Subject: [Netconf] FW: Kathleen Moriarty's No Objection on draft-ietf-netconf-rfc5539bis-09: (with COMMENT)

From: "Ersue, Mehmet (Nokia - DE/Munich)" <[email-masked]>
Date: Sun, 5 Apr 2015 16:04:42 +0000

-----Original Message-----
From: Kathleen Moriarty [mailto:[email-masked]] 
Sent: Sunday, April 05, 2015 2:56 AM
To: The IESG
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]; Ersue, Mehmet (Nokia - DE/Munich); [email-masked]
Subject: Kathleen Moriarty's No Objection on draft-ietf-netconf-rfc5539bis-09: (with COMMENT)

Kathleen Moriarty has entered the following ballot position for
draft-ietf-netconf-rfc5539bis-09: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-netconf-rfc5539bis/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I found the discussion on the SecDir review interesting, so thanks for
the more detailed explanations.  I do agree that the draft already does
state that this is a certificate fingerprint, but don't see (maybe point
me to where it is if I missed it), that this is all local, per:
https://www.ietf.org/mail-archive/web/secdir/current/msg05526.html

I'm wondering why the yang model that was spilt out into another draft
isn't referenced as that would be helpful as well (last 2 paragraphs of
Tom's response):
https://www.ietf.org/mail-archive/web/secdir/current/msg05524.html

This is non blocking as I'd like to figure out if it's helpful to avoid
questions and link drafts where appropriate (unless I missed something).

Thanks,
Kathleen

---

From: "Ersue, Mehmet (Nokia - DE/Munich)" <[email-masked]>
Date: Mon, 6 Apr 2015 13:11:57 +0000

From: Kathleen Moriarty [mailto:[email-masked]]
Sent: Monday, April 06, 2015 2:30 PM
To: t.petch
Cc: The IESG; [email-masked]; [email-masked]; [email-masked]; [email-masked]; Ersue, Mehmet (Nokia - DE/Munich); [email-masked]
Subject: Re: [Netconf] Kathleen Moriarty's No Objection on draft-ietf-netconf-rfc5539bis-09: (with COMMENT)

On Mon, Apr 6, 2015 at 7:33 AM, t.petch <[email-masked]<mailto:[email-masked]>> wrote:
----- Original Message -----
From: "Kathleen Moriarty" <[email-masked]<mailto:[email-masked]>>
To: "The IESG" <[email-masked]<mailto:[email-masked]>>
Cc: <[email-masked]<mailto:[email-masked]>>; <[email-masked]<mailto:[email-masked]>>;
<[email-masked]<mailto:[email-masked]>>;
<[email-masked]<mailto:[email-masked]>>;
<[email-masked]<mailto:[email-masked]>>; <[email-masked]<mailto:[email-masked]>>
Sent: Sunday, April 05, 2015 1:55 AM
Kathleen

Yes.

Perhaps Netconf and YANG is one of those areas which, if you have not
followed the last 12 years of discussion, you never will quite
understand:-(

Netconf started out with SSH, SOAP and BEEP.  It gained TLS, got reverse
SSH, lost SOAP and BEEP, TLS added 'reverse', 'reverse' was renamed
'call home', it gained a Netconf server YANG model, TLS gained and lost
a YANG model, it added RESTCONF and RESTCONF call home.  Along the way,
TLS gained and lost PSK while SSH acquired certificates.

The current I-D structure was agreed in July 2014 and owes something to
engineering, something to history!  Currently it is netconf-5539bis,
netconf-server-model, netconf-call-home, netconf-restconf and
netconf-zerotouch (with a variety of authors, a variety of target
completion dates and, perhaps, a wish to limit inter-dependencies).

The issue of how to authenticate a client and derive an identifier for
it is awkward and not often tackled in the IETF (which tends to be more
concerned with server authentication and HTTP - this was an issue when
adding SSH/TLS to SNMP, as well); and it cuts across TLS, SSH with
certificates, call home and zero touch while its origins go back to isms
(SNMP).  I see no best place to put all the information nor is it easy
to partition it.

I had a break recently and when I came back to netconf-5539bis,
misunderstood it, because, to my mind, the procedural description
assumed an information model, and I had the wrong model in mind.
Juergen put me straight, and clarified netconf-5539bis but I still had a
lot of background knowledge which probably stopped me having more
misunderstandings.

So yes, a few more sentences could be helpful.  I was, for example,
surprised at the discussion on fingerprints since they have been that
way since isms (SNMP) -  for which Sam was security advisor - and had
not thought of an alternative interpretation.

Thanks, Tom!  Let me know when it's been done and I'll be happy to read it again.

Tom Petch

--

Best regards,
Kathleen