Subject: [Netconf] zerotouch/13: Signature over YANG data?

From: Kent Watsen <[email-masked]>
Date: Wed, 11 May 2016 23:20:23 +0000

https://github.com/netconf-wg/zero-touch/issues/13

Slide #11 presented during the IETF 95 meeting said:

=====START=====
Current text says that the signature is over the data in whatever form it’s provided (XML or JSON)

This works great for all sources of bootstrapping data but, for the bootstrap server, requires that both the northbound application and the device access specific URL resources:
/ietf-zerotouch-bootstrap-server:devices/device=123456/redirect-information
/ietf-zerotouch-bootstrap-server:devices/device=123456/bootstrap-information

But this approach has issues:

  *   Server MUST NOT change its encoding in any way between the time the data was saved and when the device retrieves the data
  *   These two resources are under a choice node, and the device doesn’t know up front which will be present.
  *   It is desirable for device to just fetch the top-level “device” resource, to get everything in one request

Options:

  *   Keep as is (e.g., force device to try both URL resources) // up to 3 round trips instead of just one
  *   Define a canonical format for XML and JSON encodings // Not sure if this is even possible…
  *   Define an encoding-independent signature algorithm      // tricky to define, not easy to implement
  *   Encode both resources in a leaf having type “string”       // even though it’s YANG-encoded data

Thoughts?
=====STOP=====

In the discussion on this slide, Jeff Haas noted that PKCS#9 is popular in the IETF and that he felt that canonicalization might be a requirement. But Kent noted that canonicalization is practically impossible given that XML/JSON has no guaranteed ordering of tree nodes.

I don't think we have a good solution yet...

Kent