BRSKI discovery and variations

3.1.8.1. Variation Contexts Registry Table

The IANA "BRSKI Variations Contexts" registry table, see Table 2, as defined by this document, defines which Service Names and signaling parameters (e.g.: UDP vs. TCP) in each supported discovery mechanism are used to discover which role for different BRSKI protocol options.¶

In addition, the table specifies for each context the applicable variation types because these may differ by context (they do not differ yet with the registrations specified in this document though).¶

The order in which variation types are specified in this table defines the order in which variation type values are concatenated to form variation strings.¶

3.1.8.2. Variation Type and Choices Registry Table

The IANA "BRSKI Variations and Variation Strings" registry table, see Table 3, as defined by this document, defines for each context and variation type the defined choices of that variation type and whether a particular choice is a default choice, in which case it does not need to be included in the variation strings for the context.¶

This registry also registers the authoritative documentation defining the specific choices. These specifications may differ for the same choice across different contexts, such as for "est" between BRSKI and cBRSKI.¶

The "Context" column lists the BRSKI Variation Context(s) to which this line applies. If it is empty, then the same Context(s) apply as that of the last prior line with a non-empty Context column.¶

The "Variation Type" column lists the BRSKI Variation Type to which this line applies. If it is empty, then the same Variation Type applies as that of the last prior line with a non-empty Variation Type column.¶

The "Variation Type Choice" column defines a Variation Type Choice for the current context. All Variation Types and Variation Type Choices MUST be unique strings across all Variation Types so that variation strings are non-ambiguous.¶

Variation Types and Variation Type Choices and MUST be strings from lowercase letters a-z and digits 0-9 and MUST start with a letter. The maximum length of a Variation Type Choice is 12 characters.¶

The "Reference" column specifies the primary documents which defines the Variation Type Choice use in the rows context. Further references go into the Note(s) column.¶

The "Dflt" Flag specifies a Variation Type Choice that is assumed to be the default Choice for the Context, such as "rrm" for the BRSKI context. Such a Variation Type Choice is assumed to be supported by responders in discovery if discovery is performed without support of variations. This applies of course only to responders which support such discovery.¶

For example, Section 1 specifies the empty string "" as the objective-value in Section 1 discovery. Because "rrm", "est" and "cms" are default in the BRSKI context, discovery without indication of a variation can support exactly only this variation of "rrm" with "est" and "cms" in the BRSKI context.¶

The "Dflt" Flag specifies a Variation Type Choice that is only default in a subset of Discovery options in a context. The Note(s) column has then to explain which subset this is. Like for "Dflt", the signaling in this subset of Discovery options can then forego indication of the "Dflt" Variation Type Choice.¶

The "Rsvd" Flag specifies a Variation Type Choice for which no complete specification exist on how to use it within BRSKI (or more specifically the context), but which is assumed to be of potential implementation interest. "Rsvd" Variation Type Choices MUST NOT be considered for the Discoverable Variations table. They are documented primarily to reserve the Variation Type Choice string.¶

3.1.8.3. Variations and Variation String Registry Table

The IANA "BRSKI Variations and Variation Strings" registry table, see Table 4, as defined by this document, defines for every necessary context in the "Variation" column the variations which are known to be desired by implementations as a space separated sequence of variation type values, and as a "-" concatenated variation string in the "Variation String" column. The space separated sequence does not take defaults into account, the variation string does.¶

Variation strings may include additional "one-off" variation strings in support of backward compatibility when the standard scheme does not work.¶

The "Context" column lists the BRSKI Variation Context(s) to which a line applies. If it is empty, then the same Context(s) apply as that of the last prior line with a non-empty Context column.¶

The "Reference" column lists the document(s) that specify the variation, if that variation is explicitly described. If the variation is not described explicitly, but rather a combination of Variation Type Choices from more than one BRSKI related specification, then this has to be explained in the "Explanation / Notes" column.¶

3.3.2.1. Direction Connections Mode

In one proxy implementation option called "direct connections", the proxy creates for every discovered registrar socket a separate proxy-responder socket. It announces this socket with the same set of parameters as it did learn from the registrars service announcement, except for the appropriate proxy service name and socket parameters (IP/IPv6 address, port number). When a pledge connects to that socket, the proxy passes traffic for that pledges connection to and from the respective registrar socket.¶

When using the direct connections approach, the task of selecting the best registrar socket for a particular variation is left to pledges because they are exposed to at least the same number of service announcements from proxies as proxies see service announcements from registrars - and the pledge has to select the best available one from them.¶

To reduce the number of sockets that have to be announced by proxies when using direct connections and to also reduce the number of responder sockets that need to be maintained by a proxy operating in this approach, these proxies SHOULD limit the number of registrar sockets it maps to between 4 and 10 best registrar sockets as described in Section 3.2.1 per variation.¶

