Subject: [Netconf] netconf server-model (keychain) draft issues

From: Kent Watsen <[email-masked]>
Date: Wed, 11 May 2016 19:19:21 +0000

Hi Sean,

Thank you again for your review of the server-model draft before, primarily focusing on the keychain model.  As you know, I updated the draft significantly based on your comments for 95, but one issue remains...

The remaining issue regards 'key-usage' in the generate-private-key action listed on page 23 of https://tools.ietf.org/html/draft-ietf-netconf-server-model-09.  Below is the current (incomplete) definition:

          leaf key-usage {
            type enumeration {
              enum signing    { description "signing"; }
              enum encryption { description "encryption"; }
              // unclear if these should be somehow more
              // specific or varied.
            }

The question is how to make this key-usage definition complete?  I can do the YANG translation, but what are the possible values?  Is it the case that the issue only matters when discussing TPMs, which have very distinct and specific usage profiles?   As a generic keychain model, it shouldn't be specific to network management, but it would be remiss for me to not point out that, in network management, the private key seems to always have the same key usage (i.e. what's needed to establish a SSH/TLS tunnel).   Thoughts?

Thanks,
Kent

---

From: t.petch <[email-masked]>
Date: Thu, 12 May 2016 14:38:51 +0100

----- Original Message -----
From: "Kent Watsen" <[email-masked]>
To: "Sean Turner" <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, May 11, 2016 8:19 PM
> Hi Sean,
>
> Thank you again for your review of the server-model draft before,
primarily focusing on the keychain model.  As you know, I updated the
draft significantly based on your comments for 95, but one issue
remains...
>
> The remaining issue regards 'key-usage' in the generate-private-key
action listed on page 23 of
https://tools.ietf.org/html/draft-ietf-netconf-server-model-09.  Below
is the current (incomplete) definition:
> The question is how to make this key-usage definition complete?  I can
do the YANG translation, but what are the possible values?  Is it the
case that the issue only matters when discussing TPMs, which have very
distinct and specific usage profiles?   As a generic keychain model, it
shouldn't be specific to network management, but it would be remiss for
me to not point out that, in network management, the private key seems
to always have the same key usage (i.e. what's needed to establish a
SSH/TLS tunnel).   Thoughts?

Kent

sidr have defined
"     id-kp-bgpsec-router OBJECT IDENTIFIER ::= { id-kp 30 }

   A BGPsec router MUST require the extended key usage extension to be
   present in a BGPsec Router Certificate it receives.
"

and may be about to define another EKU, while IPsec IKE did dabble with
EKU some time ago.

Tom Petch