Subject: [babel] info-model: dtls

From: "STARK, BARBARA H" <[email-masked]>
Date: Mon, 18 Feb 2019 15:41:49 +0000

I've spent some time figuring out info model elements for DTLS. Here is what I ended up with. Thoughts?
Barbara

-------------------------
Under top level babel-information-obj
babel-dtls-enable (like with HMAC, enable/disable globally)
babel-dtls-cert-types: : List of supported DTLS certificate types. Possible values include "X.509" and "RawPublicKey".
babel-dtls: : A babel-dtls-obj object. If this object is implemented, it provides access to parameters related to the DTLS security mechanism. An implementation MAY choose to expose this object as read-only.

--------------------------
Definition of babel-dtls-obj

  object {
       string                rw babel-dtls-interfaces<0..*>;
      [boolean               rw babel-dtls-cached-info;]
      [string                rw babel-dtls-cert-prefer<0..*>;]
       babel-dtls-certs-obj  rw babel-dtls-certs<0..*>;
   } babel-hmac-obj;

babel-dtls-interfaces: : List of references to the babel-interfaces entries this babel-dtls entry applies to. If this list is empty, then it applies to all interfaces. An implementation MAY choose to expose this parameter as read-only ("ro").

babel-dtls-cached-info: : Indicates whether the cached_info extension is included in ClientHello and ServerHello messages. The extension is included if the value is "true". An implementation MAY choose to expose this parameter as read-only ("ro").

babel-dtls-cert-prefer: : List of supported certificate types, in order of preference. The values MUST be among those listed in the babel-dtls-cert-types parameter. This list is used to populate the server_certificate_type extension in a Client Hello. Values that are present in at least one instance in the babel-dtls-certs object with a non-empty babel-cert-private-key will be used to populate the client_certificate_type extension in a Client Hello.

babel-dtls-certs: : A set of babel-dtls-keys-obj objects. This contains both certificates for this implementation to present for authentication, and to accept from others. Certificates with a non-empty babel-cert-private-key can be presented by this implementation for authentication.

------------------------------------
Definition of babel-dtls-certs-obj

  object {
       string                ro babel-cert-value;
       string                ro babel-cert-type;
       binary                -- babel-cert-private-key;
      [operation                babel-cert-test;]
   } babel-hmac-obj;

babel-cert-value: : The DTLS certificate in PEM format {{RFC7468}}. This value can only be provided when this instance is created, and is not subsequently writable.

babel-cert-type: : The name of the certificate type of this object instance. The value MUST be the same as one of the enumerations listed in the babel-dtls-cert-types parameter. This value can only be provided when this instance is created, and is not subsequently writable.

babel-cert-private-key: : The value of the private key. If this is non-empty, this certificate can be used by this implementation to provide a certificate during DTLS handshaking. An implementation MUST NOT allow this parameter to be read. This can be done by always providing an empty string, or through permissions, or other means. This value can only be provided when this instance is created, and is not subsequently writable.

babel-cert-test: : An operation that allows a hash of the provided input string to be created using the certificate public key and the SHA-256 hash algorithm. Input to this operation is a binary string. The output of this operation is the resulting hash, as a binary string.

---

From: Antonin Décimo <[email-masked]>
Date: Mon, 18 Feb 2019 23:29:59 +0100

Hello Barbara,

> babel-dtls-interfaces

I’m confused by this, does it still allow to have DTLS enabled on some
interfaces, and disabled on others?

>  } babel-hmac-obj;

Two little copy paste omissions.

-- Antonin

---

From: "STARK, BARBARA H" <[email-masked]>
Date: Fri, 22 Feb 2019 15:38:52 +0000

> -----Original Message-----
> From: Antonin Décimo <[email-masked]>
> 

Toke had suggested "system-wide" enable/disable of a security mechanism, rather than per instance. So I decided to give that a try in this rendition of the model. Since each DTLS instance points to the interface(s) it applies to, it's still possible to have interfaces that aren't pointed to by any DTLS instance (so DTLS isn't used on those interfaces). But if you have DTLS up and running on multiple interfaces and then want to disable on some of those (but not all), this means you either have to delete the interfaces from the interface list or delete the entire instance (including keys). I think this is do-able.

I don't feel strongly about whether enable/disable is at the top or per instance. Do others have thoughts?

> Two little copy paste omissions.

Thx. And there are probably many others... 😊
I greatly appreciate nits being pointed out.
Barbara