Bootstrapping Remote Secure Key Infrastructure (BRSKI)
Metadata
- Publisher
- IETF
- Doc Type
- Standard
- Pages
- 116
- Abstract
- This document specifies automated bootstrapping of an Autonomic Control Plane. To do this, a Secure Key Infrastructure is bootstrapped. This is done using manufacturer-installed X.509 certificates, in combination with a manufacturer's authorizing service, both online and offline. We call this process the Bootstrapping Remote Secure Key Infrastructure (BRSKI) protocol. Bootstrapping a new device can occur when using a routable address and a cloud service, only link-local connectivity, or limited/disconnected networks. Support for deployment models with less stringent security requirements is included. Bootstrapping is complete when the cryptographic identity of the new key infrastructure is successfully deployed to the device. The established secure connection can be used to deploy a locally issued certificate to the device as well.
- Publication Date
- 2021-05-01
- Status Note
- Proposed Standard
- DOI
10.17487/RFC8995- Link
- https://doi.org/10.17487/RFC8995
- Author(s)
- Max PritikinMichael RichardsonToerless EckertMichael H. BehringerKent Watsen
- Keyword(s)
- Autonomic Networking, Autonomous Operation, Self-management, Voucher, Onboarding, Zero Touch, IoT-onboarding
Latest version of IETF RFC 8995
Document Versions — IETF RFC 8995
-
▶ IETF RFC 8995 (2021-05-01)THIS DOC [ACTIVE] [LATEST VERSION]
Normative Reference(s)
- IEEE.STD802.1AR — IEEE, "IEEE Standard for Local and metropolitan area networks - Secure Device Identity", IEEE 802.1AR. EXTERNAL
- Fielding, R.F., "Architectural Styles and the Design of Network-based Software Architectures", 2000, <http://www.ics.uci.edu/~fielding/pubs/dissertation/fielding_dissertation.pdf>. EXTERNAL
- IETF RFC 2119 [Active*]
- IETF RFC 3339 [Active*]
- IETF RFC 3688 [Active*]
- IETF RFC 3748 [Active*]
- IETF RFC 3927 [Active*]
- IETF RFC 4086 [Active*]
- IETF RFC 4519 [Active*]
- IETF RFC 4648 [Active*]
- IETF RFC 4862 [Active*]
- IETF RFC 5272 [Superseded*]
- IETF RFC 5280 [Active, Amended*]
- IETF RFC 5652 [Active*]
- IETF RFC 6020 [Active*]
- IETF RFC 6125 [Superseded*]
- IETF RFC 6241 [Active*]
- IETF RFC 6762 [Active*]
- IETF RFC 6763 [Active*]
- IETF RFC 7030 [Active*]
- IETF RFC 7230 [Superseded*]
- IETF RFC 7231 [Superseded*]
- IETF RFC 7469 [Active*]
- IETF RFC 7950 [Active, Amended*]
- IETF RFC 7951 [Active*]
- IETF RFC 8040 [Active*]
- IETF RFC 8174 [Active*]
- IETF RFC 8259 [Active*]
- IETF RFC 8366 [Active*]
- IETF RFC 8368 [Active*]
- IETF RFC 8407 [Superseded*]
- IETF RFC 8446 [Superseded*]
- IETF RFC 8610 [Active*]
- IETF RFC 8951 [Active*]
- IETF RFC 8981 [Active*]
- RFC8990 — RFC8990 EXTERNAL
- IETF RFC 8994 [Active*]
- T-REC-X.690.2015 — ITU-T-X.690 EXTERNAL
Bibliographic Reference(s)
- IETF.draft-ietf-ace-coap-est-18 — I-D.ietf-ace-coap-est EXTERNAL
- IETF.draft-ietf-anima-constrained-voucher-10 — I-D.ietf-anima-constrained-voucher EXTERNAL
- IETF.draft-ietf-netconf-keystore-22 — I-D.ietf-netconf-keystore EXTERNAL
- IETF.draft-richardson-anima-state-for-joinrouter-03 — I-D.richardson-anima-state-for-joinrouter EXTERNAL
- "CableLabs Digital Certificate Issuance Service", February 2018, <https://www.cablelabs.com/resources/digital-certificate-issuance-service/>. EXTERNAL
- Stajano, F. and R. Anderson, "The Resurrecting Duckling: Security Issues for Ad-hoc Wireless Networks", 1999, <https://www.cl.cam.ac.uk/~fms27/papers/1999-StajanoAnd-duckling.pdf>. EXTERNAL
- "DNSSEC Practice Statement for the Root Zone ZSK Operator", December 2017, <https://www.iana.org/dnssec/procedures/zsk-operator/dps-zsk-operator-v2.1.pdf>. EXTERNAL
