Subject: [Netconf] A catchy name for zerotouch?

From: Kent Watsen <[email-masked]>
Date: Thu, 22 Feb 2018 19:56:43 +0000

I've been thinking about sending this message for a few weeks now.  And,
as I'm putting the final touches on -20, I'm thinking that it's now or
never.

Essentially, the problem is that our zerotouch solution lacks a catchy
name or way of being referenced.  Calling it just "zerotouch" seems a
bit ambiguous, while calling it "netconf zerotouch" is a mouthful and
too easily mistaken for the protocol.

For reference, the draft's current title is:

  Zero Touch Provisioning for NETCONF or RESTCONF based Management

Here are some ideas I've had:

1) Introduce a keyword/name for the solution
   (it would show in title, but otherwise not much else changes)

   * 0-Touch   : this does nothing for speech, but could help print
   * SecureZTP : maybe a little broad, but it's not taken
   * SecBoot   : too geeky? 
   * ZeroStart : too marketing oriented?

2) Rename the title, perhaps via an acronym
   (potentially leads to global search/replace)

   Secure Zero Touch Provisioning (SZTP)  [no global search/replace needed]
   Secure Automatic Configuration using Transport-level Security and Vouchers (SACTaV)
   Secure Bootstrap using Transport-level Security and Vouchers (SBTSV)

Any thoughts or other ideas?

Thanks,
Kent    // co-author

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 22 Feb 2018 21:27:21 +0100

I do not know whether something 'fancy' is needed but I think the
title can be improved, I think 'bootstrapping' is clearer than
'provisioning' and you are bootstrapping management sessions.

  OLD

  NEW

  Zero Touch Bootstrapping of NETCONF or RESTCONF Management Sessions

I have no clue whether the mechanism could also bootstrap other
management sessions; if so one could be more general:

  NEW

  Zero Touch Bootstrapping of Network Management Sessions

/js

PS: I have not read the I-D lately so I may be way wrong.

On Thu, Feb 22, 2018 at 07:56:43PM +0000, Kent Watsen wrote:
> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <https://www.jacobs-university.de/>

---

From: Alexander Clemm <[email-masked]>
Date: Fri, 23 Feb 2018 01:27:53 +0000

+1

Zero-Touch Bootstrapping is a name that fits much better than Zero-Touch Provisioning

--- Alex

> -----Original Message-----
> From: Netconf [mailto:[email-masked]] On Behalf Of Juergen
> Schoenwaelder
> Sent: Thursday, February 22, 2018 12:27 PM
> To: Kent Watsen <[email-masked]>
> Cc: [email-masked]
> Subject: Re: [Netconf] A catchy name for zerotouch?
> 
> I do not know whether something 'fancy' is needed but I think the title can be
> improved, I think 'bootstrapping' is clearer than 'provisioning' and you are
> bootstrapping management sessions.
> 
>   OLD
> 
> I have no clue whether the mechanism could also bootstrap other management
> sessions; if so one could be more general:
> 
>   NEW
> 
> > I've been thinking about sending this message for a few weeks now.
> > And, as I'm putting the final touches on -20, I'm thinking that it's
> > now or never.
> >

---

From: Robert Wilton <[email-masked]>
Date: Fri, 23 Feb 2018 09:24:04 +0000

Hi Kent,

Ignoring my ignorance for a moment, but I thought that ZTP was quite a 
well known acronym for zero touch provisioning.  E.g. when I google ZTP 
it finds it as the top result.

If this draft is doing ZTP for NETCONF/RESTCONF then I would suggest 
that keeping the ZTP letters is a helpful thing.  If it is doing 
something else then it is a bad thing :-).

As for an acronym, SZTP is OK, or perhaps something also with Y in it 
for YANG, or even perhaps just ZTP :-)

Thanks,
Rob

On 22/02/2018 19:56, Kent Watsen wrote:
> .

---

From: Kent Watsen <[email-masked]>
Date: Fri, 23 Feb 2018 14:30:46 +0000

Hi Rob,

Yes, "ZTP" is a common acronym, which is both a good and bad thing. 
Good because it's recognizable, bad because it's a bit presumptuous
to claim that particular acronym for this.  That said, I do think
that "SZTP" is fair game, hence that suggestion before.

Hi Juergen/Alex,

Yes, "bootstrapping" over "provisioning" is likely a better (more
descriptive) and, as a bonus, it gives a little separation from 
the more commonly used term.

Yes, Juergen, this solution is not particular to NC/RC, and so
your idea of cutting that part out of the title is good.

So, how about this for a new title?

  Secure Zero Touch Bootstrapping (SZTB)

Kent // author

===== original message =====

Hi Kent,

Thanks,
Rob

On 22/02/2018 19:56, Kent Watsen wrote:
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_netconf&d=DwIDaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=3pBiWL9L5DhCkAQ1ByTCt3_niXUnUM0CcadRZTvJn7Y&s=34e7ymx4ur03p0V6Li5N4WWsguAYcYdkFgzV1eBbZhk&e=
> .
>

---

From: Robert Wilton <[email-masked]>
Date: Fri, 23 Feb 2018 14:41:58 +0000

> that "SZTP" is fair game, hence that suggestion before.
OK, so this is only part of a ZTP solution?

