Joint ONAP security subcommittee – SDC and VNFSDK project meeting 2017-08-10

Agenda Needs of VNF SDK and discussion around Certificate Authority. Purpose: Understand the needs of VNF SDK (presented by Chris) Discussion around proposals and options for Release 1 Next Step Identification Discussion around passwords, certificates, etc handling. Discussion around the needs overall Note down identified needs Discuss ambition for R1 and then R2 and beyond

Meeting Notes Needs of VNF SDK and discussion around Certificate Authority. Chris presented that they want to sign the VNF packages He raised that this maybe a bigger issue than VNFSDK but an over ONAP issue. Option A: It was raised that having a single ONAP CA (as an intermediator) may not be the best approach, but allow different certificate authorities. Would the LF be an option – maybe relates to open encrypt, but there maybe limitations due to the use case they support (websites). A suggested option was kyrio.com Option B: The other solution is to configure the roots of the major CAs (which are in a standard keystore). This could be placed in the “openconfig” repo and delivered as part of onap. Will continue in seccom, and circle back.

Meeting Notes Discussion around passwords, certificates, etc handling. We have work ongoing for this

General The “Discussion around passwords, certificates, etc handling” was considered to be the first priority to solve, then come back to the CA.