Subject: [Netconf] zerotouch/17: How to verify boot-image integrity?

From: Kent Watsen <[email-masked]>
Date: Thu, 7 Jul 2016 01:16:34 +0000

New issue: https://github.com/netconf-wg/zero-touch/issues/17

The current draft hardcodes the use of both the MD5 and SHA1 hash algorithms for the purpose of enabling a device to verify a downloaded boot-image, that may not have an embedded signature.

                  +--ro boot-image
                     +--ro modules
                     |  +--ro module*
                     |     +--ro name?       yang:yang-identifier
                     |     +--ro revision?   string
                     +--ro name       string
                     +--ro md5        string
                     +--ro sha1       string
                     +--ro uri*       inet:uri

But a recommendation came (attribution?) to try to use a digest format more generic and less obsolete.

Here are some options:

  0) do nothing, keep as md5 and shall
  1) replace both with sha256 // still hardcoded, but current
  2) define an identity base type ("digest-algorithm") and some derived types for popular dgst lags

Any other ideas?

Thanks,
Kent

---

From: Andy Bierman <[email-masked]>
Date: Thu, 7 Jul 2016 09:55:14 -0700

On Wed, Jul 6, 2016 at 6:16 PM, Kent Watsen <[email-masked]> wrote:

> The current draft hardcodes the use of both the MD5 and SHA1 hash
> algorithms for the purpose of enabling a device to verify a downloaded
> boot-image, that may not have an embedded signature.
>
>
>
>                   +--ro boot-image
>
>                      +--ro modules
>
>                      |  +--ro module*
>

I prefer option 1

I know using unbounded identityref is the latest fad, but this is really
expensive
on the client side.  I will always prefer 1 mandatory mechanism over an
unbounded set of optional-to-implement choices.

A compromise is to use an identityref but make the sha256 identity
mandatory-to-implement.

> Kent

Andy

>
>
>
>
> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf
>
>