>    Secure Zero Touch Bootstrapping (SZTB)
OK with me.  But I would also be happy to loose the "secure" part as 
well in the title, and just have it as ZTB.

Thanks,
Rob

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 23 Feb 2018 16:08:27 +0100

>   Secure Zero Touch Bootstrapping (SZTB)

I personally do no need an acronym and I prefer a title that tells me
what is being bootstrapped - do you really think this spec bootstraps
everything possible? The abstract is much more specific.

   This draft presents a secure technique for establishing a NETCONF or
   RESTCONF connection between a newly deployed device, configured with
   just its preconfigured initial state (e.g., factory default
   settings), and its deployment specific network management system
   (NMS).

Hence my original proposal:

(If the abstract is correct, then this title has the advantage the
people searching for NETCONF or RESTCONF will actually find this
document.)

/js

---

From: Kent Watsen <[email-masked]>
Date: Fri, 23 Feb 2018 17:41:01 +0000

> OK, so this is only part of a ZTP solution?

No, in a general sense, the solution presented in this draft is a full
ZTP solution.  I'm just saying that there may be other ZTP solutions,
and coining that specific term might be reaching.

>well in the title, and just have it as ZTB.

I like the "secure" part is good because it contrasts the solution 
from the last 20 years or so of ZTP solutions...

Looking at Juergen's follow-up, first, an acronym is important for the
reasons mentioned at the beginning of this thread.  We can leave it out
of the title, if it's particularly objectionable, but then define/use
it elsewhere (e.g., in the abstract).  Next, regarding the title not
indicating what is being bootstrapped, perhaps we should say something
about the devices?  Putting it together:

  Secure Zero Touch Bootstrapping for Networking Devices

Or perhaps more like a sentence:

  A Secure Zero Touch Bootstrapping Mechanism for Networking Devices

This second option gets away from being able refer to the solution as
"SZTB", though I would still do so (e.g., use "SZTB" in the abstract).

Thoughts?

Kent

K.  // author

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 23 Feb 2018 18:47:18 +0100

> "SZTB", though I would still do so (e.g., use "SZTB" in the abstract).

So either the title claims too much or the abstract is a complete
understatement. Bootstrapping a networking device means to me a lot
more than getting NC/RC sessions going.

/js

---

From: Kent Watsen <[email-masked]>
Date: Fri, 23 Feb 2018 19:01:10 +0000

Juergen writes:
> Kent writes:
>> Putting it together:

True, here we're just interested in getting the initial management 
session(s) up, after which there may be another round of "initial config"
pushed to the device, all of which could be construed as being part
of "bootstrapping a device".

Fine, then tweaking your previous suggestion:

  Secure Zero Touch Bootstrapping of Network Management Sessions

and use SZTB in the draft.   Everybody okay?

Kent // author

---

From: Andy Bierman <[email-masked]>
Date: Fri, 23 Feb 2018 11:11:10 -0800

>   Secure Zero Touch Bootstrapping of Network Management Sessions
but the device can be bootstrapped without any need for subsequent
management
sessions, right?

> and use SZTB in the draft.   Everybody okay?
no - I prefer to leave the name as-is.
IMO the term "IETF Zerotouch" is already being used, sometimes called "IETF
ZTP".
Gratuitous name changes late in the process should be avoided.

> Kent // author

Andy

---

From: Andy Bierman <[email-masked]>
Date: Fri, 23 Feb 2018 14:06:03 -0800

On Fri, Feb 23, 2018 at 1:55 PM, Kent Watsen <[email-masked]> wrote:

> Hi Andy,
> Yes, the solution stops at providing a device its "onboarding information"
> (i.e. boot-image,
>
> pre-config script, an initial config, and a post-config script).   It is
> the case that the net-result
>
> of all this may not result in the establishment of any management
> sessions.  For instance, it
>
> may result only in the establishment of control-plane or data-plane
> sessions, or perhaps no
>
> sessions at all, though this last scenario is unlikely.
>
>
>
> > IMO the term "IETF Zerotouch" is already being used, sometimes called
> "IETF ZTP".
>
> Per the above proposal, "Zero Touch" is still in the title and thus "IETF
> Zerotouch" would still
>
> be valid.  The 'P' was replaced with a 'B', and so "IETF ZTP" might be a
> stretch, but this goes
>
> back to my concern that it might be a bit presumptuous for us to claim
> that particular acronym.
>
> For instance, the ANIMA BRSKI draft might also claim to be an IETF-defined
> ZTP solution.
>
>
>
>
>
> Starting over, the current title is:
>
>
>
> A minimal change could be:
>
>
>
>     Secure Zero Touch Provisioning for NETCONF or RESTCONF based Management
>
>
>
> and use SZTP in the abstract.   This gives me what I want (an acronym),
> but:
>
>
>
>   1) Provisioning vs Bootstrapping
>
>           - I'm okay either way.
>
>           - The acronym ZTP is very common, whereas I've never seen ZTB
>
>           - 'P' has a recognition advantage, while 'B' is slightly more
> meaningful
>
>
>
>   2)  NETCONF or RESTCONF based Management vs Network Management Sessions
>
>           - maybe a compromise could be just "Network Management", since
> you object
>
>             to the word "session" and Juergen rightly points out that we
> don't have to
>
>             pin it to NC and RC?
>
>          - The result would be:
>
>                Secure Zero Touch Provisioning for Network Management
>
>
>
> Andy, would this last suggestion be okay with you?
>
>
>