3.3.2.2. Best Registrar Selection Mode

In the implementation mode "best registrar selection", the proxy creates a separate socket for a set of all registrar sockets that it discovers and that announce support for the same set of variations. It then connects pledges to the best available registrar socket from that set.¶

It then announces this socket with the parameters of the best discovered registrar socket, replacing the service name and network parameter names with those for its proxy-responder socket as in the case of a direct connection.¶

When performing best registrar selection, the proxy has to perform selection of the best availalable responder as described in Section 3.2.1.¶

In addition, stateful proxies implementing best registrar selection SHOULD optimize selection of registrar for each proxy responder socket across connections for multiple pledges instead of starting the sequence of responders to try anew from the highest precedence registrar for every new connecting pledge - and repeatedly run into timeouts when one or more of the best registrar time out on connection attempts because they are unresponsive or unreachable. Instead, after a responder first fails to connect, the proxy SHOULD skip this responder in further connection attempts for other connecting pledges and re-consider it only for new connection attempts after at least 60 seconds.¶

Stateless proxies can not learn unresponsiveness or unreachability of a responder through connection attempts. Instead, they SHOULD perform a stateless responsivness/reachability check for each responder that the proxy is actively forwarding packets to from one or more pledges. If no packets are returned from such a responder over a period of more than 30 seconds, then the responder SHOULD be considered unreachable for at least 180 seconds. Unreachability signaling received in response to packets sent to the responder SHOULD trigger this unreachability status after it persists for 10 seconds.¶

Using newly discovered responders in stateless proxies supporting best registrar selection must be done carefully. Consider the common case that service annuncements for a primary responder did stop due to network issues, now the proxy starts to send packets to a secondary responder, and then the primary responder becomes reachable and the proxy sees service announcements for it. If the proxy would now start to forward packets from pledges to this primary responder due to its higher precedence, then this could unnecessarily break ongoing connections from clients whose packets are currently forwarded to the lower preference proxy. Direct connection mode does not incur this problem, because the pledge can select another proxy-responder socket when it discovers the first one to be unresponsive or erroneous.¶

Replacing to use a selected responder in a stateless proxy with a better one SHOULD hence only be done if no packets have been exchanged between pleges and the current selected responder through the proxy for more than 300 seconds. This long timeout specifically intends to not break connections in which the registrar keeps the pledge waiting for an administrative response such as an operator performing a policy validation for enrollment.¶

Load balancing as described in Section 3.2.1 is NOT RECOMMENDED for stateless proxies because per-pledge stateless load balancing may involve more processing complexity than feasible for proxies on constrained devices. To avoid changing the selection of active responders when one responder becomes unresponsive, a "stable hash" approach would have to be used, such as described in [HRW98], which is used for example by [I-D.ietf-bess-evpn-fast-df-recovery]. Supporting weights with stateless proxying is even more complex. Instead of load balancing, responders simply need to be designed to scale to the maximum amount of simultaneous initiator connections necessary when supporting stateless proxying mode.¶

3.3.2.3. Proxy in Name Only Mode on Registrars

Registrars that implement support for connections from stateful proxies and/or from pledges may minimize their proxy implementation work by only implementing the appropriate service name announcements for the same socket to support connections from both: announcements as a registrar for connections from proxies and announcements as a proxy for connections from pledges. No additional sockets or other proxy specific packet processing code is required to support this.¶

Registrars that implement support for connections from stateless proxies can share that implementation for connections from pledges by also implementing simple UDP<->JPY header conversion. Nevertheless, they do need to do this via a separate socket and hence need to announce the two sockets separately: UDP for connections pledges with the proxy service name, and UDP with JPY header for connections from stateless proxies with the stateless registrar service name.¶

Proxy functionality that is implemented as described here on registrars is called "proxy in name only mode", because such an implementation can not discover, select and fail over between different registrars. Such proxies in name only therefore do not share requirements against discovering and selecting registrars described for the prior specified modes.¶

Like other proxies, proxies in name only SHOULD nevertheless track aliveness of their registrar function and withdraw its service announcements (both as proxy as well as as registrar) when it does not run, fails or becomes unresponsive.¶

Proxies in name only SHOULD default to the same discovery method priority and weight parameter as those configured for the registrar service announcements. This is so that in the absence of separate proxies in the network selection of registrars co-located proxies would follow the same criteria as those used by proxies and which use the registrar service announcement parameters.¶

3.3.2.4. Proxy Mode Discussion

This document defines no requirements against the implementation mode for proxies. Those are left for solution or deployment (profile) specifications. Instead, this section discusses some considerations for those choices.¶

