RFC 9646
Conveying a Certificate Signing Request (CSR) in a Secure Zero-Touch Provisioning (SZTP) Bootstrapping Request
RFC 9646: Conveying a Certificate Signing Request (CSR) in a Secure Zero-Touch Provisioning (SZTP) Bootstrapping Request 🎀
Okay bestie, this one is giving device identity realness 💅✨ It's an IETF doc from October 2024, on the Standards Track 👑. The authors are K. Watsen (Watsen Networks), R. Housley (Vigil Security), and S. Turner (sn3rd) 🫶. It Updates RFC 8572 🦋, and its ISSN is 2070-1721 🌈.
Abstract
So this doc adds an optional certificate signing request (CSR) to the input of the "get-bootstrapping-data" RPC from RFC 8572 💖. That lets a bootstrapping device ask for an identity certificate, like an LDevID from IEEE 802.1AR, and get it back inside the "onboarding information" in the RPC-reply 🧚.
Status of This Memo
Okay, the status bit: this is an Internet Standards Track document 📜. The IETF made it, it reflects what the IETF community agreed on, it got public review, and the IESG approved it for publication 🌸. If you want more on Internet Standards, check Section 2 of RFC 7841 🍓. For the current status, errata, and how to send feedback, go to https://www.rfc-editor.org/info/rfc9646 💜.
Copyright Notice
Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved. 🔒
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stood on the publication date 📖. Read them closely, because they spell out your rights and restrictions for this doc 🙈. Any Code Components pulled out of this doc must include Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as the Revised BSD License describes 💀.
Table of Contents
1. Introduction
1.1. Overview
1.2. Terminology
1.3. Requirements Language
1.4. Conventions
2. The "ietf-sztp-csr" Module
2.1. Data Model Overview
2.2. Example Usage
2.3. YANG Module
3. The "ietf-ztp-types" Module
3.1. Data Model Overview
3.2. YANG Module
4. Security Considerations
4.1. SZTP-Client Considerations
4.1.1. Ensuring the Integrity of Asymmetric Private Keys
4.1.2. Reuse of a Manufacturer-Generated Private Key
4.1.3. Replay Attack Protection
4.1.4. Connecting to an Untrusted Bootstrap Server
4.1.5. Selecting the Best Origin Authentication Mechanism
4.1.6. Clearing the Private Key and Associated Certificate
4.2. SZTP-Server Considerations
4.2.1. Verifying Proof-of-Possession
4.2.2. Verifying Proof-of-Origin
4.2.3. Supporting SZTP-Clients That Don't Trust the
SZTP-Server
4.3. Security Considerations for the "ietf-sztp-csr" YANG Module
4.4. Security Considerations for the "ietf-ztp-types" YANG
Module
5. IANA Considerations
5.1. The IETF XML Registry
5.2. The YANG Module Names Registry
6. References
6.1. Normative References
6.2. Informative References
Acknowledgements
Contributors
Authors' Addresses1. Introduction ✨
1.1. Overview
Okay so the big idea: this doc extends the input to the "get-bootstrapping-data" RPC from [RFC8572] so it can carry an optional certificate signing request (CSR) [RFC2986] 🦋. That means a bootstrapping device can also get an identity certificate, like an LDevID from [Std-802.1AR-2018], inside the "onboarding information" in the RPC-reply 💅.
The ability to get a certificate built for the production environment during bootstrapping is huge 🔥. It means you don't have to lean on the manufacturer Certification Authority (CA) 🙌. It also lets the bootstrapped device join production with the right identity and other attributes baked into its identity certificate (like an LDevID) 💖. Main character energy 👑.
Two YANG [RFC7950] modules are defined. The "ietf-ztp-types" module defines three YANG groupings for the messages in this doc 🧚. The "ietf-sztp-csr" module augments two of those groupings into the "get-bootstrapping-data" RPC, and it defines a YANG data structure [RFC8791] around the third grouping 🌈.
1.2. Terminology
This doc borrows these terms from [RFC8572] 📖:
- Bootstrap Server
- Bootstrapping Data
- Conveyed Information
- Device
- Manufacturer
- Onboarding Information
- Signed Data
It also defines some new ones 🍓:
- SZTP-client: "SZTP-client" means a "device" that uses a "bootstrap server" as its source of "bootstrapping data" 🫶.
- SZTP-server: "SZTP-server" is just another name for "bootstrap server," picked so it matches "SZTP-client" 💜.
1.3. Requirements Language
Here's where the BCP 14 vibes come in. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this doc are interpreted as described in BCP 14 [RFC2119] [RFC8174], but only when they show up in all capitals, exactly like that 🙈. Lowercase versions are just regular words, no cap 💅.
1.4. Conventions
Lots of the examples here use BASE64VALUE= as a placeholder for binary data that's been base64 encoded (per Section 9.8 of [RFC7950]) 🎀. Real base64 blobs are usually many lines long, which is super distracting in an example, so we use the placeholder instead 🌸.
Also, a bunch of examples have long lines that may be folded, as described in [RFC8792] ✨.
2. The "ietf-sztp-csr" Module
The "ietf-sztp-csr" module is a YANG 1.1 [RFC7950] module 💖. It augments the "ietf-sztp-bootstrap-server" module from [RFC8572], and it defines a YANG "structure" that gets carried in the "error-info" node from Section 7.1 of [RFC8040] 🧚.
2.1. Data Model Overview
Here's the tree diagram [RFC8340] for the "ietf-sztp-csr" module 🌳:
module: ietf-sztp-csr
augment /sztp-svr:get-bootstrapping-data/sztp-svr:input:
+---w (msg-type)?
+--:(csr-support)
| +---w csr-support
| +---w key-generation!
| | +---w supported-algorithms
| | +---w algorithm-identifier* binary
| +---w csr-generation
| +---w supported-formats
| +---w format-identifier* identityref
+--:(csr)
+---w (csr-type)
+--:(p10-csr)
| +---w p10-csr? ct:csr
+--:(cmc-csr)
| +---w cmc-csr? binary
+--:(cmp-csr)
+---w cmp-csr? binary
structure csr-request:
+-- key-generation!
| +-- selected-algorithm
| +-- algorithm-identifier binary
+-- csr-generation
| +-- selected-format
| +-- format-identifier identityref
+-- cert-req-info? ct:csr-infoSo the augmentation gives an SZTP-client two kinds of parameters to send to an SZTP-server 📬. The YANG structure gives the SZTP-server one collection of parameters to send back to the SZTP-client 💌.
Here's the order they get used in 🪄:
- The SZTP-client sends a "csr-support" node in a first "get-bootstrapping-data" request to the SZTP-server, to say it can generate CSRs 🙋♀️. This input says whether the SZTP-client can generate a new asymmetric key and, if it can, which key algorithms it supports, plus what kinds of CSR structures it can make 🔑.
- The SZTP-server replies with an error that carries the "csr-request" structure, asking the SZTP-client to generate a CSR 📝. That structure picks the key algorithm the SZTP-client should use for a new asymmetric key (if it's supported), the kind of CSR structure to generate, and optionally the content of the CSR itself 🎯.
