Subject: [Netconf] NETCONF over TLS Issue remaining from IESG chat

From: "Ersue, Mehmet (NSN - DE/Munich)" <[email-masked]>
Date: Sun, 15 Mar 2009 01:36:18 +0100

Hi All,

we have one remaining issue from the IESG chat 
for the NETCONF over TLS on the way to RFC. (see 
the IESG ballot page for DISCUSSes from Jari Arkko 
and Tim Polk and the text proposals before IESG chat: 
https://datatracker.ietf.org/idtracker/ballot/2950/)

There was an inconcistency between Ch 2.1. and 
3.2. in v-07. 
Ch 2.1 limits implementations to TLS cipher suites 
that provide certificate-based mutual authentication, 
where Ch 3.2 allows connections without verifying 
the client identity.
Jari would be fine with the changes we proposed 
for Ch 3.2. before the IESG chat (see ballot page). 
Tim would consider the issue as resolved if we clarify 
that certificate-based client authentication is a 
requirement and servers must authenticate the client. 

Based on this considerations Badra prepared following 
changes:

Section 2.1:
-----------
OLD:
Implementation of the protocol specified in this document 
MAY implement any TLS cipher suite that provides 
certificate-based mutual   authentication [RFC5246]. 

NEW:
Implementation of the protocol specified in this document 
MAY implement any TLS cipher suite that provides 
certificate-based mutual  authentication [RFC5246]. 
The server MUST support certificate-based client 
authentication.

Section 3.2:
-----------
OLD:
The server may have no external knowledge on client's 
identity and identity checks might not be possible (unless 
the client has a certificate chain rooted in an appropriate 
CA). If a server has knowledge on client's identity (typically 
from some source external to NETCONF or TLS) it MUST 
check the identity as described above.

NEW:
"The server MUST verify the identity of the client with 
certificate-based authentication and according to local 
policy to ensure that the incoming client request is 
legitimate before any configuration or state data is 
sent to or received from the client."

The WG co-chairs think the proposed change will 
address Tim's DISCUSS. We believe this is a suitable 
solution and assume the WG members will agree. 
However, if anyone has STRONG OBJECTIONS, please 
let us know BEFORE March 20, 2009.

Mehmet