The list of possible modes presented is exemplary and not meant to be exhaustive. Other modes are equally able to support the requirements, such as mixtures of the described modes. Likewise, introduction of new variations may not only work well via arbitrary variation support in proxies, but through explicit configuration of variations on proxies - this all depends on the target deployment environment. The presented modes where choosen primarily as the ones providing most configuration free deployment options and for registrar implementations most simplicity in implementation.¶

If a deployment has a larger number of service announcements and (extremely) constrained pledges, direct connection mode may be inappropriate because it shifts the burden of best available discovery and selection and onto the pledge. If simultaneously proxies in such deployments can support more scalable complex implementations, then best registrar selection mode may be most appropriate.¶

In environments, where all pledges are expected to become proxies after enrollment, implementers may simply want to implement the option for which both pledge and proxy code together is easiest to implement.¶

Even on registrars, proxy in name only mode may not suffice deployment requirements or provide best redundancy. For example, the co-located registrar may incur problems, not applicable to alternative registrars, such as for example Internet connectivity problems to MASAs when different registrars have different Internet connectivity. If the registrar co-located proxy is then still the only proxy available to some candidate pledges, then this proxy needs to be able to connect to an alternative registrar, which would not be possible if it was a a proxy in name only.¶

Likewise, proxy in name only mode will disturb the introduction of new variations on pledges and other registrars in the network if the registrar node implementing proxy in name only mode becomes a necessary proxy for a pledge requiring a variation not supported by this registrar, but by another registrar that would only be reachable through this registrar node. Therefore, proxy in name only mode is best suited for node types not deployed on an edge of the network where a future variety of pledges may connect to, and those pledges will require the use of a proxy.¶

3.5.1.1. Signaling

The following definitions apply to any instantiation of DNS-SD including DNS-SD via mDNS as defined in Section 1, but also via unicast DNS, for example by registering the necessary DNS-SD Resource Records (RR) via [I-D.ietf-dnssd-srp] (SRP).¶

Because of the different options of how to run DNS-SD, the requirements in this document do not guarantee interoperability when using DNS-SD. One side could use unicast DNS-SD, the other mDNS, and there may be no mapping between the two. Therefore the recommendations in this document need to be amended with deployment specific specifications / requirements as to which signaling variation, such as mDNS or unicast DNS with SRP is to be supported between initiator and responder. When using unicast DNS (with SRP), additional mechanisms are required to learn the IP / IPv6 address(es) of feasible DNS and SRP servers, and deployment may also need agreements for the (default) domain they want to use in unicast DNS. Hence, a mandatory to implement (MTI) profile is not feasible because of the wide range of variations to deploy DNS-SD.¶

In the absence of overriding deployment profile requirements, implementations are RECOMMENDED to support mDNS and MAY support [I-D.ietf-dnssd-srp] and fall back to mDNS if [I-D.ietf-dnssd-srp] fails to work, e.g.: it fails to discover SRP server and/or default domain.¶

3.5.1.2. Variation String Encoding

Variation Strings from the IANA registry Table 4 are encoded as DNS-SD Keys with a value of 1 in the DNS-SD service instances TXT RR using the shortened encoding of "key" instead of "key=1". In result, the value of the TXT RR is a sequence of zero terminated strings, each one indicating a single supported variation type choice.¶

A variation may have the option of being represented by the empty string "". This is not allowed in the DNS-SD encoding, and instead the alternative variation string MUST always be used for DNS-SD.¶

Variation strings in DNS-SD are case insensitive as required by DNS-SD. It is RECOMMENDED to only announce lowercase variation strings in DNS-SD.¶

The use of variation strings can easily break the DNS-SD rule that they keys should be no more than 9 characters long. This is justified by the absence of value fields to keep the total length of the TXT RR reasonably short.¶

3.5.1.3. Service Instance and Host Names

To be able to specify for each responder socket individually its supported variations as well as its selection criteria (priority weight), it needs to be represented in DNS-SD as a service instance name with an SRV and TXT RR. In BRSKI-PLEDGE Section 3.4 the service instance name is significant as it is what a registrar agent may need to to discover, but in BRSKI and cBRSKI it is merely an artefact of DNS-SD encoding: Unlike typical user-centric DNS-SD use-cases, there are no users that need to make sense of the meaning of the service instance name, for example to know, which printer to to pick. Only operators may need to look at them for troubleshooting. The choice of instance name (the first component of a service instance name) is hence arbitrary. The same is true for the host names used in the DNS-SD records for BRSKI.¶

Registrars SHOULD support automatic generation of their service instance name for their DNS-SD operation to avoid additional need for operator configurations. Registrars SHOULD likewise support the configuration of such a name - if the operator so desires to support operational troubleshooting.¶

If the host on which the registrar is running already has a DNS host name for the IP/IPv6 addresses used by the registrar and for the desired DNS method (mDNS = .local, unicast DNS = default domain), then the registar SHOULD be able to use that host name as the target domain name in the SRV RR. This requirement avoids the unnecessary addition of DNS A/AAAA RRs because of the registrar, when useable RRs already exist.¶

