Subject: Re: [netconf] Truststore: bags, sets, or other?

From: Schönwälder, Jürgen <[email-masked]>
Date: Sat, 1 Feb 2020 08:09:17 +0000

A common interpretation in various data structure libraries is this:

set: unordered collection of something, duplicates not allowed
bag: unordered collection of something, duplicates allowed

/js

On Fri, Jan 31, 2020 at 10:06:10PM +0000, Kent Watsen wrote:
> Hi Martin,
> 
> >> NEW:
> >>            +--rw <thing>-bags {<thing-feature>}?
> >>               +--rw <thing>-bag* [name]
> >>                  +--rw name string
> >>                     +--rw <thing>* [name]
> >>                        +--rw name string
> >>                         …
> >> 
> >> Better, right?   Any other ideas?
> > 
> > We have current published modules with both "-list" and "-set".  No
> > "-bag" so far.
> > 
> > For example:
> > 
> >  "list rule-list" in ietf-netconf-acm
> > 
> >  "list module-set" in ietf-yang-library
> 
> True.
> 
> 
> > There are some examples of "s" as well, but these are plural "s" for a
> > normal list of singletons, and should have been named w/o the plural
> > "s" (if we were to be consistent).
> > 
> > I would try to avoid "s" for a "list-of-lists", but then pick the
> > suffix that feels most natural in the domain.  (For example, rather
> > "list access-control-list" than "list access-control-set”).
> 
> Agreed.
> 
> > Perhaps you can argue that "-list" works better for ordered sequences,
> > and "-set" and "-bag" for unordered.  But then there are "ordeded
> > sets" and "unordered lists" (and even apparently "ordered bag", in
> > UML).
> 
> Perhaps.
> 
> > The plural "s" is better for a surrounding container (if one exists).
> 
> Agreed.
> 
> 
> I also received a private response from Russ, who rather not join the netconf list, but said:
> 
> 1) “bag” was originally created to deal with issues with ASN.1 the SET and SEQUENCE types, and since have entered general crypto parlance outside the PKCS#12 context.
> 
> 2) “bag” is the ideal term for when conveying a unordered collection of X.509 certificates.
> 
> 3) “bag” is not known to be used in the context of SSH host keys or RPKs, but there isn’t anything wrong or bad with doing so either.
> 
> All said, I believe the best course is to use “bag” and, more specifically, to use the "/x-bags/x-bag/…” structure that is present at the top of this message.   Assuming there are no objections, this change will be in the next update.
> 
> 
> Kent
> 

> _______________________________________________
> netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <https://www.jacobs-university.de/>

---

From: "Rob Wilton (rwilton)" <[email-masked]>
Date: Mon, 3 Feb 2020 14:51:29 +0000

+1

This would also be my normal interpretation of a structure described as a "bag", although they don't seem to be that commonly used.

Thanks,
Rob

-----Original Message-----
From: netconf <[email-masked]> On Behalf Of Schönwälder, Jürgen
Sent: 01 February 2020 08:09
To: Kent Watsen <[email-masked]>
Cc: Russ Housley <[email-masked]>; [email-masked]
Subject: Re: [netconf] Truststore: bags, sets, or other?

/js

On Fri, Jan 31, 2020 at 10:06:10PM +0000, Kent Watsen wrote:
> > There are some examples of "s" as well, but these are plural "s" for 
> > a normal list of singletons, and should have been named w/o the 
> > plural "s" (if we were to be consistent).
> > 
> > Perhaps you can argue that "-list" works better for ordered 
> > sequences, and "-set" and "-bag" for unordered.  But then there are 
> > "ordeded sets" and "unordered lists" (and even apparently "ordered 
> > bag", in UML).
> 
> Perhaps.
>

---

From: Kent Watsen <[email-masked]>
Date: Mon, 3 Feb 2020 20:21:34 +0000

Searching online for “bag”, I found definitions vary (even amongst university CS sites) regarding if duplicates are allowed.  FWIW, this variation also exists in IETF RFCs, as CMS uses the ASN.1’s "SET OF” syntax (duplicates not allowed) whereas PKCS#12 uses ASN.1’s “SEQUENCE” syntax (duplicates allowed).  In any case, if duplicates are present, they have no impact on processing behavior (e.g., a certificate isn’t somehow more trusted if it appears more than once).

Of course, YANG only has ‘list’ and ‘leaf-list’ statements for collections.  So perfect mappings aren’t always possible.  As Martin noted in his message, the substring "set” is used in published modules (e.g., module-set).  Interestingly, lists generally allow for duplicates, but YANG lists don’t, due to being keyed, unless the scope is reduce to the non-key fields, e.g., assuming certificate ‘C’, both {key1, C} and {key2, C} could be in the Truststore at the same time.

I still feel that “bag” is the best term to use here due to it being a distinctive crypto-domain term used for set-like collections.  I’m assuming that this (using “bag”) is okay since no real objection has been voiced yet, but please let me know if that is a misunderstanding on my part.

Kent // contributor

> On Feb 3, 2020, at 9:51 AM, Rob Wilton (rwilton) <[email-masked]> wrote:
> 
> +1
>

---

From: Russ Housley <[email-masked]>
Date: Mon, 3 Feb 2020 16:06:51 -0500

> On Feb 3, 2020, at 3:21 PM, Kent Watsen <[email-masked]> wrote:
>

---

From: Randy Presuhn <[email-masked]>
Date: Mon, 3 Feb 2020 13:38:17 -0800

Hi -

There is no reason to use two terms for one thing.
Use the term "bag" only if what you're describing
is indeed not a set, i.e., if it is unordered and
allows duplicates.

Randy

---

From: Ladislav Lhotka <[email-masked]>
Date: Tue, 04 Feb 2020 20:45:30 +0100

> This would also be my normal interpretation of a structure described as a "bag", although they don't seem to be that commonly used.

I think the term was coined in Smalltalk-80, where Bag is a subclass of Collection such that

- its elements are not ordered
- are not accessible by a key
- duplicates are allowed

Lada

-- 
Ladislav Lhotka 
Head, CZ.NIC Labs
PGP Key ID: 0xB8F92B08A9F76C67

---

From: Balázs Kovács <[email-masked]>
Date: Fri, 7 Feb 2020 16:13:24 +0000

Hi,

I agree that bag is an appropriate term in the certificate management or crypto-domain. So  +1 for that.

Br,
Balazs

-----Original Message-----
From: netconf <[email-masked]> On Behalf Of Kent Watsen
Sent: Monday, February 3, 2020 9:22 PM
To: Rob Wilton (rwilton) <[email-masked]>
Cc: Russ Housley <[email-masked]>; [email-masked]
Subject: Re: [netconf] Truststore: bags, sets, or other?

Kent // contributor