randy/draft-l3dl-signing
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

full pass fixing lsor refs and some adjustments to new l3dl changes

Browse source
This commit is contained in:
Randy Bush 2019-10-03 15:06:34 -07:00
parent 141d1ba4ea
commit 785738788f
1 changed files with 10 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

20
draft-ymbk-lsvr-l3dl-signing.xml
View file

@ -58,12 +58,12 @@
<abstract> <abstract>
<t>The Layer 3 Discovery and Liveness protocol OPEN PDU contains a <t>The Layer 3 Discovery and Liveness protocol OPEN PDU may contain
key and a certificate, which can be used to verify signatures on a key and a certificate, which can be used to verify signatures on
subsequent PDUs. This document describes two mechanisms based on subsequent PDUs. This document describes two mechanisms based on
digital signatures, one that is Trust On First Use (TOFU), and one digital signatures, one that is Trust On First Use (TOFU), and one
that uses certificates to provide authentication as well as that uses certificates to provide authentication as well as session
session integrity.</t> integrity.</t>
</abstract> </abstract>
@ -84,7 +84,7 @@
<section anchor="intro" title="Introduction"> <section anchor="intro" title="Introduction">
<t>The Layer 3 Discovery and Liveness protocol [old ref because <t>The Layer 3 Discovery and Liveness protocol [old ref because
new draft not yet pushed] <xref target="I-D.ietf-lsvr-lsoe"/> OPEN new draft not yet pushed] <xref target="I-D.ietf-lsvr-l3dl"/> OPEN
PDU contains an algorithm specifier, a key, and a certificate, PDU contains an algorithm specifier, a key, and a certificate,
which can be used to verify signatures on subsequent PDUs. This which can be used to verify signatures on subsequent PDUs. This
document describes two methods of key generation and signing for document describes two methods of key generation and signing for
@ -387,9 +387,9 @@
<t>Modern key management allows for agility in 'rolling' to a new <t>Modern key management allows for agility in 'rolling' to a new
key or even algorithm in case of key expiry, key compromise, or key or even algorithm in case of key expiry, key compromise, or
merely prudence. Declaring a new key with an L3DL OPEN PDU would merely prudence. Declaring a new key with an L3DL OPEN PDU would
cause serious churn in topology as a new OPEN causes a withdraw of cause serious churn in topology as a new OPEN may cause a withdraw
previously announced encapsulations. Therefore, a gentler rekeying of previously announced encapsulations. Therefore, a gentler
is needed.</t> rekeying is needed.</t>
<!-- <!--
protocol "Type = 8:8,Payload Length:16,New Key Type:8,New Key Length:16,New Key ...:32,New Cert Length:16,New Certificate ...:32,Old Sig Type:8,Old Signature Length:16,Old Signature ...:40" protocol "Type = 8:8,Payload Length:16,New Key Type:8,New Key Length:16,New Key ...:32,New Cert Length:16,New Certificate ...:32,Old Sig Type:8,Old Signature Length:16,Old Signature ...:40"
@ -458,7 +458,7 @@
<t>The PKI-based method offers assurance that the certificate, and <t>The PKI-based method offers assurance that the certificate, and
hence the keying material, provided in the OPEN PDU are authorized hence the keying material, provided in the OPEN PDU are authorized
by a central authority, e.g. the Clos's network security team. The by a central authority, e.g. the network's network security team. The
onward assurance of talking to the same peer and data integrity are onward assurance of talking to the same peer and data integrity are
the same as in the TOFU method.</t> the same as in the TOFU method.</t>
@ -512,7 +512,7 @@
<references title="Normative References"> <references title="Normative References">
<?rfc include="reference.RFC.2119"?> <?rfc include="reference.RFC.2119"?>
<?rfc include="reference.RFC.8174"?> <?rfc include="reference.RFC.8174"?>
<?rfc include="reference.I-D.ietf-lsvr-lsoe"?> <?rfc include="reference.I-D.ietf-lsvr-l3dl"?>
</references> </references>
<!-- <!--
<references title="Informative References"> <references title="Informative References">