Subject: Re: [Netconf] regarding keystore and related drafts

From: Qin Wu <[email-masked]>
Date: Sat, 17 Mar 2018 21:40:12 +0000

Remove comments that have been addressed, please see followup comments.

-----邮件原件-----
发件人: Kent Watsen [mailto:[email-masked]] 
发送时间: 2018年3月18日 4:20
收件人: Qin Wu <[email-masked]>; [email-masked]
主题: Re: regarding keystore and related drafts

Hi Qin,

> Would it be great to see crypto types covers all application requiring 
> asymmetric key.

What do you mean by "all application"?

[Qin]: My impression, the application is SSH specific application, please correct me if I am wrong.

> For trust anchors, I think this draft is more related to certificates

It will likely be used mostly for certificates, but the model enables SSH host keys can be configured as well.

[Qin]: So SSH host keys are not mandatory parameter, correct?

Thanks,
Kent

---

From: Kent Watsen <[email-masked]>
Date: Sat, 17 Mar 2018 23:37:32 +0000

Hi Qin,

<KENT> the immediate need is to support both SSH and TLS, as they are the transports for NETCONF and RESTCONF, but the hope is that the crypto types could be used for other purposes as well.

> For trust anchors, I think this draft is more related to certificates

It will likely be used mostly for certificates, but the model SSH host keys can be configured as well.

<KENT> there is a list of pinned certificates and there is a list of pinned host-keys (see below for the tree diagram).  Neither of which are mandatory on their own, but something would need to be configured if using one of the SSH or TLS based client or server modules (e.g., ietf-tls-client), as those modules have leafrefs to the trust anchors.  Makes sense?

   module: ietf-trust-anchors
     +--rw trust-anchors
        +--rw pinned-certificates* [name]
        |  +--rw name                  string
        |  +--rw description?          string
        |  +--rw pinned-certificate* [name]
        |     +--rw name    string
        |     +--rw data    binary
        +--rw pinned-host-keys* [name]
           +--rw name               string
           +--rw description?       string
           +--rw pinned-host-key* [name]
              +--rw name    string
              +--rw data    binary

Kent