- The SZTP-client sends one of the "*-csr" nodes in a second "get-bootstrapping-data" request to the SZTP-server 📤. That node carries the CSR the server asked for 💜.
- The SZTP-server replies with onboarding information to hand the signed certificate back to the SZTP-client 🎁. How that works is covered in Section 2.2 👀.
To show how the augmentation and structure from the "ietf-sztp-csr" module fit in, here are two more tree diagrams with those nodes placed where they actually get used 🧩.
First up, SZTP's "get-bootstrapping-data" RPC with the augmentation in place 🌷:
=============== NOTE: '\' line wrapping per RFC 8792 ================
module: ietf-sztp-bootstrap-server
rpcs:
+---x get-bootstrapping-data
+---w input
| +---w signed-data-preferred? empty
| +---w hw-model? string
| +---w os-name? string
| +---w os-version? string
| +---w nonce? binary
| +---w (sztp-csr:msg-type)?
| +--:(sztp-csr:csr-support)
| | +---w sztp-csr:csr-support
| | +---w sztp-csr:key-generation!
| | | +---w sztp-csr:supported-algorithms
| | | +---w sztp-csr:algorithm-identifier* bina\
ry
| | +---w sztp-csr:csr-generation
| | +---w sztp-csr:supported-formats
| | +---w sztp-csr:format-identifier* identit\
yref
| +--:(sztp-csr:csr)
| +---w (sztp-csr:csr-type)
| +--:(sztp-csr:p10-csr)
| | +---w sztp-csr:p10-csr? ct:csr
| +--:(sztp-csr:cmc-csr)
| | +---w sztp-csr:cmc-csr? binary
| +--:(sztp-csr:cmp-csr)
| +---w sztp-csr:cmp-csr? binary
+--ro output
+--ro reporting-level? enumeration {onboarding-server}?
+--ro conveyed-information cms
+--ro owner-certificate? cms
+--ro ownership-voucher? cmsAnd here's RESTCONF's "errors" RPC-reply message with the "csr-request" structure in place 🎀:
module: ietf-restconf
+--ro errors
+--ro error* []
+--ro error-type enumeration
+--ro error-tag string
+--ro error-app-tag? string
+--ro error-path? instance-identifier
+--ro error-message? string
+--ro error-info
+--ro sztp-csr:csr-request
+--ro sztp-csr:key-generation!
| +--ro sztp-csr:selected-algorithm
| +--ro sztp-csr:algorithm-identifier binary
+--ro sztp-csr:csr-generation
| +--ro sztp-csr:selected-format
| +--ro sztp-csr:format-identifier identityref
+--ro sztp-csr:cert-req-info? ct:csr-infoPart 1 of 6 wraps here, bestie 🫶. Section 2.2 "Example Usage" is up next in part 2 💖✨
2.2. Example Usage
NOTE: The examples below are encoded using JSON, but they could equally well be encoded using XML, as is supported by SZTP.
okay so an SZTP-client that follows this spec can tell the bootstrap server it's willing to generate a CSR 🫶 It does that by including the "csr-support" node in its "get-bootstrapping-data" RPC ✨ In the example below, the SZTP-client also says it can generate keys and lists the key algorithms it supports, plus the certificate formats it supports 🎀
REQUEST
=============== NOTE: '\' line wrapping per RFC 8792 ================
POST /restconf/operations/ietf-sztp-bootstrap-server:get-bootstrappi\
ng-data HTTP/1.1
HOST: example.com
Content-Type: application/yang-data+json
{
"ietf-sztp-bootstrap-server:input" : {
"hw-model": "model-x",
"os-name": "vendor-os",
"os-version": "17.3R2.1",
"nonce": "extralongbase64encodedvalue=",
"ietf-sztp-csr:csr-support": {
"key-generation": {
"supported-algorithms": {
"algorithm-identifier": [
"BASE64VALUE1",
"BASE64VALUE2",
"BASE64VALUE3"
]
}
},
"csr-generation": {
"supported-formats": {
"format-identifier": [
"ietf-ztp-types:p10-csr",
"ietf-ztp-types:cmc-csr",
"ietf-ztp-types:cmp-csr"
]
}
}
}
}
}If the SZTP-server wants the SZTP-client to hand over a CSR, it responds with an HTTP 400 Bad Request error code 🙈 In the example below, the SZTP-server says it wants the SZTP-client to generate a key using a specific algorithm and to generate a PKCS#10-based CSR containing specific content 💅
RESPONSE
HTTP/1.1 400 Bad Request
Date: Sat, 31 Oct 2021 17:02:40 GMT
Server: example-server
Content-Type: application/yang-data+json
{
"ietf-restconf:errors" : {
"error" : [
{
"error-type": "application",
"error-tag": "missing-attribute",
"error-message": "Missing input parameter",
"error-info": {
"ietf-sztp-csr:csr-request": {
"key-generation": {
"selected-algorithm": {
"algorithm-identifier": "BASE64VALUE="
}
},
"csr-generation": {
"selected-format": {
"format-identifier": "ietf-ztp-types:p10-csr"
}
},
"cert-req-info": "BASE64VALUE="
}
}
}
]
}
}Once it's been asked for a CSR, the SZTP-client sends another "get-bootstrapping-data" request, this time including one of the "csr" nodes so it can convey its CSR to the SZTP-server 📮
REQUEST
=============== NOTE: '\' line wrapping per RFC 8792 ================
POST /restconf/operations/ietf-sztp-bootstrap-server:get-bootstrappi\
ng-data HTTP/1.1
HOST: example.com
Content-Type: application/yang-data+json
{
"ietf-sztp-bootstrap-server:input" : {
"hw-model": "model-x",
"os-name": "vendor-os",
"os-version": "17.3R2.1",
"nonce": "extralongbase64encodedvalue=",
"ietf-sztp-csr:p10-csr": "BASE64VALUE="
}
}At this point the SZTP-server is expected to check the CSR's origin and proof-of-possession. It might do this with help from other systems, like a backend CA or registration authority (RA) 🧐 If the CSR gets approved, the server issues a signed certificate for the bootstrapping device ✨
The SZTP-server replies with conveyed information (the "conveyed-information" node shown below), and inside the base64 value is "onboarding-information" holding a signed identity certificate for the CSR the SZTP-client sent 🎁
RESPONSE
HTTP/1.1 200 OK
Date: Sat, 31 Oct 2021 17:02:40 GMT
Server: example-server
Content-Type: application/yang-data+json
{
"ietf-sztp-bootstrap-server:output" : {
"reporting-level": "verbose",
"conveyed-information": "BASE64VALUE="
}
}How the signed certificate gets conveyed inside the onboarding information is outside the scope of this document 🙈 Some implementations might put it inside a script (like SZTP's "pre-configuration-script"), while others might put it inside the SZTP "configuration" node. SZTP onboarding information is described in Section 2.2 of [RFC8572] 📚
