Subject: [Netconf] PSK Identity Types

From: Badra <[email-masked]>
Date: Wed, 23 Nov 2011 15:13:38 +0400

Dear all,

draft-badra-netconf-rfc5539bis-00 includes support for certificate and
pre-shared key (PSK)-based authentication.

RFC4279 listed three "PSK Identity" types: DNS Names, X509 Distinguished
Names and IP Addresses.

PSK identity is used as the NETCONF username. Please don't hesitate to
propose more identity types so we include them in the draft

Best regards,
Badra

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Wed, 23 Nov 2011 12:56:19 +0100

> propose more identity types so we include them in the draft

I and Badra seem to have different interpretations of this text
(quoting from RFC 4279):

  5.1.  PSK Identity Encoding

     The PSK identity MUST be first converted to a character string, and
     then encoded to octets using UTF-8 [UTF8].  For instance,

     o  IPv4 addresses are sent as dotted-decimal strings (e.g.,
        "192.0.2.1"), not as 32-bit integers in network byte order.

     o  Domain names are sent in their usual text form [DNS] (e.g.,
        "www.example.com" or "embedded\.dot.example.net"), not in DNS
        protocol format.

     o  X.500 Distinguished Names are sent in their string representation
        [LDAPDN], not as BER-encoded ASN.1.

My reading of this text is that the PSK identity is a UTF-8 character
string. Period. 

In case your identity is an IPv4 address or a domain name or an X.500
DN (that is stuff that is natively not a UTF-8 character string), the
bullets say how to render things in UTF-8.  I do not see a requirement
in this text to specify identity types and specific encoding rules. In
other words, if I call my PSK identity "badra", the resulting string
is simply the five UTF-8 character sequence "badra".

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Badra <[email-masked]>
Date: Wed, 23 Nov 2011 13:24:49 +0100

> is simply the five UTF-8 character sequence "badra".

I agree with your interpretation; RFC4279 doesn't mandate the use of any
particular type of identity. I wanted in my previous message to know if we
need to add more examples on how to convert, to UTF-8, some different PSK
Identities not being listed in RFC4279. If this is not required, so the
current text is more than enough.

Best regards,
Badra