OK:

 Secure Zero Touch Provisioning for Network Management

But some people not following this email list will still be confused by the
change

Andy

---

From: Kent Watsen <[email-masked]>
Date: Fri, 23 Feb 2018 21:55:34 +0000

Hi Andy,

> but the device can be bootstrapped without any need for subsequent management
> sessions, right?

Yes, the solution stops at providing a device its "onboarding information" (i.e. boot-image,
pre-config script, an initial config, and a post-config script).   It is the case that the net-result
of all this may not result in the establishment of any management sessions.  For instance, it
may result only in the establishment of control-plane or data-plane sessions, or perhaps no
sessions at all, though this last scenario is unlikely.

> IMO the term "IETF Zerotouch" is already being used, sometimes called "IETF ZTP".

Per the above proposal, "Zero Touch" is still in the title and thus "IETF Zerotouch" would still
be valid.  The 'P' was replaced with a 'B', and so "IETF ZTP" might be a stretch, but this goes
back to my concern that it might be a bit presumptuous for us to claim that particular acronym.
For instance, the ANIMA BRSKI draft might also claim to be an IETF-defined ZTP solution.

and use SZTP in the abstract.   This gives me what I want (an acronym), but:

  1) Provisioning vs Bootstrapping
          - I'm okay either way.
          - The acronym ZTP is very common, whereas I've never seen ZTB
          - 'P' has a recognition advantage, while 'B' is slightly more meaningful

  2)  NETCONF or RESTCONF based Management vs Network Management Sessions
          - maybe a compromise could be just "Network Management", since you object
            to the word "session" and Juergen rightly points out that we don't have to
            pin it to NC and RC?
         - The result would be:
               Secure Zero Touch Provisioning for Network Management

Kent // author

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Sat, 24 Feb 2018 10:25:41 +0100

I still think we should have a title that reflects what is in the
document. This is the IETF, not a marketing organization.

/js

---

From: "Mehmet Ersue" <[email-masked]>
Date: Mon, 26 Feb 2018 17:07:04 +0100

Current title is fine.

Cheers,
Mehmet

> Sent: Saturday, February 24, 2018 10:26 AM
document. This is
> the IETF, not a marketing organization.
> 
> /js
> 
> --

---

From: Kent Watsen <[email-masked]>
Date: Mon, 26 Feb 2018 17:17:25 +0000

> Current title is fine.

But does the current title reflect what's in the document?
Is the solution really just for NETCONF and RESTCONF?

Personally, I thought focusing on "networking devices" was
most accurate.  Keeping the 'P' for Andy and removing "secure"
for Juergen, this title is accurate:

  Zero Touch Provisioning for Networking Devices

Yes, Juergen, the abstract should be adjusted, something like this:

  This draft presents a technique to securely provision a networking
  device when it is booting in a factory-default state.  Variations
  in the solution enables it to be used on both public and private
  networks.  The provisioning steps are able to update the boot image,
  commit an initial configuration, and execute arbitrary scripts to
  address auxiliary needs.  The updated device is subsequently able
  to establish secure connections with other systems.  For instance,
  a device may establish NETCONF [RFC6241] and/or RESTCONF [RFC8040]
  connections with deployment-specific network management systems.

Thoughts?

Kent

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Mon, 26 Feb 2018 19:53:40 +0100

>   connections with deployment-specific network management systems.

Sure, I have not read the I-D for a while so it might meanwhile do all
of this. Is the new SUIT WG [1] aware of this work?

/js

[1] https://datatracker.ietf.org/wg/suit/about/

---

From: Kent Watsen <[email-masked]>
Date: Mon, 26 Feb 2018 20:18:40 +0000

Juergen writes:
> of this. 

Andy, are you also okay with this?  You can still call it "IETF Zerotouch"
or "IETF ZTP" if you like...

> Is the new SUIT WG [1] aware of this work?

I haven't interacted with the SUIT WG particularly, but I notice that 
Russ Housley is a co-chair and recall that we recently had a PKCS7 to
CMS discussion that involved him.  FWIW, SUIT seems to be more about
ongoing firmware updates, whereas this work only cares about an initial
update.

Kent  // co-author

---

From: Andy Bierman <[email-masked]>
Date: Mon, 26 Feb 2018 12:38:50 -0800

> or "IETF ZTP" if you like...
OK