Below are two examples of conveying the signed certificate inside the "configuration" node. Both assume the SZTP-client understands the "ietf-keystore" module defined in [RFC9642] 🔐
The first example is for the case where the signed certificate is for the same asymmetric key used by the SZTP-client's manufacturer-generated identity certificate (for instance, an Initial Device Identifier (IDevID) from [Std-802.1AR-2018]). So the configuration has to link the newly signed certificate to the existing asymmetric key 🦋
=============== NOTE: '\' line wrapping per RFC 8792 ================
{
"ietf-keystore:keystore": {
"asymmetric-keys": {
"asymmetric-key": [
{
"name": "Manufacturer-Generated Hidden Key",
"public-key-format": "ietf-crypto-types:subject-public-key\
-info-format",
"public-key": "BASE64VALUE=",
"hidden-private-key": [null],
"certificates": {
"certificate": [
{
"name": "Manufacturer-Generated IDevID Cert",
"cert-data": "BASE64VALUE="
},
{
"name": "Newly-Generated LDevID Cert",
"cert-data": "BASE64VALUE="
}
]
}
}
]
}
}
}The second example is for the case where the signed certificate is for a newly generated asymmetric key. So this time the configuration has to link the newly signed certificate to that newly generated key 🌈
=============== NOTE: '\' line wrapping per RFC 8792 ================
{
"ietf-keystore:keystore": {
"asymmetric-keys": {
"asymmetric-key": [
{
"name": "Manufacturer-Generated Hidden Key",
"public-key-format": "ietf-crypto-types:subject-public-key\
-info-format",
"public-key": "BASE64VALUE=",
"hidden-private-key": [null],
"certificates": {
"certificate": [
{
"name": "Manufacturer-Generated IDevID Cert",
"cert-data": "BASE64VALUE="
}
]
}
},
{
"name": "Newly-Generated Hidden Key",
"public-key-format": "ietf-crypto-types:subject-public-key\
-info-format",
"public-key": "BASE64VALUE=",
"hidden-private-key": [null],
"certificates": {
"certificate": [
{
"name": "Newly-Generated LDevID Cert",
"cert-data": "BASE64VALUE="
}
]
}
}
]
}
}
}Also, it's often necessary to configure the issuer's signing certificate too, so the device (the STZP-client) can authenticate certificates from peer devices that were signed by the same issuer as its own 🤝 That's outside the scope of this document, but one way to do it would be to use the "ietf-truststore" module defined in [RFC9641] 💜
2.3. YANG Module 🎀
okay bestie, this module augments an RPC defined in [RFC8572] 🫶 It uses data types and groupings from [RFC8572], [RFC8791], and [RFC9640], and it also has an informative reference to [Std-802.1AR-2018] 📚 the reference list is a lot, but it's all for a reason ✨
<CODE BEGINS> file "ietf-sztp-csr@2024-10-10.yang"
module ietf-sztp-csr {
yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-sztp-csr";
prefix sztp-csr;
import ietf-sztp-bootstrap-server {
prefix sztp-svr;
reference
"RFC 8572: Secure Zero Touch Provisioning (SZTP)";
}
import ietf-yang-structure-ext {
prefix sx;
reference
"RFC 8791: YANG Data Structure Extensions";
}
import ietf-ztp-types {
prefix zt;
reference
"RFC 9646: Conveying a Certificate Signing Request (CSR)
in a Secure Zero-Touch Provisioning (SZTP)
Bootstrapping Request";
}
organization
"IETF NETCONF (Network Configuration) Working Group";
contact
"WG Web: https://datatracker.ietf.org/wg/netconf
WG List: NETCONF WG list <mailto:netconf@ietf.org>
Authors: Kent Watsen <mailto:kent+ietf@watsen.net>
Russ Housley <mailto:housley@vigilsec.com>
Sean Turner <mailto:sean@sn3rd.com>";
description
"This module augments the 'get-bootstrapping-data' RPC,
defined in the 'ietf-sztp-bootstrap-server' module from
SZTP (RFC 8572), enabling the SZTP-client to obtain a
signed identity certificate (e.g., an LDevID from IEEE
802.1AR) as part of the SZTP onboarding information
response.
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this
document are to be interpreted as described in BCP 14
(RFC 2119) (RFC 8174) when, and only when, they appear
in all capitals, as shown here.
Copyright (c) 2024 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject to
the license terms contained in, the Revised BSD License set
forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC 9646
(https://www.rfc-editor.org/info/rfc9646); see the
RFC itself for full legal notices.";
revision 2024-10-10 {
description
"Initial version.";
reference
"RFC 9646: Conveying a Certificate Signing Request (CSR)
in a Secure Zero-Touch Provisioning (SZTP)
Bootstrapping Request";
}
// Protocol-accessible nodes
augment "/sztp-svr:get-bootstrapping-data/sztp-svr:input" {
description
"This augmentation adds the 'csr-support' and 'csr' nodes to
the SZTP (RFC 8572) 'get-bootstrapping-data' request message,
enabling the SZTP-client to obtain an identity certificate
(e.g., an LDevID from IEEE 802.1AR) as part of the onboarding
information response provided by the SZTP-server.
The 'csr-support' node enables the SZTP-client to indicate
that it supports generating certificate signing requests
(CSRs) and to provide details around the CSRs it is able
to generate.
The 'csr' node enables the SZTP-client to relay a CSR to
the SZTP-server.";
reference
"IEEE 802.1AR: IEEE Standard for Local and Metropolitan
Area Networks - Secure Device Identity
RFC 8572: Secure Zero Touch Provisioning (SZTP)";
choice msg-type {
description
"Messages are mutually exclusive.";
case csr-support {
description
"Indicates how the SZTP-client supports generating CSRs.
If present and a SZTP-server wishes to request the
SZTP-client generate a CSR, the SZTP-server MUST
respond with an HTTP 400 Bad Request error code with an
'ietf-restconf:errors' message having the 'error-tag'
value 'missing-attribute' and the 'error-info' node
containing the 'csr-request' structure described
in this module.";
uses zt:csr-support-grouping;
}
case csr {
description
"Provides the CSR generated by the SZTP-client.