If such a DNS RR does not exist, but a DNS host name for a different DNS method, or a different set of addresses than used by the registrar, then the registrar MAY be able to use a target domain name derived from that primary domain name by appending a unique name element. This requirement exist to avoid the creation of unnecessarily inconsistent host names.¶

If no DNS host name exists, the registrar MUST be able to automatically create a DNS host name and the A and/or AAAA RRs for the address(es) used by the registrar for use in the SRV RR target field. This requirement exists to ensure that operators are not unnecessary required to configure a host name on a system that does not need one - and none is required to run a registrar.¶

A registrar MAY use any unique identifiers of its host system as its instance name or host name. This can avoid or at least minimize the need to automatically pick another name in case the chosen name is already taken by another system. This for example would happen if a registrar tried to use an instance component such as "registrar" and there is already another registrar. Using a known unique identifier allows a registrar to raise an alert and claim an operational error with a high degree of confidence.¶

MAC addresses are only unique when an application such as a registrar understand what hardware it is running on, and that the MAC address was assigned by registering its OUI with IEEE and that MAC addresses from the OUI where assigned uniquely. This is for example not necessarily the case for IoT equipment or registrars running in a virtual context in the cloud. IP/IPv6 addresses can be assumed to be unique (enough) when they have globals scope or ULA.¶

When registrar software does not know that no other registrar software or instance of the same software may run on the same host (for example when being packaged as an application), the registrar SHOULD not assume that a host unique name, is actually unique, but instead disambiguate it by appending an additional name element to make it unique, such as a process number of the running process.¶

Picking well-known or unique identifiers for registrar also helps operator to troubleshoot by often eliminating the need to also know the IP/IPv6 addresses associated with the name.¶

Target host names need to follow the requirements for host names. By those requirements, it is not permitted to use ":" in target host names, for example as part of MAC or IP address based host names. instance names do not share this limitation, but it SHOULD be useful to pick the same host name requirements based encoding format for both type of DNS RR nams when using encoded addresses in them. For example by replacing ":" as commonly used with "-".¶

If the responder needs to indicate different sockets for different (set of) variations, for example, when operating as a proxy, according to Section 3.3.1, then it needs to signal for each socket a separate service instance name with the appropriate port information in its SRV record and the supported variations for that socket in the TXT Record of that service instance name. A responder MAY create the instance and host name for such different variation sockets by appending the variation string to the previously determined instance and host names.¶

3.5.1.4. Examples

These example use OUI and IPv6 addresses reserved for documentation purposes. Do not re-use these addresses in actual deployments¶

# BRSKI
_brski-registrar._tcp.local
               IN PTR  0000-5e00-5314._brski-registrar._tcp.local
0000-5e00-5314._brski-registrar._tcp.local
               IN SRV  1 2 4555 0000-5e00-5314.local
0000-5e00-5314._brski-registrar._tcp.local
               IN TXT  "est-tls" "prm-jose" "cmp"

# cBRSKI
_brski-registrar._udp.local
                IN PTR  0000-5e00-5314._brski-registrar._udp.local
0000-5e00-5314._brski-registrar._udp.local
                IN SRV  1 2 5684 0000-5e00-5314.local
0000-5e00-5314._brski-registrar._udp.local
                IN TXT  "rrm-cose"

# Host name
0000-5e00-5314.local
               IN AAAA  2001:DB8:0815::5e00:5314

In example Figure 2, a registrar on a router, that is using mDNS for being discovered supports BRSKI with "rrm" and "prm" modes across the same TCP socket port 4555, with "est" and "cmp". This leads to the three supported and IANA registry defined variations "est-tls", "prm-jose", and "cmp". For cBRSKI (UDP), it supports the only variation registered through this document, "rrm-cose".¶

Such a registrar implementation might even support a combination of "prm" with "jose" and "cmp", but at the time of this specification, this exact interoperability aspects of such a combination have at the time of writing of this spec not been investigated and hence it is not listed in the IANA registry. Nevertheless, this may happen later, so it is useful for registrar implementations to allow configuration of variations for its service announcements to allow operational modifications.¶

This registrar implementation is running on a router that otherwise has no for a host name registered in DNS or DNS-SD, so it is using it's MAC-address as its target host name, "0000-5e00-5314.local", the same name is used in the registrar service instance names. Running on a router without modular software, the registrar knows that no other registrar instances can run on the same host and hence the name has no further disambiguating elements.¶

Note also that there is never a need for two different service instance names between BRSKI and cBRSKI, because they are distinguished bt the "_tcp" versus "_udp" component of the service instance name.¶

