Subject: [netconf] Truststore: bags, sets, or other?

From: Kent Watsen <[email-masked]>
Date: Fri, 31 Jan 2020 01:01:29 +0000

[CC-ing Russ, who says he knows a lot about bags ;)

The truststore draft [1] has the following general structure:

   module: ietf-truststore
     +--rw truststore
        +--rw certificates* [name] {x509-certificates}?
        |  +--rw name           string
        |  +--rw certificate* [name]
        |     +--rw name                      string
        |     ...
        +--rw host-keys* [name] {ssh-host-keys}?
        |  +--rw name           string
        |  +--rw host-key* [name]
        |     +--rw name        string
        |     ...
        +--rw raw-public-keys* [name] {raw-public-keys}?
           +--rw name              string
           +--rw raw-public-key* [name]
              +--rw name                 string
              ...

I have been struggling with the naming of the top-level nodes (/certificates, /host-keys, etc.) being plural while also being ‘list’ elements.   What is intended is that each of these top-level nodes is a "list of sets/bags of things.    To resolve this issue, I’m thinking about the following change:

OLD:
            +--rw <thing>s* [name] {<thing-feature>}?
               +--rw name string
                  +--rw <thing>* [name]
                     +--rw name string
                      …

NEW:
            +--rw <thing>-bags {<thing-feature>}?
               +--rw <thing>-bag* [name]
                  +--rw name string
                     +--rw <thing>* [name]
                        +--rw name string
                         …

Better, right?   Any other ideas?

Note that the term “bag” is the commonly used term in crypto circles with regard to PKI and, in particular, in reference to the “CertBag” type defined in Section 4.2.3 in RFC 7292 [2].   That said, I don’t think that “bag" is commonly used in reference to SSH host keys or raw public keys.  I don’t know if that is any issue but, in case it is, the choices are:

	1) use “bag” for all three
	2) use “set” for all three
	3) use “bag” for certificates and “set” for the other two
	4) <another idea?>

Thoughts?

[1] https://tools.ietf.org/html/draft-ietf-netconf-trust-anchors <https://tools.ietf.org/html/draft-ietf-netconf-trust-anchors>
[2] https://tools.ietf.org/html/rfc7292#section-4.2.3 <https://tools.ietf.org/html/rfc7292#section-4.2.3>

Kent

---

From: Martin Bjorklund <[email-masked]>
Date: Fri, 31 Jan 2020 11:10:27 +0100 (CET)

Hi,

Kent Watsen <[email-masked]> wrote:
> I have been struggling with the naming of the top-level nodes
> (/certificates, /host-keys, etc.) being plural while also being ‘list’
> elements.  What is intended is that each of these top-level nodes is a
> "list of sets/bags of things.  To resolve this issue, I’m thinking
> about the following change:
> 
> OLD:

We have current published modules with both "-list" and "-set".  No
"-bag" so far.

For example:

  "list rule-list" in ietf-netconf-acm

  "list module-set" in ietf-yang-library

There are some examples of "s" as well, but these are plural "s" for a
normal list of singletons, and should have been named w/o the plural
"s" (if we were to be consistent).

I would try to avoid "s" for a "list-of-lists", but then pick the
suffix that feels most natural in the domain.  (For example, rather
"list access-control-list" than "list access-control-set").

Perhaps you can argue that "-list" works better for ordered sequences,
and "-set" and "-bag" for unordered.  But then there are "ordeded
sets" and "unordered lists" (and even apparently "ordered bag", in
UML).

The plural "s" is better for a surrounding container (if one exists).

/martin

> 
> Note that the term “bag” is the commonly used term in crypto circles
> with regard to PKI and, in particular, in reference to the “CertBag”
> type defined in Section 4.2.3 in RFC 7292 [2].  That said, I don’t
> think that “bag" is commonly used in reference to SSH host keys or raw
> public keys.  I don’t know if that is any issue but, in case it is,
> the choices are:
> 
> [1] https://tools.ietf.org/html/draft-ietf-netconf-trust-anchors
> <https://tools.ietf.org/html/draft-ietf-netconf-trust-anchors>
> [2] https://tools.ietf.org/html/rfc7292#section-4.2.3
> <https://tools.ietf.org/html/rfc7292#section-4.2.3>
> 
> Kent
> 
>

---

From: Kent Watsen <[email-masked]>
Date: Fri, 31 Jan 2020 22:06:10 +0000

Hi Martin,

>  "list module-set" in ietf-yang-library

True.

> "list access-control-list" than "list access-control-set”).

Agreed.

> sets" and "unordered lists" (and even apparently "ordered bag", in

Perhaps.

> The plural "s" is better for a surrounding container (if one exists).

Agreed.

I also received a private response from Russ, who rather not join the netconf list, but said:

1) “bag” was originally created to deal with issues with ASN.1 the SET and SEQUENCE types, and since have entered general crypto parlance outside the PKCS#12 context.

2) “bag” is the ideal term for when conveying a unordered collection of X.509 certificates.

3) “bag” is not known to be used in the context of SSH host keys or RPKs, but there isn’t anything wrong or bad with doing so either.

All said, I believe the best course is to use “bag” and, more specifically, to use the "/x-bags/x-bag/…” structure that is present at the top of this message.   Assuming there are no objections, this change will be in the next update.

Kent