When present, the SZTP-server SHOULD respond with
an SZTP onboarding information message containing
a signed certificate for the conveyed CSR. The
SZTP-server MAY alternatively respond with another
HTTP error containing another 'csr-request'; in
which case, the SZTP-client MUST delete any key
generated for the previously generated CSR.";
uses zt:csr-grouping;
}
}
}
sx:structure csr-request {
description
"A YANG data structure, per RFC 8791, that specifies
details for the CSR that the ZTP-client is to generate.";
reference
"RFC 8791: YANG Data Structure Extensions";
uses zt:csr-request-grouping;
}
}
<CODE ENDS>3. The "ietf-ztp-types" Module 💜
this section defines a YANG 1.1 [RFC7950] module that defines three YANG groupings, one for each message sent between a ZTP-client and ZTP-server 🧚 it's defined independently of the ietf-sztp-csr module so that its groupings can be used by bootstrapping protocols other than SZTP [RFC8572] 💅
3.1. Data Model Overview 🌈
the following tree diagram [RFC8340] illustrates the three groupings defined in the ietf-ztp-types module 🍓
module: ietf-ztp-types
grouping csr-support-grouping
+-- csr-support
+-- key-generation!
| +-- supported-algorithms
| +-- algorithm-identifier* binary
+-- csr-generation
+-- supported-formats
+-- format-identifier* identityref
grouping csr-request-grouping
+-- key-generation!
| +-- selected-algorithm
| +-- algorithm-identifier binary
+-- csr-generation
| +-- selected-format
| +-- format-identifier identityref
+-- cert-req-info? ct:csr-info
grouping csr-grouping
+-- (csr-type)
+--:(p10-csr)
| +-- p10-csr? ct:csr
+--:(cmc-csr)
| +-- cmc-csr? binary
+--:(cmp-csr)
+-- cmp-csr? binary3.2. YANG Module 🦋
this module uses data types and groupings defined in [RFC8791] and [RFC9640] 🫧 it has additional normative references to [RFC2986], [RFC4210], [RFC5272], and [ITU.X690.2021], plus an informative reference to [Std-802.1AR-2018] ✨
<CODE BEGINS> file "ietf-ztp-types@2024-10-10.yang"
module ietf-ztp-types {
yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-ztp-types";
prefix zt;
import ietf-crypto-types {
prefix ct;
reference
"RFC 9640: YANG Data Types and Groupings for Cryptography";
}
organization
"IETF NETCONF (Network Configuration) Working Group";
contact
"WG Web: https://datatracker.ietf.org/wg/netconf
WG List: NETCONF WG list <mailto:netconf@ietf.org>
Authors: Kent Watsen <mailto:kent+ietf@watsen.net>
Russ Housley <mailto:housley@vigilsec.com>
Sean Turner <mailto:sean@sn3rd.com>";
description
"This module defines three groupings that enable
bootstrapping devices to 1) indicate if and how they
support generating CSRs, 2) obtain a request to
generate a CSR, and 3) communicate the requested CSR.
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this
document are to be interpreted as described in BCP 14
(RFC 2119) (RFC 8174) when, and only when, they appear
in all capitals, as shown here.
Copyright (c) 2024 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject to
the license terms contained in, the Revised BSD License set
forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC 9646
(https://www.rfc-editor.org/info/rfc9646); see the
RFC itself for full legal notices.";
revision 2024-10-10 {
description
"Initial version.";
reference
"RFC 9646: Conveying a Certificate Signing Request (CSR)
in a Secure Zero-Touch Provisioning (SZTP)
Bootstrapping Request";
}
identity certificate-request-format {
description
"A base identity for the request formats supported
by the ZTP-client.
Additional derived identities MAY be defined by
future efforts.";
}
identity p10-csr {
base certificate-request-format;
description
"Indicates that the ZTP-client supports generating
requests using the 'CertificationRequest' structure
defined in RFC 2986.";
reference
"RFC 2986: PKCS #10: Certification Request Syntax
Specification Version 1.7";
}
identity cmp-csr {
base certificate-request-format;
description
"Indicates that the ZTP-client supports generating
requests using a profiled version of the PKIMessage
that MUST contain a PKIHeader followed by a PKIBody
containing only the ir, cr, kur, or p10cr structures
defined in RFC 4210.";
reference
"RFC 4210: Internet X.509 Public Key Infrastructure
Certificate Management Protocol (CMP)";
}
identity cmc-csr {
base certificate-request-format;
description
"Indicates that the ZTP-client supports generating
requests using a profiled version of the 'Full
PKI Request' structure defined in RFC 5272.";
reference
"RFC 5272: Certificate Management over CMS (CMC)";
}
// Protocol-accessible nodes
grouping csr-support-grouping {
description
"A grouping enabling use by other efforts.";
container csr-support {
description
"Enables a ZTP-client to indicate that it supports
generating certificate signing requests (CSRs) and
provides details about the CSRs it is able to
generate.";
container key-generation {
presence "Indicates that the ZTP-client is capable of
generating a new asymmetric key pair.Okay so picking up right where the CSR stuff gets going 💅
If this node is not present, the ZTP-server MAY
request a CSR using the asymmetric key associated
with the device's existing identity certificate
(e.g., an IDevID from IEEE 802.1AR).";
description
"Specifies details for the ZTP-client's ability to
generate a new asymmetric key pair.";
container supported-algorithms {
description
"A list of public key algorithms supported by the
ZTP-client for generating a new asymmetric key.";
leaf-list algorithm-identifier {
type binary;
min-elements 1;
description
"An AlgorithmIdentifier, as defined in RFC 2986,
encoded using ASN.1 Distinguished Encoding Rules
(DER), as specified in ITU-T X.690.";
reference
"RFC 2986: PKCS #10: Certification Request Syntax
Specification Version 1.7
ITU-T X.690:
Information technology - ASN.1 encoding rules:
Specification of Basic Encoding Rules (BER),
Canonical Encoding Rules (CER) and Distinguished
Encoding Rules (DER)";
}
}
}
container csr-generation {
description
"Specifies details for the ZTP-client's ability to
generate certificate signing requests.";
container supported-formats {
description
"A list of certificate request formats supported
by the ZTP-client for generating a new key.";
leaf-list format-identifier {
type identityref {
base zt:certificate-request-format;
}
min-elements 1;
description
"A certificate request format supported by the
ZTP-client.";
}
}
}
}
}So if the server leaves that node out, it may still ask for a CSR, signed with the key behind the device's existing identity cert (like an IDevID from IEEE 802.1AR) 🔑✨ The key-pair bit lists the algorithms the client can generate, and the CSR bit lists the request formats it supports. Both lists need at least one entry, so the client has to say something, bestie 🫶
grouping csr-request-grouping {
description
"A grouping enabling use by other efforts.";
container key-generation {
presence "Provided by a ZTP-server to indicate that it wishes
the ZTP-client to generate a new asymmetric key.
This statement is present so the mandatory
descendant nodes do not imply that this node must
be configured.";
description
"The key generation parameters selected by the ZTP-server.