# BRSKI registrar application
_brski-registrar._tcp.example.org
     IN PTR  noc-registrar-brski-37253._brski-registrar._tcp.example.org
noc-registrar-brski-37253._brski-registrar._tcp.example.org
     IN SRV  1 2 4555 noc-registrar.example.org
noc-registrar-brski-37253._brski-registrar._tcp.example.org
     IN TXT "est-tls" "cmp"

# cBRSKI registrar application
_brski-registrar._udp.example.org
     IN PTR  noc-registrar-cbrski-5376._brski-registrar._udp.example.org
noc-registrar-cbrski-5376._brski-registrar._udp.example.org
     IN SRV  1 2 7533 noc-registrar.example.org
noc-registrar-cbrski-5376._brski-registrar._udp.example.org
     IN TXT "rrm-cose"

# BRSKI-PRM application
_brski-registrar._tcp.example.org
               IN PTR noc-registrar-prm-9735._brski-registrar._tcp.example.org
noc-registrar-prm-9735._brski-registrar._tcp.example.org
               IN SRV 1 2 17355 noc-registrar.example.org
noc-registrar-prm-9735._brski-registrar._tcp.example.org
               IN TXT "prm"

# Host name
noc-registrar.example.org
               IN AAAA  2001:DB8:0815::5e00:5333

In the second example Figure 3, a server system in the NOC of customer with domain example.org is set up as the registrar for various BRSKI options. It uses [I-D.ietf-dnssd-srp] to register its DNS-SD names into the example.org domain which it discovers as the default domain. The host name of the server is set to noc-registrar.example.org.¶

The operator installs three separate registrar applications on this server. One from a vendor whose pledges use BRSKI, one from an integrator supporting pledges from various "IoT" vendors that usecBRSKI, and one from a manufacturer that has pledges using BRSKI-PRM.¶

Each of the three applications operates the same way for discovery. It opens a socket for its registrar responder and notes the port number it receives. It determines that SRP is useable, that the default domain is "example.org", and that the host name is noc-registrar. It then forms a unique name from noc-registrar by appening some string abbreviation indicating its mode of operation ("brski", "cbrski", "prm"), and it's numeric process identifier - just in case more than one instance of the same application can be started. It then publishes its PTR, SRV and TXT DNS-RR, using these creates unique service instance names, the respective port number in the SRV RR and the variation(s) in the TXT RR.¶

3.5.2.1. Signaling

This document does not specify a mandatory to implement set of signaling options to guarantee interoperability of discovery between initiator and responders when using GRASP. Like for the other discovery mechanisms, these requirements will have to come from other specifications that outline what in Section 1 is called the "security and transport substrate" to be used for GRASP.¶

[RFC8994] specifies one such "security and transport substrate", which is zero-touch deployable. It is mandatory to support for initiators and responders implementing the so-called "Autonomic Network Infrastructure" (ANI). DULL GRASP is used for link-local discovery of proxies, and the ACP is used to automatically and securely build the connectivity for multi-hop discovery of registrars by proxies.¶

3.5.2.2. Encoding and Examples

To announce protocol variations with Section 1, the supported Variation is indicated in the objective-value field of the GRASP objective, using the method of forming the Variation string term in Section 3.1.8.3, and listed in the Variation String column of the Table 4 table.¶

If more than one Variation is supported, then multiple objectives have to be announced, each with a different objective-value, but the same location information if the different Variations are supported across the same socket. Different sockets require different objective structures in GRASP anyhow.¶

Compared to DNS-SD, the choice of encoding for GRASP optimizes for minimum parsing effort, whereas the DNS-SD encoding is optimized for most compact encoding given the limit for DNS-SD TXT records.¶

[M_FLOOD, 12340815, h'fe800000000000000000000000000001', 180000,
    [["AN_Proxy", 4, 1, "",
     [O_IPv6_LOCATOR,
     h'fe800000000000000000000000000001', IPPROTO_TCP, 4443],
     ["AN_Proxy", 4, 1, "prm",
     [O_IPv6_LOCATOR,
     h'fe800000000000000000000000000001', IPPROTO_TCP, 4443],
     ["AN_Proxy", 4, 1, "",
     [O_IPv6_LOCATOR,
     h'fe800000000000000000000000000001', IPPROTO_UDP, 4684]]
]

Figure 4 is an example for a GRASP service announcement for "AN_Proxy" in support of BRSKI with both "rrm" and "prm" supported on the same TCP port 4443 and for cBRSKI with COAP over DTLS on UDP port 4684.¶

Note that one or more complete service instances (in the example 3) can be contained within a single GRASP message without the need for any equivalent to the Service Instance Name of the DNS-SD PTR RR or the Target name of the DNS-SD SRV RR. DNS-SD requires them because its encoding is decomposed into different RR, but it also intentionally introduces the Service Instance Name as an element for human interaction with selection (browsing and/or diagnostics of selection), something that the current GRASP objective-value encoding does not support.¶