- Wikipedia, "Source code escrow", March 2020, <https://en.wikipedia.org/w/index.php?title=Source_code_escrow&oldid=948073074>. EXTERNAL
- OpenSSL, "OpenSSL X509 Utility", September 2019, <https://www.openssl.org/docs/man1.1.1/man1/openssl-x509.html/>. EXTERNAL
- CA/Browser Forum, "Information for Auditors and Assessors", August 2019, <https://cabforum.org/information-for-auditors-and-assessors/>. EXTERNAL
- ESET, "IoT of toys stranger than fiction: Cybersecurity and data privacy update", March 2017, <https://www.welivesecurity.com/2017/03/03/internet-of-things-security-privacy-iot-update/>. EXTERNAL
- Wikipedia, "Imprinting (psychology)", January 2021, <https://en.wikipedia.org/w/index.php?title=Imprinting_(psychology)&=999211441>. EXTERNAL
- Urban Dictionary, "brewski", March 2003, <https://www.urbandictionary.com/define.php?term=brewski>. EXTERNAL
- Broadband Forum, "CPE WAN Management Protocol", TR-069, Issue 1, Amendment 6, March 2018, <https://www.broadband-forum.org/download/TR-069_Amendment-6.pdf>. EXTERNAL
- Richardson, M., "Minerva reference implementation for BRSKI", 2020, <https://minerva.sandelman.ca/>. EXTERNAL
- "ANIMA Minerva toolkit", <https://github.com/ANIMAgus-minerva>. EXTERNAL
- Silicon Republic, "What is it actually like to live in a house filled with IoT devices?", February 2018, <https://www.siliconrepublic.com/machines/iot-smart-devices-reality>. EXTERNAL
- Dingledine, R., Mathewson, N., and P. Syverson, "Tor: The Second-Generation Onion Router", August 2004, <https://svn-archive.torproject.org/svn/projects/design-paper/tor-design.pdf>. EXTERNAL
- Wikipedia, "Slowloris (computer security)", January 2021, <https://en.wikipedia.org/w/index.php?title=Slowloris_(computer_security)&oldid=1001473290/>. EXTERNAL
- IETF RFC 2131 [Active*]
- IETF RFC 2663 [Active*]
- IETF RFC 5209 [Active*]
- IETF RFC 6960 [Active*]
- IETF RFC 6961 [Superseded*]
- IETF RFC 7228 [Active*]
- IETF RFC 7258 [Active*]
- IETF RFC 7435 [Active*]
- IETF RFC 7575 [Active*]
- IETF RFC 8126 [Active*]
- IETF RFC 8340 [Active*]
- IETF RFC 8615 [Active*]
- RFC8993 — RFC8993 EXTERNAL
- W3C.capability-urls.20140218 — W3C.capability-urls EXTERNAL
Source Data (JSON)
Full registry record with provenance metadata. Open directly: /api/doc/RFC8995.json
Reference Tree
Explore all references and references to this document, as a navigable tree.
Open Reference TreeReference this Doc
Plain text (ISO 690 compliant)
Preview:
IETF RFC 8995, Bootstrapping Remote Secure Key Infrastructure (BRSKI). Available at https://doi.org/10.17487/RFC8995
Snippet:
IETF RFC 8995, Bootstrapping Remote Secure Key Infrastructure (BRSKI). Available at https://doi.org/10.17487/RFC8995
HTML (ISO 690 compliant)
Preview:
IETF RFC 8995, Bootstrapping Remote Secure Key Infrastructure (BRSKI). Available at https://doi.org/10.17487/RFC8995
Snippet:
<span class="citation"><cite>IETF RFC 8995</cite>, Bootstrapping Remote Secure Key Infrastructure (BRSKI). Available at <a href="https://doi.org/10.17487/RFC8995" target="_blank" rel="noopener">https://doi.org/10.17487/RFC8995</a></span>
SMPTE's HTML Pub
Preview:
IETF RFC 8995, Bootstrapping Remote Secure Key Infrastructure (BRSKI)
doi: 10.17487/RFC8995
url: https://doi.org/10.17487/RFC8995
doi: 10.17487/RFC8995
url: https://doi.org/10.17487/RFC8995
Snippet:
<li> <cite id="bib-rfc8995">IETF RFC 8995</cite>, Bootstrapping Remote Secure Key Infrastructure (BRSKI) <span class="doi">10.17487/RFC8995</span> </li>
Referenced By
- IETF RFC 8994 [Active*]
- IETF RFC 9030 [Active*]
- IETF RFC 9483 [Active*]
- IETF RFC 9733 [Active*]
- IETF RFC 9810 [Active*]
- IETF RFC 9908 [Active*]