic algorithm and key lengths to be used are out of the scope	cryptographic algorithm and key lengths to be used are out of the scope
	of this document. This section illustrates one method, but, as with	of this document. This section illustrates one method, but, as with
	much of this document, the exact mechanism may vary by vendor.	much of this document, the exact mechanism may vary by vendor.

	Enrollment over Secure Transport <xref target="RFC7030"	Enrollment over Secure Transport <xref target="RFC7030"
	format="default"/> and possibly the Simple Certificate Enrollment	format="default"/> and possibly the Simple Certificate Enrollment

	Protocol <xref target="I-D.gutmann-scep" format="default"/> are	Protocol <xref target="RFC8894" format="default"/> are
	methods that vendors may want to consider.</t>	methods that vendors may want to consider.</t>
	<t>During the manufacturing stage, when the device is initially powered	<t>During the manufacturing stage, when the device is initially powered
	on, it will generate a public-private key pair. It will send its unique device	on, it will generate a public-private key pair. It will send its unique device
	identifier and the public key to the vendor's directory server	identifier and the public key to the vendor's directory server
	<xref target="RFC5280" format="default"/> to be published. The vendor's directory server	<xref target="RFC5280" format="default"/> to be published. The vendor's directory server
	should only accept certificates that are from the manufacturing	should only accept certificates that are from the manufacturing
	facility and that match vendor-defined policies (for example, extended	facility and that match vendor-defined policies (for example, extended
	key usage and extensions).	key usage and extensions).

	Note that some devices may be constrained and so may send	Note that some devices may be constrained and so may send

	skipping to change at line 522 ¶	skipping to change at line 522 ¶
	<t>Even when using a secure bootstrap mechanism, security-conscious	<t>Even when using a secure bootstrap mechanism, security-conscious
	operators may wish to bootstrap devices with a minimal or less-sensitive	operators may wish to bootstrap devices with a minimal or less-sensitive
	configuration and then replace this with a more complete one after	configuration and then replace this with a more complete one after
	install.</t>	install.</t>
	</section>	</section>

	</middle>	</middle>
	<back>	<back>

	<displayreference target="I-D.ietf-anima-bootstrapping-keyinfra" to="BRSKI"/>	<displayreference target="I-D.ietf-anima-bootstrapping-keyinfra" to="BRSKI"/>

	<displayreference target="I-D.gutmann-scep" to="SCEP"/>
	<displayreference target="I-D.ietf-opsawg-tacacs" to="TACACS"/>	<displayreference target="I-D.ietf-opsawg-tacacs" to="TACACS"/>

	<references>	<references>
	<name>Informative References</name>	<name>Informative References</name>
	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.8572.xml"/>	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.8572.xml"/>
	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.4122.xml"/>	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.4122.xml"/>
	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.2131.xml"/>	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.2131.xml"/>
	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.8415.xml"/>	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.8415.xml"/>
	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.2865.xml"/>	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.2865.xml"/>
	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.1350.xml"/>	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.1350.xml"/>
	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.8551.xml"/>	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.8551.xml"/>
	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.7030.xml"/>	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.7030.xml"/>
	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.5280.xml"/>	<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.5280.xml"/>

		<xi:include href="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.8894.xml"/>
	<xi:include
	href="https://www.rfc-editor.org/refs/bibxml3/reference.I-D.gutmann-scep.xml"/>

	<reference anchor='I-D.ietf-opsawg-tacacs'>	<reference anchor='I-D.ietf-opsawg-tacacs'>
	<front>	<front>
	<title>The TACACS+ Protocol</title>	<title>The TACACS+ Protocol</title>

	<author initials='T' surname='Dahm' fullname='Thorsten Dahm'>	<author initials='T' surname='Dahm' fullname='Thorsten Dahm'>
	<organization />	<organization />
	</author>	</author>

	<author initials='A' surname='Ota' fullname='Andrej Ota'>	<author initials='A' surname='Ota' fullname='Andrej Ota'>

	skipping to change at line 613 ¶	skipping to change at line 611 ¶
	in production.</t>	in production.</t>
	<t>It uses OpenSSL from the command line. In production, something more	<t>It uses OpenSSL from the command line. In production, something more
	automated would be used. In this example, the unique device identifier is the	automated would be used. In this example, the unique device identifier is the
	serial number of the router, SN19842256.</t>	serial number of the router, SN19842256.</t>
	<section numbered="true" toc="default">	<section numbered="true" toc="default">
	<name>Step 1: Generating the Certificate</name>	<name>Step 1: Generating the Certificate</name>
	<t>This step is performed by the router. It generates a key, then a	<t>This step is performed by the router. It generates a key, then a
	Certificate Signing Request (CSR), and then a self-signed certificate.</t>	Certificate Signing Request (CSR), and then a self-signed certificate.</t>
	<section numbered="true" toc="default">	<section numbered="true" toc="default">
	<name>Step 1.1: Generate the Private Key</name>	<name>Step 1.1: Generate the Private Key</name>