[M_FLOOD, 12340815, h'fe800000000000000000000000000001', 180000,
    [["AN_Proxy", 4, 1, "",
     [O_IPv6_LOCATOR,
     h'fe800000000000000000000000000001', IPPROTO_TCP, 4443],
     ["AN_Proxy", 4, 1, "",
     [O_IPv6_LOCATOR,
     h'fe800000000000000000000000000001', IPPROTO_UDP, 4684]]
]

[M_FLOOD, 42310815, h'fe800000000000000000000000000001', 180000,
    [["AN_Proxy", 4, 1, "prm",
     [O_IPv6_LOCATOR,
     h'fe800000000000000000000000000001', IPPROTO_TCP, 44000]]
]

In Figure 5, A separate application process supports "prm" and hence uses a separate socket, with example TCP port 44000. In this case, there is no need nor significant benefit to merge all service instance announcements into a single GRASP message. Instead, the BRSKI-"rrm"/cBRSKI process would be able to generate and send its own, first, message shown in the example, and the second process would send its own, second message in the example.¶

For a more extensive, DNS-SD compatible encoding of the objective-value that also support Service Instance Names, see [I-D.eckert-anima-grasp-dnssd].¶

3.5.3.1. Overview

"Web Linking", [RFC5988] defines a format, originally for use with HTTP headers, to link an HTTP document against other URIs. Web linking is not a standalone method for discovery of services for use with HTTP.¶

Based on Web Linking, "Constrained RESTful Environments (CoRE) Link Format", Section 1 introduces a stand alone method to discover resources, such as service instances. CORE-LF was introduced primarily for use with Section 1 but it can equally be used for discovery of service instances that use HTTP or any other suitable (web transfer) protocols. This makes CORE-LF an alternative to DNS-SD and GRASP for any of the BRSKI variations.¶

In CORE-LF, an initiator may use (link-local) IPv6 multicast UDP packet to the COAP port (5683) to discover a possible responder for a requested resource. The responder will reply with unicast UDP. If the IPv6 address of a responder has been configured or is otherwise known to the initiator, it may instead of multicast equally query the parameters of the desired resource via unicast to the default COAP UDP or TCP port (5683).¶

[RFC9176] defines a "Resource Directory" mechanism for CORE-LF which is abbreviated CORE-RD. Initiators can learn the IPv6 address protocol (TCP or UDP) and port number of a CORE-RD server by some other mechanism (such as DNS-SD) and then use a unicast UDP or TCP COAP connection to the CORE-RD server to discover CORE-LF resources available on other systems. Resource providers can likewise register their resources with the resource directory server using CORE-RD registration procedures.¶

In summaery, CORE-LF including CORE-RD is a mechanism for registration and discovery of resources and hence services which may be preferred in deployments over other options and can equally be applicable to register/discover any variation of BRSKI for any type of BRSKI service.¶

3.5.3.2. Background

Section 1 specifies the use of CORE-LF as the reference method for pledges to discover registrars - in the absence of any proxies, to allow deployments of scenarios where no proxies are needed - and hence also where Section 1 is not needed. Because BRSKI is designed so that pledges can be agnostic of whether they connect to a registrar directly or via a proxy, the resource/service that the pledge needs to discover is nevertheless called "(brski) join proxy (for pleges)", and encoded in CORE-LF as the value "brski.jp" for the resource type attribute ("rt=resource-type") according to Section 1.¶

The following picture, Figure 6 shows the encoding and an example of this discovery. "ff02::fd" is the link-local scope address for "All Coap Nodes" in IPv6, as introduced in [RFC7390], which also defines IPv6 and site-scoped address options.¶

Template:

REQ: GET coap://[All_Coap_Nodes_IP_multicast_addr]/.well-known/core?rt=brski.jp

RES: 2.05 Content
   <coaps://[Responder_IP_unicast_address]:join-port>; rt="brski.jp"

Example:

REQ: GET coap://[ff02::fd]/.well-known/core?rt=brski.jp

RES: 2.05 Content
   <coaps://[fe80::c78:e3c4:58a0:a4ad]:8485>;rt=brski.jp

Section 1 introduces the operations of a CoAP based join proxy both as a connection based proxy as in Section 1 (only using UDP connections for COAPs instead of TCP for TLS as in Section 1), but also as a new, stateless join proxy - to eliminate the need for potentially highly constrained join proxy nodes to keep connection state and avoid the complexity of protecting that state against attacks. The new resource type "brski.rjp" is defined to support stateless join proxies to discover registrars and their UDP port number that support the stateless, so-called JPY protocol.¶