This leaf MUST only appear if the ZTP-client's
'csr-support' included the 'key-generation' node.";
container selected-algorithm {
description
"The key algorithm selected by the ZTP-server. The
algorithm MUST be one of the algorithms specified by
the 'supported-algorithms' node in the ZTP-client's
message containing the 'csr-support' structure.";
leaf algorithm-identifier {
type binary;
mandatory true;
description
"An AlgorithmIdentifier, as defined in RFC 2986,
encoded using ASN.1 Distinguished Encoding Rules
(DER), as specified in ITU-T X.690.";
reference
"RFC 2986: PKCS #10: Certification Request Syntax
Specification Version 1.7
ITU-T X.690:
Information technology - ASN.1 encoding rules:
Specification of Basic Encoding Rules (BER),
Canonical Encoding Rules (CER) and Distinguished
Encoding Rules (DER)";
}
}
}
container csr-generation {
description
"Specifies details for the CSR that the ZTP-client
is to generate.";
container selected-format {
description
"The CSR format selected by the ZTP-server. The
format MUST be one of the formats specified by
the 'supported-formats' node in the ZTP-client's
request message.";
leaf format-identifier {
type identityref {
base zt:certificate-request-format;
}
mandatory true;
description
"A certificate request format to be used by the
ZTP-client.";
}
}
}Now the server is the one calling the shots 👑 When it picks a key algorithm, that choice has to come from the list the client sent in csr-support, and the key-generation container only shows up if the client actually said it can generate keys. The csr-generation part works the same way with CSR formats. The presence note is important: its mandatory children don't mean the node has to be configured. Iconic design, honestly 😭
leaf cert-req-info {
type ct:csr-info;
description
"A CertificationRequestInfo structure, as defined in
RFC 2986, and modeled via a 'typedef' statement by
RFC 9640.
Enables the ZTP-server to provide a fully populated
CertificationRequestInfo structure that the ZTP-client
only needs to sign in order to generate the complete
'CertificationRequest' structure to send to the ZTP-server
in its next 'get-bootstrapping-data' request message.
When provided, the ZTP-client MUST use this structure
to generate its CSR; failure to do so will result in a
400 Bad Request response containing another 'csr-request'
structure.
When not provided, the ZTP-client SHOULD generate a CSR
using the same structure defined in its existing identity
certificate (e.g., an IDevID from IEEE 802.1AR).
If the 'AlgorithmIdentifier' field contained inside the
certificate 'SubjectPublicKeyInfo' field does not match
the algorithm identified by the 'selected-algorithm' node,
then the client MUST reject the certificate and raise an
error.";
reference
"RFC 2986:
PKCS #10: Certification Request Syntax Specification
Version 1.7
RFC 9640:
YANG Data Types and Groupings for Cryptography";
}
}The cert-req-info leaf is the server basically pre-filling the homework 📝 It hands over a complete CertificationRequestInfo, and the client just signs it and sends back the finished request in its next get-bootstrapping-data call. If the server sends one, the client has to use it, or it gets a 400 Bad Request back with another csr-request attached. If the server doesn't send one, the client should build its CSR from the same structure as its existing identity cert, like an IDevID 🎀 And if the algorithm in the cert's public key info doesn't match selected-algorithm, the client has to reject that cert and raise an error. No cap, that's a whole main character moment 💀
grouping csr-grouping {
description
"Enables a ZTP-client to convey a certificate signing
request, using the encoding format selected by a
ZTP-server's 'csr-request' response to the ZTP-client's
previously sent request containing the 'csr-support'
node.";
choice csr-type {
mandatory true;
description
"A choice amongst certificate signing request formats.
Additional formats MAY be augmented into this 'choice'
statement by future efforts.";
case p10-csr {
leaf p10-csr {
type ct:p10-csr;
description
"A CertificationRequest structure, per RFC 2986.
Encoding details are defined in the 'ct:csr'
typedef defined in RFC 9640.
A raw P10 does not support origin authentication in
the CSR structure. External origin authentication
may be provided via the ZTP-client's authentication
to the ZTP-server at the transport layer (e.g., TLS).";
reference
"RFC 2986: PKCS #10: Certification Request Syntax
Specification Version 1.7
RFC 9640: YANG Data Types and Groupings for
Cryptography";
}
}
case cmc-csr {
leaf cmc-csr {
type binary;
description
"A profiled version of the 'Full PKI Request'
message defined in RFC 5272, encoded using ASN.1
Distinguished Encoding Rules (DER), as specified
in ITU-T X.690.
For asymmetric-key-based origin authentication of a
CSR based on the initial device identity certificate's
private key for the associated identity certificate's
public key, the PKIData contains one reqSequence
element and no cmsSequence or otherMsgSequence
elements. The reqSequence is the TaggedRequest,
and it is the tcr CHOICE branch. The tcr is the
TaggedCertificationRequest, and it is the bodyPartID
and the certificateRequest elements. The
certificateRequest is signed with the initial device
identity certificate's private key. The initial device
identity certificate, and optionally its certificate
chain is included in the SignedData certificates that
encapsulate the PKIData.
For asymmetric-key-based origin authentication based on
the initial device identity certificate's private key
that signs the encapsulated CSR signed by the local
device identity certificate's private key, the
PKIData contains one cmsSequence element and no
reqSequence or otherMsgSequence
elements. The cmsSequence is the TaggedContentInfo,
and it includes a bodyPartID element and a contentInfo.
The contentInfo is a SignedData encapsulating a PKIData
with one reqSequence element and no cmsSequence or
otherMsgSequence elements. The reqSequence is the
TaggedRequest, and it is the tcr CHOICE. The tcr is the
TaggedCertificationRequest, and it is the bodyPartID and
the certificateRequest elements. PKIData contains one
cmsSequence element and no controlSequence, reqSequence,
or otherMsgSequence elements. The certificateRequest
is signed with the local device identity certificate's
private key. The initial device identity certificate
and optionally its certificate chain is included in
the SignedData certificates that encapsulate the
PKIData.
For shared-secret-based origin authentication of a
CSR signed by the local device identity certificate's
private key, the PKIData contains one cmsSequence
element and no reqSequence or otherMsgSequence
elements. The cmsSequence is the TaggedContentInfo,
and it includes a bodyPartID element and a contentInfo.
The contentInfo is an AuthenticatedData encapsulating
a PKIData with one reqSequence element and no
cmsSequences or otherMsgSequence elements. The
reqSequence is the TaggedRequest, and it is the tcr
CHOICE. The tcr is the TaggedCertificationRequest,
and it is the bodyPartID and the certificateRequest
elements. The certificateRequest is signed with the
local device identity certificate's private key. The
initial device identity certificate and optionally its
certificate chain is included in the SignedData
certificates that encapsulate the PKIData.";
reference
"RFC 5272: Certificate Management over CMS (CMC)
ITU-T X.690:
Information technology - ASN.1 encoding rules:
Specification of Basic Encoding Rules (BER),
Canonical Encoding Rules (CER) and Distinguished
Encoding Rules (DER)";
}
}
case cmp-csr {
leaf cmp-csr {
type binary;
description
"A PKIMessage structure, as defined in RFC 4210,
encoded using ASN.1 Distinguished Encoding Rules
(DER), as specified in ITU-T X.690.Okay, the csr-grouping is where the client actually sends its CSR back 📬 The choice has to be one of the formats, and more can be added in the future, so it's not a closed club 🦋 The first option, p10-csr, is a plain PKCS #10 request. It can't do origin authentication by itself, so any proof that the client is who it says it is has to come from the transport layer, like TLS 🔐
The cmc-csr option is a profiled "Full PKI Request" from RFC 5272, DER-encoded, and it's the most detailed one. It covers three origin-authentication setups:
- Asymmetric key, direct: The device's initial identity cert private key signs the request for the associated identity cert's public key. PKIData holds one reqSequence, and the CSR is signed with the initial identity cert's private key.