	<artwork name="" type="" align="left" alt=""><![CDATA[	<sourcecode name="" type=""><![CDATA[
	$ openssl ecparam -out privatekey.key -name prime256v1 -genkey	$ openssl ecparam -out privatekey.key -name prime256v1 -genkey
	$	$
	]]></artwork>	]]></sourcecode>
	</section>	</section>
	<section numbered="true" toc="default">	<section numbered="true" toc="default">
	<name>Step 1.2: Generate the Certificate Signing Request</name>	<name>Step 1.2: Generate the Certificate Signing Request</name>

	<artwork name="" type="" align="left" alt=""><![CDATA[	<sourcecode name="" type=""><![CDATA[
	$ openssl req -new -key key.pem -out SN19842256.csr	$ openssl req -new -key key.pem -out SN19842256.csr
	Common Name (e.g., server FQDN or YOUR name) []:SN19842256	Common Name (e.g., server FQDN or YOUR name) []:SN19842256

	]]></artwork>	]]></sourcecode>
	</section>	</section>
	<section numbered="true" toc="default">	<section numbered="true" toc="default">
	<name>Step 1.3: Generate the (Self-Signed) Certificate Itself</name>	<name>Step 1.3: Generate the (Self-Signed) Certificate Itself</name>

	<artwork name="" type="" align="left" alt=""><![CDATA[	<sourcecode name="" type=""><![CDATA[
	$ openssl req -x509 -days 36500 -key key.pem -in SN19842256.csr	$ openssl req -x509 -days 36500 -key key.pem -in SN19842256.csr
	-out SN19842256.crt	-out SN19842256.crt

	]]></artwork>	]]></sourcecode>
	<t>The router then sends the key to the vendor's key server for	<t>The router then sends the key to the vendor's key server for
	publication (not shown).</t>	publication (not shown).</t>
	</section>	</section>
	</section>	</section>
	<section numbered="true" toc="default">	<section numbered="true" toc="default">
	<name>Step 2: Generating the Encrypted Configuration</name>	<name>Step 2: Generating the Encrypted Configuration</name>
	<t>The operator now wants to deploy the new router.</t>	<t>The operator now wants to deploy the new router.</t>
	<t>They generate the initial configuration (using whatever magic tool	<t>They generate the initial configuration (using whatever magic tool
	generates router configs!), fetch the router's certificate, and	generates router configs!), fetch the router's certificate, and
	encrypt the configuration file to that key. This is done by the operator.</t>	encrypt the configuration file to that key. This is done by the operator.</t>
	<section numbered="true" toc="default">	<section numbered="true" toc="default">
	<name>Step 2.1: Fetch the Certificate</name>	<name>Step 2.1: Fetch the Certificate</name>

	<artwork name="" type="" align="left" alt=""><![CDATA[	<sourcecode name="" type=""><![CDATA[
	$ wget http://keyserv.example.net/certificates/SN19842256.crt	$ wget http://keyserv.example.net/certificates/SN19842256.crt

	]]></artwork>	]]></sourcecode>
	</section>	</section>
	<section numbered="true" toc="default">	<section numbered="true" toc="default">
	<name>Step 2.2: Encrypt the Configuration File</name>	<name>Step 2.2: Encrypt the Configuration File</name>
	<t>S/MIME is used here because it is simple to demonstrate. This is	<t>S/MIME is used here because it is simple to demonstrate. This is
	almost definitely not the best way to do this.</t>	almost definitely not the best way to do this.</t>

	<artwork name="" type="" align="left" alt=""><![CDATA[	<sourcecode name="" type=""><![CDATA[
	$ openssl smime -encrypt -aes-256-cbc -in SN19842256.cfg\	$ openssl smime -encrypt -aes-256-cbc -in SN19842256.cfg\
	-out SN19842256.enc -outform PEM SN19842256.crt	-out SN19842256.enc -outform PEM SN19842256.crt
	$ more SN19842256.enc	$ more SN19842256.enc
	-----BEGIN PKCS7-----	-----BEGIN PKCS7-----
	MIICigYJKoZIhvcNAQcDoIICezCCAncCAQAxggE+MIIBOgIBADAiMBUxEzARBgNV	MIICigYJKoZIhvcNAQcDoIICezCCAncCAQAxggE+MIIBOgIBADAiMBUxEzARBgNV
	BAMMClNOMTk4NDIyNTYCCQDJVuBlaTOb1DANBgkqhkiG9w0BAQEFAASCAQBABvM3	BAMMClNOMTk4NDIyNTYCCQDJVuBlaTOb1DANBgkqhkiG9w0BAQEFAASCAQBABvM3
	...	...
	LZoq08jqlWhZZWhTKs4XPGHUdmnZRYIP8KXyEtHt	LZoq08jqlWhZZWhTKs4XPGHUdmnZRYIP8KXyEtHt
	-----END PKCS7-----	-----END PKCS7-----