The following picture, Figure 7 shows the encoding and an example of this discovery. Section 1 introduces the new scheme "coaps+jpy" for the packet header used by the stateless JPY" protocol. The request in the template is assumed to be based on unicast, relying on another method to discover the IP address of the registrar first. It could equally use COAP site-scoped IP multicast, but in general, the assumeption is that registrar will not necessarily be link-local connected to proxies (this may be different in specific deployments). Even though the registrar IP address is hence known, the reply still needs to include this address again because in the [RFC6690] link format, and [RFC3986], Section 3.2, the authority attribute can not include a port number unless it also includes the IP address.¶

Template:

REQ: GET /.well-known/core?rt=brski.jpy

RES: 2.05 Content
     <coaps+jpy://[Responder_IP_unicast_address]:join-port>;rt=brski.jpy

Example:

REQ: GET /.well-known/core?rt=brski.jpy

RES: 2.05 Content
     <coaps+jpy://[2001:db8:0:abcd::52]:7633>;rt=brski.jpy

3.5.3.3. Specification

This section specifies the use of CORE-LF for BRSKI variations. These specifications are backward compatible extensions to what was is specified in [I-D.ietf-anima-constrained-voucher] and [I-D.ietf-anima-constrained-join-proxy], except for noted exceptions, where the requirements are narrowed. This document does not specifiy how to discover It uses terms from the ABNF in section 2 of Section 1 and from [RFC3986] (URI) for explanations and relies on the following template example, Figure 8.¶

Template:

REQ: GET /.well-known/core?rt=brski.*

RES: 2.05 Content
     <scheme://[address]:port path-abempty>;\
       rt=brski-service(;var="brski-variation-string(s)");\
       pw="priority weight"

BRSKI responder sockets are indicated in CORE-LF as a URI-Reference. The URI-Reference SHOULD be a URI with a scheme, the IPv4 or IPv6 address of the responder socket and the port used by the responder. It may optionally be followed by a non-empty path-abempty.¶

URL-references SHOULD not use a domain name instead of an address to allow responders to select a BRSKI responder without requiring DNS support. Likewise, port and scheme MUST be included so that the information can be passed on to consumers without having to modify it. When omitting this information, the full information can only be known in the context of the connections scheme and port through which it was retrieved.¶

Note that these URL-Reference requirements are stronger than those from [I-D.ietf-anima-constrained-voucher] and [I-D.ietf-anima-constrained-join-proxy] to make extensibility easier.¶

BRSKI responder sockets MUST include a resource type field indicating a resource type value indicating a BRSKI service, indicated as "brski-service" in Figure 8. This MUST be registered in the IANA "Resource Type Link Target Attribute Values" registry table, and also referenced in the "BRSKI Variation Contexts" registry table Table 2. A brski-service is a string without "." (single component string).¶

Discovery of registrar sockets by stateful proxies uses the resource type "brski.rs". This can be used in conjunction with any scheme: https:// for BRSKI and coaps:// for cBRSKI. Stateless registrar sockets use the resource type "brski.rjpy". This currently only support the coaps+jpy:// scheme. By its nature, it can only be used with schemes that rely on UDP. These resource type uses are no change over [I-D.ietf-anima-constrained-voucher] and [I-D.ietf-anima-constrained-join-proxy]. This document does not specifiy how to discover BRSKI-PLEDGE via CORE-LF.¶

The variations supported by a BRSKI responder socket are indicated via the optional "var=" link-extension. The value is a quoted-string of one or more space contatenated BRSKI variation strings. The absence of a "var=" link-extension indicates support for only the default variation for the BRSKI context to which the BRSKI service belongs. This can also be indicated as "var=".¶

The optional "pw" target attribute indicates priority and weight for the selection of the resource target with the semantic and format defined in [RFC2782] for priority and weight in DNS SRV resource records. If the attribute pw is absent, then it is assumed to mean pw="65535 0".¶

A non-empty path-abempty indicates a path prefix for the endpoints supporting the BRSKI service and variation that is shorter than the default endpoint paths specified for the service.¶

3.5.3.4. Examples

REQ: GET /.well-known/core?rt=brski.*

01234567890123456789012345678901234567890123456789012345678901234567890123456789
RES: 2.05 Content
Content-Format: 40
Payload:
 <https://[2001:DB8:0815::5e00:5314]:4555>;        # [1]
        rt=brski.rs;var="est-tls prm-jose cmp";
        pw="1 2",
 <https://[2001:DB8:0815::5e00:5314]:4555>;        # [2]
        rt=brski.jp;var="est-tls prm-jose cmp";
        pw="1 2",
 <coaps://[2001:DB8:0815::5e00:5314]:5684/b>;      # [3]
        rt=brski.rs;var=,
        pw="1 2",
 <coaps://[2001:DB8:0815::5e00:5314]:5684/b>;      # [4]
        rt=brski.jp;var=,
        pw="1 2",
 <coaps+jpy://[2001:DB8:0815::5e00:5314]:6534/b>;  # [5]
        rt=brski.rjpy;var=,
        pw="1 2"

