Subject: [netconf] type for a PSK's "id" node?

From: Kent Watsen <[email-masked]>
Date: Tue, 21 Jul 2020 14:44:51 +0000

Hi Henk,

I’m trying to close a couple issues on list before the meeting...

Below you’ll note the "is this the right type?” comment.  Currently the “id” node is type “string”, what type is used by TLS?

        case psk {
          if-feature psk-auth;
          container psk {
            description 
              "Specifies the server identity using a PSK (pre-shared
              or pairwise-symmetric key).";
            uses ks:local-or-keystore-symmetric-key-grouping {
              augment "local-or-keystore/local/local-definition" {
                if-feature "ks:local-definitions-supported";
                description
                  "Adds an 'id' value when the PSK is used by TLS.";
                leaf id {
                  type string;  // FIXME: is this the right type?
                  description
                    "The key id used in the TLS protocol for PSKs.";
                }   
              } 
            } 
          } 
        } 

K.

---

From: Henk Birkholz <[email-masked]>
Date: Tue, 28 Jul 2020 11:46:02 +0200

Hi all,

this might be pretty much "just in time", but let me elaborate a bit here:

After re-exploring the source of PSK Identity (hints), I arrived at PSK 
Identity Encoding again:

> https://tools.ietf.org/html/rfc4279#section-5.1

If that is the PSK "id" that you are looking for, that always involves a 
conversion to UTF8 encoded bytestrings. If that is interoperable with 
the type string here, that is fine, I'd say. Interoperability already is 
a rather painful compromise here in (D)TLS. Please take care to adhere 
to the encoding guidance, therefore. I am not sure, if you want to cover 
identity hints, too:

> https://tools.ietf.org/html/rfc4279#section-5.2

Viele Grüße,

Henk

On 21.07.20 16:44, Kent Watsen wrote:
> Below you’ll note the "is this the right type?” comment.  Currently the 
> “id” node is type “string”, what type is used by TLS?
> 
> 
> case*psk*{
> if-feature*psk-auth*;
> container*psk*{
> description
> uses*ks:local-or-keystore-symmetric-key-grouping*{
> augment"local-or-keystore/local/local-definition"{
> if-feature"ks:local-definitions-supported";
> description
> leaf*id*{
> typestring; // FIXME: is this the right type?
> description