Subject: [netconf] rename /ta:trust-anchors to /ts:truststore

From: Kent Watsen <[email-masked]>
Date: Thu, 2 May 2019 17:46:56 +0000

One of the Change Log entries in Monday's update to the trust-anchor's draft said this:

  o  Added groupings 'local-or-truststore-certs-grouping' and 'local-
     or-truststore-host-keys-grouping', matching similar definitions in
     the keystore draft.  Note new (and incomplete) "truststore" usage!

Regarding renaming top-level container, I initially did this so that these new grouping names made sense (i.e., they sound like they're referring to a noun), but a little searching found lots of precedent. For instance:

  1. Truststore and Keystore Definitions
     https://stackoverflow.com/questions/318441/truststore-and-keystore-definitions <https://stackoverflow.com/questions/318441/truststore-and-keystore-definitions>

  2. Trust Store vs Key Store - creating with keytool
     https://stackoverflow.com/questions/6340918/trust-store-vs-key-store-creating-with-keytool <https://stackoverflow.com/questions/6340918/trust-store-vs-key-store-creating-with-keytool>

  3. Difference between trustStore vs keyStore in Java SSL
     http://www.java67.com/2012/12/difference-between-truststore-vs.html <http://www.java67.com/2012/12/difference-between-truststore-vs.html>

In my view, the above not only confirms that we should rename "trust-anchors" to "truststore", but also that we did the right thing in having separate models for keys and trust anchors.

If no objection is raised, this name change will be in the next update to the trust-anchors draft (note: the draft name itself will stay the same).  This update will likely not occur before the crypto-types "hidden" key issue is resolved, so as to minimize the number of updates.

Separately, there needs to be a discussion regarding these new groupings, specifically if the SSL and TLS client/server drafts should be updated to use them, to enable local-definition of trust anchors, rather than only supporting references to /ta:trust-anchors (or now, I guess, /ts:truststore).  It would be great if someone wants to comment on that now as well.

PS: As mentioned in Prague, the goal is to move the three drafts (crypto-types, keystore, and trust-anchors) to Last Call quickly, hence the attention being given to them lately.

Kent // contributor