Subject: Re: [Netconf] zerotouch/16: How to encode a chain of certs?

From: Kent Watsen <[email-masked]>
Date: Tue, 11 Oct 2016 02:27:44 +0000

The PKCS#12 format is giving me trouble.   I dumped its ASN.1 content to ensure I was documenting the structure correctly, only to discover that it was password-encrypted, even though I hit <return> for the password (note: this is because it’s using a salt value).  I spent over an hour looking for a way to remove the password completely, but to no avail.  Unless anyone has an idea, I think we should give up on the pkcs#12 format.

So now it’s just PEM and PKCS#7, but between the two, PKCS#7 is by far the better choice.   The idea of supporting more than one format was only really interesting when pkcs#12 was in the mix.  Now I’m not sure if it’s worth it any more.   So, should we stick with:

              +--ro certificate
                  +--ro format    enumeration    <-- choices are “pem” and “pkcs7”
                  +--ro data      binary                   <-- encoding depends on ‘format’ field

or

              +--ro certificate  binary                <-- hardcoded to pkcs#7

Mehmet/Mahesh, since you two selected option #6 (see below) before, I’m especially interested in your opinions.

Thanks,
Kent

From: Netconf <[email-masked]> on behalf of Kent Watsen <[email-masked]>
Date: Thursday, September 29, 2016 at 7:33 PM
To: Mahesh Jethanandani <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [Netconf] zerotouch/16: How to encode a chain of certs?

So both Mahesh and Mehmet (as contributors I believe) selected option #6.  No other responses were received.  Thus I will move forward with option #6.

Thanks,
Kent

From: Netconf <[email-masked]> on behalf of Kent Watsen <[email-masked]>
Date: Tuesday, September 13, 2016 at 7:54 PM
To: Mahesh Jethanandani <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [Netconf] zerotouch/16: How to encode a chain of certs?

<SNIP/>

Recommendations:
  - If we have to pick just one, I’d ask security experts to pick between
    pk7 and p12.  Note: pk7 was a bit easier on the command line, in
    that it didn’t prompt for password.  Also, pk7 round-tripping
    stabilized faster.
  - If we’re okay with devices having to support all formats,

[Mahesh] +1

then I
    think solution #6 is better than #5.

[Mahesh] What is the advantage of solution #6 over #5?

I just like the idea of adding future enumerations more than adding leafs.  This approach ensures more processing steps are always the same.  It’s not much, but it’s something...

Kent

---

From: Kent Watsen <[email-masked]>
Date: Wed, 12 Oct 2016 19:15:16 +0000

No responses so far.   To keep the ball rolling, I’ll assume just supporting pkcs#7 is okay if no objections are raised by this Friday.

Thanks,
Kent

From: Netconf <[email-masked]> on behalf of Kent Watsen <[email-masked]>
Date: Monday, October 10, 2016 at 10:27 PM
To: "[email-masked]" <[email-masked]>
Subject: Re: [Netconf] zerotouch/16: How to encode a chain of certs?

              +--ro certificate

or

Thanks,
Kent

Thanks,
Kent

<SNIP/>

Recommendations:

[Mahesh] +1

then I

Kent