Subject: [netconf] Pointers to major "crypto" threads?

From: "Salz, Rich" <[email-masked]>
Date: Thu, 8 Aug 2019 11:50:51 +0000

I am new to netconf. I am very concerned about the crypto objects drafts, and would like to do some background reading on the discussion threads before commenting. Does anyone have useful pointers they can share?  Replies to me will be summarized for the list.  Thanks.

---

From: Kent Watsen <[email-masked]>
Date: Thu, 8 Aug 2019 15:32:50 +0000

Hi Rich,

What do you mean by "the crypto objects" drafts?   Do you mean https://tools.ietf.org/html/draft-ietf-netconf-crypto-types <https://tools.ietf.org/html/draft-ietf-netconf-crypto-types>?  Is so, then please see the discussion starting on slide #4 here:  https://datatracker.ietf.org/meeting/105/materials/slides-105-netconf-client-server-suite-of-drafts-00 <https://datatracker.ietf.org/meeting/105/materials/slides-105-netconf-client-server-suite-of-drafts-00>.

As an update to that, the Sec DIr discussed with Roman, who discussed with IESG in Montreal.  Nothing significant seemed to come out of it though.  l just pinged the Sec Dir for an update.

If you mean any other draft listed on the first slide on the preso linked above, or RFC 8366 or RFC 8572, I can field questions on them as well, on or off list.

Kent

> On Aug 8, 2019, at 7:50 AM, Salz, Rich <[email-masked]> wrote:
> 
> _______________________________________________
> netconf mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/netconf <https://www.ietf.org/mailman/listinfo/netconf>

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 8 Aug 2019 16:45:56 +0000

*   What do you mean by "the crypto objects" drafts?   Do you mean https://tools.ietf.org/html/draft-ietf-netconf-crypto-types<https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_draft-2Dietf-2Dnetconf-2Dcrypto-2Dtypes&d=DwMFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=QFOViMLDVSb49MVw97CWLsVelHJK_qz9djjspxWiOas&s=cGrVdIk5zF-nsbElnDx6MD5ObESqPnEhhEOF6xkX8Q4&e=>?

Yes, that one.

  *   As an update to that, the Sec DIr discussed with Roman, who discussed with IESG in Montreal.  Nothing significant seemed to come out of it though.  l just pinged the Sec Dir for an update.

I brought this up at the secdir lunch during Montreal, and it was not well-received.

I am looking for email discussion (I guess I can watch meetecho archives if that’s useful) to understand the WG thoughts.

---

From: Kent Watsen <[email-masked]>
Date: Thu, 8 Aug 2019 18:57:45 +0000

> 
> 	• What do you mean by "the crypto objects" drafts?   Do you mean https://tools.ietf.org/html/draft-ietf-netconf-crypto-types?
>  
> Yes, that one.
>   

I'm guessing that you have the same concern with this draft as expressed by others, and thus imagine the thread you are looking for is here: https://mailarchive.ietf.org/arch/browse/netconf/?q=I-D%20Action.

The NETCONF WG's ultimate objective is to define YANG modules enabling the configuration of the NETCONF and RESTCONF protocol stacks, for both client and servers (please see [1] and [2]).  The crypto-types draft is the cornerstone of a hierarchy of drafts supporting this goal:

                                       crypto-types
                                         ^      ^
                                        /        \
                                       /          \
                             trust-anchors       keystore
                                ^      ^------+    ^
                                |              \   |
                                |      +-----------+
                                |     /          \
tcp-client-server     ssh-client-server      tls-client-server     http-client-server
      ^      ^              ^                  ^           ^               ^
      |      |              |                  |           |               |
      |      |              |       +----------+           |               |
      |      |              |       |                      |               |
      |      |              |       |                      |               |
      |      +--------------|-------|------------+         |               |
      |                     |       |            |         |               |
      |                     |       |            |         |               |
      +--------------+      |       |            |         |      +--------+
                     |      |       |            |         |      |
                     |      |       |            |         |      |
                  netconf-client-server        restconf-client-server

Not shown, other WGs are defining YANG modules that import parts of the above.

[1] https://tools.ietf.org/html/draft-ietf-netconf-netconf-client-server
[2] https://tools.ietf.org/html/draft-ietf-netconf-restconf-client-server

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 8 Aug 2019 19:21:44 +0000

>    The NETCONF WG's ultimate objective is to define YANG modules enabling the configuration of the NETCONF and RESTCONF protocol stacks, for both client and servers (please see [1] and [2]).

Thanks for those pieces of information.  "I'll be back" :)