Subject: [Netconf] mbj comments on draft-kwatsen-netconf-crypto-types-00

From: Martin Bjorklund <[email-masked]>
Date: Wed, 21 Mar 2018 17:38:48 +0000 (GMT)

Hi,

Some quick comments on draft-kwatsen-netconf-crypto-types-00:

o  identity hash-algorithm

  I suggest you remove the sentence:

       This identity is used in the ietf-zerotouch-information
       module (draft-ietf-netconf-zerotouch)";

o  leaf private-key

        "A binary that contains the value of the private key.  The
         interpretation of the content is defined by the key
         algorithm.  For example, a DSA key is an integer,

  Is it clear how an integer is stored in a "binary"?

o      action generate-private-key {

  Will the public key be instatiated as well?

o  It should be stated that if the client tries to set the private-key
   to "hardware-protected" (or invalid binary data), the server
   returns an error.

o  What happens if the client first configures a key, and then invokes
   the action "generate-private-key"?   Will it just be a mismatch
   beteen the config and operational state?

   Maybe the action should only be available when no private key
   exists?

o  Should the algorithm be mandatory in the config; then it is not
   needed as an input parameter to the action.

   What happens if the algorithm doesn't match the key, either both in
   config, or the key in hardware?

o    grouping certificates-grouping {

      description
        "Certificates associated with this key.

   Which key?  There is no key in this grouping.

/martin