Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

proposed text from errata 6648 #151

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open

proposed text from errata 6648 #151

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b880553
proposed text from errata 6648
mcr Feb 20, 2024
c887ece
fix typo
mcr Feb 21, 2024
987e41d
add missing word
mcr Feb 21, 2024
dce7ccf
upcase Registrar
mcr Feb 21, 2024
815339e
upcase registrar
mcr Feb 21, 2024
09521c7
clarify SNI non-use
mcr Feb 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 16 additions & 5 deletions dtbootstrap-anima-keyinfra.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1738,12 +1738,23 @@ locator3 = [O_IPv6_LOCATOR, fe80::1234, 41, nil]]]></artwork>
</t>
<t>
Use of TLS 1.3 (or newer) is encouraged.
TLS 1.2 or newer is REQUIRED on the Pledge side.
TLS 1.3 (or newer) SHOULD be available on the Registrar server interface,
and the Registrar client interface, but TLS 1.2 MAY be used.
TLS 1.3 (or newer) SHOULD be available on the MASA server interface, but TLS
1.2 MAY be used.
TLS 1.2 or newer is REQUIRED on the pledge side.
TLS 1.3 (or newer) SHOULD be available on the registrar server
interface, and the registrar client interface, but TLS 1.2 MAY
be used.
When TLS 1.3 is used the use of Server Name Indication (SNI,
<xref target="RFC6066" />) is not required, per <xref
target="RFC8446" /> section 9.2, as this
specification is an application profile specification.
</t>

<t>
A pledge connects to the registrar using only an IP address and it will
not have any idea of a correct SNI value.
This also implies that the registrar interface MUST NOT be virtual-
hosted in such a way that it depends on the SNI being present.
</t>

<t>
Establishment of the BRSKI-EST TLS connection is as
specified in EST <xref target="RFC7030"/> section 4.1.1 "Bootstrap
Expand Down