Figure 9 shows example BRSKI variations in CORE-LF format. Note that the example is pretty-printed through indentation and breaking long lines. This additional white space is not compatible with actual CORE-LF output. Likewise, the text following "#" are editorial comments.¶

Example [1] is the equivalent announcement for a BRSKI registrar service as shown for DNS-SD in Figure 2 except for the absence of any service instance. Note the use of "var=" to indicate the list of variation strings supported and "pw=" to indicate priority and weight as in DNS-SD.¶

[3] is likewise the comparable example for the cBRSKI registar example with DNS-SD. Note that here, a non-empty path-abempty "/b" is used to indicate a shortened endpoint prefix path for the service. There is no equivalent in DNS-SD defined. When discovering a service via DNS-SD, the service will need to use the (longer) pre-defined endpoint prefixes, such as "/brski" and "/est" instead of "/b".¶

Example [2] is the same socket as [1], but announced as a join proxy socket for pledges. Likewise, [4] is the same socket as [2] announced as a join proxy socket for pledges. Finally, [5] announces the registrars socket in support of stateless BRSKI proxies using the JPY header encapsulation.¶

3.5.3.5. Resource Type Considerations

CORE-LF expresses information about resources of a target identified by a resource type. This specification encodes BRSKI services in CORE-LF also as a resource types, as specified in Section 3.5.3.3. For the purpose of CORE-LF, a BRSKI service is just another resource, except that it characterizes the overall functionality available across a connection to the target, composed of a sequence of endpoint instantiations. In addition, this behavior is further refined by the list of supported variations indicated.¶

Often, resources in CORE-LF do - instead of a service - describe details of as little as a single endpoint, such as its URL prefix and format encoding. The reason why this fine-grained specification is not a good replacement for the concept of service and variation is that the avilability of a set of endpoints with specific encodings does not imply whether the target does support the desired specific sequencing of instantiating those endpoints, including the use of any endpoint encoding option in any combination.¶

Making such arbitrary combinations a requirement can easily lead to more generic, but also more costly implementations and testing requirements without necessarily gaining deployment benefit.¶

BRSKI resource types which are not treated as services according to this specification can still be used if so desired to amend the discovery of shortened endpoints, as shown in Figure 10.¶

RES: 2.05 Content
Content-Format: 40
Payload:
 <https://[2001:DB8:0815::5e00:5314]:4555/b>;      # [1]
        rt=brski.rs;var="est-tls prm-jose cmp";
        pw="1 2",
 <https://[2001:DB8:0815::5e00:5314]:4555/b/rv>;   # [2]
        rt=brski.rs.requestvoucher,
 <https://[2001:DB8:0815::5e00:5314]:4555/b/vs>;   # [3]
        rt=brski.rs.voucher_status,
 </b/rv>;rt=brski.rs.rv,                           # [4]
 </b/vs>;rt=brski.rs.vs,                           # [5]

[1] shows how the prefix for all BRSKI endpoints over "https://" can be shortened from "/.well-known/brski" to "/b". Nevertheless, this would still make it necessary to use "/b/requestvoucher" and "/b/voucher_status" as endpoints.¶

[2] and [3] show how to shorten those two endpoints to "/b/rv" and "/b/rs" by creating resource types "brski.rs.rv" and "brski.rs.vs". By using resource type prefix "brski.rs." for both of them as well as path prefix "/b", it can be implied that these endpoints are part of the service specified in [1],¶

These discovery options can be further compacted such as shown in example [4] and [5] when assuming that the abbreviations "rv" and "vs" are also known even by BRSKI implementations from [I-D.ietf-anima-constrained-voucher]. Likewise, the full socket details can be avoided when one can infer it from context.¶

While these shortenings can be highly useful in often called resources, each endpoint in BRSKI is typically only instantiated once by a pledge, so the overall savings in communication data becauseof these shortenings is likely negligible, and it is better to define short endpoint paths into the variation specification if they are likely needed, such as done in [I-D.ietf-anima-constrained-voucher], such that it is not necessary in cBRKSI to add such shortenings in discovery. For these reasons, this document does not specify if or how to use such resource targets in cunjunction with BRSKI discovery but only discusses possibilities and limitations here.¶

Considerations for such non-service resource type use in BRSKI nevertheless introduces one requirement to avoid conflicts: The names of BRSKI services MUST not duplicate the endpoint names of any resources specified for BRSKI protocols. This means that "rv" or "vs" can not be used to create BRSKI service name resource types "brski.rv" or "brski.rs", and likewise, Additional BRSKI endpoints can not be called "rs", "jp", "jpy" or any other string registered in the BRSKI discover registry tables.¶