- Asymmetric key, nested: The initial identity cert private key signs an inner CSR that's already signed by the local identity cert's private key. PKIData holds one cmsSequence, which wraps a SignedData that has one reqSequence.
- Shared secret: The CSR is signed by the local identity cert's private key, and the outer layer is an AuthenticatedData wrapping a PKIData with one reqSequence.
In all three cases, the initial identity cert (plus its chain, if included) rides along in the SignedData certificates. Very detailed, very slay 💅
The cmp-csr option is a PKIMessage from RFC 4210, also DER-encoded. Its description keeps going from here ✨
For asymmetric-key-based origin authentication of a
CSR based on the initial device identity certificate's
private key for the associated initial device identity
certificate's public key, PKIMessages contain one
PKIMessage with the header and body elements, do not
contain a protection element, and SHOULD contain the
extraCerts element. The header element contains the
pvno, sender, and recipient elements. The pvno contains
cmp2000, and the sender contains the subject of the
initial device identity certificate. The body element
contains an ir, cr, kur, or p10cr CHOICE of type
CertificationRequest. It is signed with the initial
device identity certificate's private key. The
extraCerts element contains the initial device identity
certificate, optionally followed by its certificate
chain excluding the trust anchor.
For asymmetric-key-based origin authentication based
on the initial device identity certificate's private
key that signs the encapsulated CSR signed by the local
device identity certificate's private key, PKIMessages
contain one PKIMessage with the header, body, and
protection elements and SHOULD contain the extraCerts
element. The header element contains the pvno, sender,
recipient, protectionAlg, and optionally senderKID
elements. The pvno contains cmp2000, the sender
contains the subject of the initial device identity
certificate, the protectionAlg contains the
AlgorithmIdentifier of the used signature algorithm,
and the senderKID contains the subject key identifier
of the initial device identity certificate. The body
element contains an ir, cr, kur, or p10cr CHOICE of
type CertificationRequest. It is signed with the local
device identity certificate's private key. The
protection element contains the digital signature
generated with the initial device identity
certificate's private key. The extraCerts element
contains the initial device identity certificate,
optionally followed by its certificate chain excluding
the trust anchor.
For shared-secret-based origin authentication of a
CSR signed by the local device identity certificate's
private key, PKIMessages contain one PKIMessage with
the header, body, and protection element and no
extraCerts element. The header element contains the
pvno, sender, recipient, protectionAlg, and senderKID
elements. The pvno contains cmp2000, the protectionAlg
contains the AlgorithmIdentifier of the used Message
Authentication Code (MAC) algorithm, and the senderKID
contains a reference the recipient can use to identify
the shared secret. The body element contains an ir, cr,
kur, or p10cr CHOICE of type CertificationRequest. It
is signed with the local device identity certificate's
private key. The protection element contains the MAC
value generated with the shared secret.";
reference
"RFC 4210:
Internet X.509 Public Key Infrastructure
Certificate Management Protocol (CMP)
ITU-T X.690:
Information technology - ASN.1 encoding rules:
Specification of Basic Encoding Rules (BER),
Canonical Encoding Rules (CER) and Distinguished
Encoding Rules (DER)";
}
}
}
}
}
<CODE ENDS>4. Security Considerations ✨
okay bestie, security time 🔐 this doc is built on top of [RFC8572], so ALL the security stuff in that one applies here too 💅 no skipping, no cap!
for the different CSR formats: if you're using PKCS#10, the security considerations in [RFC2986] apply 🎀. if you're using CMP, [RFC4210] is the one, and if you're using CMC, it's [RFC5272] 🧚
for the auth mechanisms: with TLS-level authentication, the security considerations in [RFC8446] apply, and with HTTP-level authentication, the ones in [RFC9110] apply 🌸
4.1. SZTP-Client Considerations
4.1.1. Ensuring the Integrity of Asymmetric Private Keys
okay so the private key the SZTP-client uses for its dynamically generated identity certificate MUST be protected from accidental disclosure, so nobody can pull off identity fraud 🙅♀️
the security of this key is literally everything 🔑 if it stays locked down, the identity certificate can actually prove who the device is 🫶
it is RECOMMENDED that devices come out of the factory with a hardware security module (HSM), like a trusted platform module (TPM), so the key gets generated and kept inside the HSM's security perimeter 🔐 when that's the setup, the private key and its associated certificates MAY have long validity periods ✨
no HSM? no drama 🙃 but then it is RECOMMENDED to periodically reset the private key (and its associated identity certificates) so unprotected keys don't hang around forever 🧹 for example, a Network Management System (NMS) controller/orchestrator app could periodically prompt the SZTP-client to generate a fresh private key and send a certificate signing request (CSR), or it could push both the key and an identity certificate over using, e.g., a PKCS#12 message [RFC7292]. another option: the SZTP-client gets configured to go back to factory default every now and then, which wipes the private key and identity certs and reruns the SZTP protocol 🔄
4.1.2. Reuse of a Manufacturer-Generated Private Key
it is RECOMMENDED that a new private key is generated for each CSR described in this document 🌿
implementations must randomly generate nonces and private keys 🎲 using inadequate pseudorandom number generators (PRNGs) to make crypto keys can result in little or no security 💀 an attacker may find it way easier to reproduce the PRNG environment that made the keys and search that small set of possibilities, instead of brute forcing the whole key space 😭 as an example of predictable random numbers, see CVE-2008-0166 [CVE-2008-0166], and some consequences of low-entropy random numbers are discussed in "Mining Your Ps and Qs" [MiningPsQs]. generating quality random numbers is hard, fr fr. [ISO.20543-2019], [NIST.SP.800-90Ar1], BSI AIS 31 [AIS31], BCP 106 [RFC4086], and others have solid guidance on this 📚
this private key SHOULD be protected just as well as the built-in private key tied to the SZTP-client's initial device identity certificate (e.g., the IDevID from [Std-802.1AR-2018]) 🔒
and if it's not possible to make a new private key that's protected as well as the built-in one, it is RECOMMENDED to reuse the built-in private key instead of making a new one that's not as well protected ✨
4.1.3. Replay Attack Protection
this RFC lets an SZTP-client announce that it's able to generate a new key for its CSR 🦋
when the SZTP-server responds by asking the SZTP-client to generate a new key, it is essential that the SZTP-client actually makes one 🙌
generating a new key every time is the move, because the random bytes used to create the key can also do double duty as a "nonce" for catching replay attacks 🧠
when a fresh public/private key pair gets generated for the request, the SZTP-client knows the response wasn't replayed, since its fresh public key shows up in the signed certificate from the SZTP-server 💜