	]]></artwork>	]]></sourcecode>
	</section>	</section>
	<section numbered="true" toc="default">	<section numbered="true" toc="default">
	<name>Step 2.3: Copy Configuration to the Configuration Server</name>	<name>Step 2.3: Copy Configuration to the Configuration Server</name>

	<artwork name="" type="" align="left" alt=""><![CDATA[	<sourcecode name="" type=""><![CDATA[
	$ scp SN19842256.enc config.example.com:/tftpboot	$ scp SN19842256.enc config.example.com:/tftpboot

	]]></artwork>	]]></sourcecode>
	</section>	</section>
	</section>	</section>
	<section numbered="true" toc="default">	<section numbered="true" toc="default">
	<name>Step 3: Decrypting and Using the Configuration</name>	<name>Step 3: Decrypting and Using the Configuration</name>
	<t>When the router connects to the operator's network, it will detect	<t>When the router connects to the operator's network, it will detect
	that it does not have a valid configuration file and will start the	that it does not have a valid configuration file and will start the
	"autoboot" process. This is a well-documented process, but	"autoboot" process. This is a well-documented process, but
	the high-level overview is that it will use DHCP to obtain an IP	the high-level overview is that it will use DHCP to obtain an IP
	address and configuration server. It will then use TFTP to download a	address and configuration server. It will then use TFTP to download a
	configuration file, based upon its serial number (this document	configuration file, based upon its serial number (this document
	modifies the solution to fetch an encrypted configuration file (ending in	modifies the solution to fetch an encrypted configuration file (ending in
	.enc)). It will then decrypt the configuration file and install it.</t>	.enc)). It will then decrypt the configuration file and install it.</t>
	<section numbered="true" toc="default">	<section numbered="true" toc="default">
	<name>Step 3.1: Fetch Encrypted Configuration File from Configuration Server</name>	<name>Step 3.1: Fetch Encrypted Configuration File from Configuration Server</name>

	<artwork name="" type="" align="left" alt=""><![CDATA[	<sourcecode name="" type=""><![CDATA[
	$ tftp 2001:0db8::23 -c get SN19842256.enc	$ tftp 2001:0db8::23 -c get SN19842256.enc

	]]></artwork>	]]></sourcecode>
	</section>	</section>
	<section numbered="true" toc="default">	<section numbered="true" toc="default">
	<name>Step 3.2: Decrypt and Use the Configuration</name>	<name>Step 3.2: Decrypt and Use the Configuration</name>

	<artwork name="" type="" align="left" alt=""><![CDATA[	<sourcecode name="" type=""><![CDATA[
	$ openssl smime -decrypt -in SN19842256.enc -inform pkcs7\	$ openssl smime -decrypt -in SN19842256.enc -inform pkcs7\
	-out config.cfg -inkey key.pem	-out config.cfg -inkey key.pem

	]]></artwork>	]]></sourcecode>
	<t>If an attacker does not have the correct key, they will not be	<t>If an attacker does not have the correct key, they will not be
	able to decrypt the configuration file:</t>	able to decrypt the configuration file:</t>

	<artwork name="" type="" align="left" alt=""><![CDATA[	<sourcecode name="" type=""><![CDATA[
	$ openssl smime -decrypt -in SN19842256.enc -inform pkcs7\	$ openssl smime -decrypt -in SN19842256.enc -inform pkcs7\
	-out config.cfg -inkey wrongkey.pem	-out config.cfg -inkey wrongkey.pem
	Error decrypting PKCS#7 structure	Error decrypting PKCS#7 structure
	140352450692760:error:06065064:digital envelope	140352450692760:error:06065064:digital envelope
	routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:592:	routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:592:
	$ echo $?	$ echo $?

	4]]></artwork>	4]]></sourcecode>
	</section>	</section>
	</section>	</section>
	</section>	</section>
	<section numbered="false" toc="default">	<section numbered="false" toc="default">
	<name>Acknowledgments</name>	<name>Acknowledgments</name>
	<t>The authors wish to thank everyone who contributed, including	<t>The authors wish to thank everyone who contributed, including
	<contact fullname="Benoit Claise"/>, <contact fullname="Francis	<contact fullname="Benoit Claise"/>, <contact fullname="Francis
	Dupont"/>, <contact fullname="Mirja Kuehlewind"/>, <contact	Dupont"/>, <contact fullname="Mirja Kuehlewind"/>, <contact
	fullname="Sam Ribeiro"/>, <contact fullname="Michael Richardson"/>,	fullname="Sam Ribeiro"/>, <contact fullname="Michael Richardson"/>,
	<contact fullname="Sean Turner"/>, and <contact fullname="Kent	<contact fullname="Sean Turner"/>, and <contact fullname="Kent

End of changes. 21 change blocks.
	26 lines changed or deleted	24 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/