Subject: [netconf] today's updates to client/server drafts

From: Kent Watsen <[email-masked]>
Date: Sun, 8 Mar 2020 21:41:19 +0000

Summary:

With only two lingering issues (AFAIK), we’re very close to done with these drafts.   The two open issues are:

1) how to define the algorithm ids in crypto-types.  The current draft now defines registries and a process that IANA can use to generate YANG modules from them.  This approach seemed reasonable to Rich Salz (SecDir), but Ben Kaduk (Sec AD) suggested that protocol-specific registries may be preferred.  The hope that current approach will give everyone something concrete to reference and improve on.

2) the “supported algorithms” list have been removed from crypto-types but not yet added to the ssh-client-server and tls-client-server drafts.  I was hoping that someone else would do this but, alas, none stepped up.

Following are the per-draft Change Log entries.

crypto-types:

  o  Resolved the "FIXME: forward ref" issue by modulating 'must',
      'when', and 'mandatory' expressions.

  o  Moved the 'generatesymmetric-key' and 'generate-asymmetric-key'
      actions from ietf-keystore to ietf-crypto-types, now as RPCs.

  o  Cleaned up various description statements and removed lingering
      FIXMEs.

  o  Converted the "iana-<alg-type>-algs" YANG modules to IANA
      registries with instructions for how to generate modules from the
      registries, whenever they may be updated.

keystore:

  o  Moved the generate key actions to ietf-crypt-types as RPCs, which
      are augmented by ietf-keystore to support encrypted keys.
      Examples updated accordingly.

  o  Added a SSH certificate-based key (RFC 6187) and a raw private key
      to the example instance document (partly so they could be
      referenced by examples in the SSH and TLS client/server drafts.

truststore:

  o  Removed remaining PSK references from text.

  o  Wrapped each top-level list with a container.

  o  Introduced "bag" term.

  o  Merged "SSH Public Keys" and "Raw Public Keys" in a single "Public
      Keys" bag.  Consuming downstream modules (i.e., "ietf-[ssh/tls]-
      [client/server]) refinei the "public-key-format" to be either SSH
      or TLS specific as needed.

tcp-client-server:

  o  Fixed a few typos.

ssh-client-server:

  o  Removed leaf-list 'other' from ietf-ssh-server.

  o  Removed unused 'external-client-auth-supported' feature.

  o  Added features client-auth-password, client-auth-hostbased, and
      client-auth-none.

  o  Renamed 'host-key' to 'public-key' for when refering to
      'publickey' based auth.

  o  Added new feature-protected 'hostbased' and 'none' to the 'user'
      node's config.

  o  Added new feature-protected 'hostbased' and 'none' to the 'client-
      identity' node's config.

  o  Updated examples to reflect new "bag" addition to truststore.

  o  Refined truststore/keystore groupings to ensure the key formats
      "must" be particular values.

  o  Switched to using truststore's new "public-key" bag (instead of
      separate "ssh-public-key" and "raw-public-key" bags.

  o  Updated client/server examples to cover ALL cases (local/ref x
      cert/raw-key/psk).

tls-client-server:

  o  Removed the unused "external-client-auth-supported" feature.

  o  Made client-indentity optional, as there may be over-the-top auth
      instead.

  o  Added augment to uses of local-or-keystore-symmetric-key-grouping
       for a psk "id" node.

  o  Added missing presence container "psks" to ietf-tls-server's
      "client-authentication" container.

  o  Updated examples to reflect new "bag" addition to truststore.

  o  Removed feature-limited caseless 'case' statements to improve tree
      diagram rendering.

  o  Refined truststore/keystore groupings to ensure the key formats
      "must" be particular values.

  o  Switched to using truststore's new "public-key" bag (instead of
      separate "ssh-public-key" and "raw-public-key" bags.

  o  Updated client/server examples to cover ALL cases (local/ref x
      cert/raw-key/psk).

http-client-server:

  o  Removed the unused "external-client-auth-supported" feature from
      ietf-http-server.

netconf-client-server:

  o  Updated examples to reflect new "bag" addition to truststore.

restconf-client-server:

  o  Updated examples to reflect new "bag" addition to truststore.