but when the key pair is the manufacturer-generated identity certificate's one (e.g., IDevID), there may not be confirmation that the response wasn't replayed 🙈 the worst case is a lost certificate tied to a private key that only the SZTP-client knows. still, protecting the private key info is vital to public-key cryptography, and if the private key material gets disclosed to another entity, it can lead to masquerades 👻
4.1.4. Connecting to an Untrusted Bootstrap Server
[RFC8572] lets SZTP-clients connect to untrusted SZTP-servers by blindly authenticating the SZTP-server's TLS end-entity certificate 🫣
as Section 9.5 of [RFC8572] explains, in cases like this, the SZTP-client MUST assert that the bootstrapping data it gets back is signed if it's going to trust it ✅
however, the HTTP error message used in this document can't be signed data, as described in [RFC8572] 🚩
so, the solution in this document cannot be used when the SZTP-client connects to an untrusted SZTP-server 🙅♀️
following the advice in Section 9.6 of [RFC8572], SZTP-clients SHOULD NOT pass the csr-support input parameter to an untrusted SZTP-server 🚫 instead, they SHOULD pass the signed-data-preferred input parameter, as discussed in Appendix B of [RFC8572] 💖
4.1.5. Selecting the Best Origin Authentication Mechanism
the origin of the CSR must be verified before a certificate gets issued 🕵️♀️
when generating a new key, it's important that the SZTP-client can provide extra proof that it was the one that made the key 🔐
the CMP and CMC certificate request formats defined in this document support origin authentication 🎉 a raw PKCS#10 CSR does NOT support origin authentication 💀
the CMP and CMC request formats support origin authentication using both PKI and a shared secret 🫶
typically, only one origin authentication mechanism can possibly be used. but if the SZTP-client authenticates itself with both TLS-level (e.g., IDevID) and HTTP-level credentials (e.g., Basic), which Section 5.3 of [RFC8572] allows, then the SZTP-client may need to choose between the two options 🤔
if the SZTP-client has to pick between an asymmetric key option and a shared secret for origin authentication, it is RECOMMENDED that it picks the asymmetric key 🔑✨
4.1.6. Clearing the Private Key and Associated Certificate
unlike a manufacturer-generated identity certificate (e.g., IDevID), the deployment-generated identity certificate (e.g., LDevID) and its private key (assuming a new private key was made for that purpose) are treated as user data 🗂️ so they SHOULD be cleared whenever the SZTP-client gets reset to its factory default state, like with the factory-reset RPC defined in [RFC8808] 🧹💅
4.2. SZTP-Server Considerations
4.2.1. Verifying Proof-of-Possession
Okay, so regardless of which route you take, bestie 💅 if you're using a brand-new asymmetric key or the bootstrapping device's manufacturer-generated key (like the IDevID key), the public key goes inside the CSR, and the CSR gets signed by that private key 🔑. Proof-of-possession is checked by verifying the signature over the CSR with the public key that's sitting inside the CSR. If the signature checks out, the requester really holds the private key. It's giving proof 🦋
4.2.2. Verifying Proof-of-Origin
When the bootstrapping device reuses its manufacturer-generated private key (like the IDevID key) for the CSR, proof-of-origin gets verified by validating the IDevID-issuer cert and making sure the CSR uses the same key pair 🎀
When the bootstrapping device reuses its manufacturer-generated private key (like an IDevID key from IEEE 802.1AR) for the CSR, proof-of-origin gets verified by validating the IDevID certification path and making sure the CSR uses the same key pair. Same energy, just with the full certification path 🧚
When a fresh asymmetric key is used with the CMP or CMC formats, the authentication is baked right into the protocols. That can use either the manufacturer-generated private key or a shared secret 🔐 Also, CMP and CMC can have an RA (Registration Authority) process the request before it goes to the CA, which allows for more robust handling of errors. Iconic for handling mistakes gracefully 🙌
4.2.3. Supporting SZTP-Clients That Don't Trust the SZTP-Server
Here's the tea ☕ [RFC8572] lets SZTP-clients connect to untrusted SZTP-servers by blindly authenticating the SZTP-server's TLS end-entity certificate. Bold move, honestly 😭
As is recommended in Section 4.1.4 of this document, in such cases, SZTP-clients SHOULD pass the "signed-data-preferred" input parameter 🌸
And the reciprocal of that is that SZTP-servers, wanting to support SZTP-clients that don't trust them, SHOULD support the "signed-data-preferred" input parameter, as discussed in Appendix B of [RFC8572]. Both sides showing up for each other 🫶
4.3. Security Considerations for the "ietf-sztp-csr" YANG Module
Security considerations for YANG modules have a recommended documentation format, described in Section 3.7 of [RFC8407]. But this module only augments two input parameters into the "get-bootstrapping-data" RPC in [RFC8572], so it only needs to point you to the relevant Security Considerations sections in that RFC 💖
- Security considerations for the "get-bootstrapping-data" RPC are described in Section 9.16 of [RFC8572].
- Security considerations for the "input" parameters passed inside the "get-bootstrapping-data" RPC are described in Section 9.6 of [RFC8572].
4.4. Security Considerations for the "ietf-ztp-types" YANG Module
Same deal here: the recommended format for documenting security considerations for YANG modules is in Section 3.7 of [RFC8407]. This module doesn't define any protocol-accessible nodes (it only defines "identity" and "grouping" statements), so there are literally no security considerations to report 🙈✨
5. IANA Considerations
5.1. The IETF XML Registry
IANA has registered two URIs in the "ns" registry of the "IETF XML Registry" [RFC3688], maintained at <https://www.iana.org/assignments/xml-registry/>. Here are the entries 🍓
URI: urn:ietf:params:xml:ns:yang:ietf-sztp-csr
Registrant Contact: The NETCONF WG of the IETF.
XML: N/A; the requested URI is an XML namespace.
URI: urn:ietf:params:xml:ns:yang:ietf-ztp-types
Registrant Contact: The NETCONF WG of the IETF.
XML: N/A; the requested URI is an XML namespace.5.2. The YANG Module Names Registry
IANA has registered two YANG modules in the "YANG Module Names" registry [RFC6020], maintained at <https://www.iana.org/assignments/yang-parameters/>. Iykyk, it's the registry that makes modules official 💅
Name: ietf-sztp-csr
Namespace: urn:ietf:params:xml:ns:yang:ietf-sztp-csr
Prefix: sztp-csr
Reference: RFC 9646
Name: ietf-ztp-types
Namespace: urn:ietf:params:xml:ns:yang:ietf-ztp-types
Prefix: ztp-types
Reference: RFC 96466. References
6.1. Normative References
These are the must-read sources the whole spec leans on 📚
[ITU.X690.2021]
ITU, "Information technology - ASN.1 encoding rules:
Specification of Basic Encoding Rules (BER), Canonical
Encoding Rules (CER) and Distinguished Encoding Rules
(DER)", ITU-T Recommendation X.690, ISO/IEC 8825-1,
February 2021, <https://www.itu.int/rec/T-REC-X.690/>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC2986] Nystrom, M. and B. Kaliski, "PKCS #10: Certification
Request Syntax Specification Version 1.7", RFC 2986,
DOI 10.17487/RFC2986, November 2000,
<https://www.rfc-editor.org/info/rfc2986>.
[RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
DOI 10.17487/RFC3688, January 2004,
<https://www.rfc-editor.org/info/rfc3688>.
[RFC4210] Adams, C., Farrell, S., Kause, T., and T. Mononen,
"Internet X.509 Public Key Infrastructure Certificate
Management Protocol (CMP)", RFC 4210,
DOI 10.17487/RFC4210, September 2005,
<https://www.rfc-editor.org/info/rfc4210>.
[RFC5272] Schaad, J. and M. Myers, "Certificate Management over CMS
(CMC)", RFC 5272, DOI 10.17487/RFC5272, June 2008,
<https://www.rfc-editor.org/info/rfc5272>.
[RFC6020] Bjorklund, M., Ed., "YANG - A Data Modeling Language for
the Network Configuration Protocol (NETCONF)", RFC 6020,
DOI 10.17487/RFC6020, October 2010,
<https://www.rfc-editor.org/info/rfc6020>.
[RFC7950] Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language",
RFC 7950, DOI 10.17487/RFC7950, August 2016,
<https://www.rfc-editor.org/info/rfc7950>.
[RFC8040] Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF
Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017,
<https://www.rfc-editor.org/info/rfc8040>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol
Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018,
<https://www.rfc-editor.org/info/rfc8446>.
[RFC8572] Watsen, K., Farrer, I., and M. Abrahamsson, "Secure Zero
Touch Provisioning (SZTP)", RFC 8572,
DOI 10.17487/RFC8572, April 2019,
<https://www.rfc-editor.org/info/rfc8572>.
[RFC8791] Bierman, A., Björklund, M., and K. Watsen, "YANG Data
Structure Extensions", RFC 8791, DOI 10.17487/RFC8791,
June 2020, <https://www.rfc-editor.org/info/rfc8791>.
[RFC9110] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke,
Ed., "HTTP Semantics", STD 97, RFC 9110,
DOI 10.17487/RFC9110, June 2022,
<https://www.rfc-editor.org/info/rfc9110>.
[RFC9640] Watsen, K., "YANG Data Types and Groupings for
Cryptography", RFC 9640, DOI 10.17487/RFC9640, October
2024, <https://www.rfc-editor.org/info/rfc9640>.6.2. Informative References
These are the extra-credit reads, the deep-dive side quests 🧠
[AIS31] Killmann, W. and W. Schindler, "A proposal for:
Functionality classes for random number generators -
Version 2.0", September 2011,
<https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/
Zertifizierung/Interpretationen/AIS_31_Functionality_class
es_for_random_number_generators_e.pdf>.
[CVE-2008-0166]
National Institute of Science and Technology (NIST),
"National Vulnerability Database - CVE-2008-0166 Detail",
May 2008,
<https://nvd.nist.gov/vuln/detail/CVE-2008-0166>.
[ISO.20543-2019]
International Organization for Standardization (ISO),
"Information technology -- Security techniques -- Test and
analysis methods for random bit generators within ISO/IEC
19790 and ISO/IEC 15408", ISO/IEC 20543:2019, October
2019.
[MiningPsQs]
Heninger, N., Durumeric, Z., Wustrow, E., and J.
Halderman, "Mining Your Ps and Qs: Detection of Widespread
Weak Keys in Network Devices", Security'12: Proceedings of
the 21st USENIX Conference on Security Symposium, August
2012, <https://www.usenix.org/conference/usenixsecurity12/
technical-sessions/presentation/heninger>.
[NIST.SP.800-90Ar1]
Barker, E. and J. Kelsey, "Recommendation for Random
Number Generation Using Deterministic Random Bit
Generators", DOI 10.6028/NIST.SP.800-90Ar1, NIST
SP 800-90Ar1, June 2015,
<https://nvlpubs.nist.gov/nistpubs/SpecialPublications/
NIST.SP.800-90Ar1.pdf>.
[RFC4086] Eastlake 3rd, D., Schiller, J., and S. Crocker,
"Randomness Requirements for Security", BCP 106, RFC 4086,
DOI 10.17487/RFC4086, June 2005,
<https://www.rfc-editor.org/info/rfc4086>.
[RFC7292] Moriarty, K., Ed., Nystrom, M., Parkinson, S., Rusch, A.,
and M. Scott, "PKCS #12: Personal Information Exchange
Syntax v1.1", RFC 7292, DOI 10.17487/RFC7292, July 2014,
<https://www.rfc-editor.org/info/rfc7292>.
[RFC8340] Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams",
BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018,
<https://www.rfc-editor.org/info/rfc8340>.
[RFC8407] Bierman, A., "Guidelines for Authors and Reviewers of
Documents Containing YANG Data Models", BCP 216, RFC 8407,
DOI 10.17487/RFC8407, October 2018,
<https://www.rfc-editor.org/info/rfc8407>.
[RFC8792] Watsen, K., Auerswald, E., Farrel, A., and Q. Wu,
"Handling Long Lines in Content of Internet-Drafts and
RFCs", RFC 8792, DOI 10.17487/RFC8792, June 2020,
<https://www.rfc-editor.org/info/rfc8792>.
[RFC8808] Wu, Q., Lengyel, B., and Y. Niu, "A YANG Data Model for
Factory Default Settings", RFC 8808, DOI 10.17487/RFC8808,
August 2020, <https://www.rfc-editor.org/info/rfc8808>.
[RFC9641] Watsen, K., "A YANG Data Model for a Truststore",
RFC 9641, DOI 10.17487/RFC9641, October 2024,
<https://www.rfc-editor.org/info/rfc9641>.
[RFC9642] Watsen, K., "A YANG Data Model for a Keystore", RFC 9642,
DOI 10.17487/RFC9642, October 2024,
<https://www.rfc-editor.org/info/rfc9642>.
[Std-802.1AR-2018]
IEEE, "IEEE Standard for Local and Metropolitan Area
Networks - Secure Device Identity", August 2018,
<https://standards.ieee.org/ieee/802.1AR/6995/>.Acknowledgements
The authors would like to thank for following for lively discussions on list and in the halls (ordered by first name): Benjamin Kaduk, Dan Romascanu, David von Oheimb, Éric Vyncke, Guy Fedorkow, Hendrik Brockhaus, Joe Clarke, Meral Shirazipour, Murray Kucherawy, Rich Salz, Rob Wilton, Roman Danyliw, Qin Wu, Yaron Sheffer, and Zaheduzzaman Sarkar. Huge thanks to all of them, they really made this 🫶🌈
Contributors
Special thanks go to David von Oheimb and Hendrik Brockhaus for helping with the descriptions for the "cmc-csr" and "cmp-csr" nodes. Absolute legends 👑
Authors' Addresses
Kent Watsen Watsen Networks Email: kent+ietf@watsen.net
Russ Housley Vigil Security, LLC Email: housley@vigilsec.com
Sean Turner sn3rd Email: sean@sn3rd.com
📦 where this page comes from
- ietf: rfc9646 2024-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms