Re: [babel] Information model and YANG: about HMAC

Hi Juliusz,

My comments inline.

> On Nov 7, 2018, at 6:21 PM, Juliusz Chroboczek <jch@irif.fr> wrote:
> 
> My comment during the meeting, expanded.
> 
> HMAC does not carry keys or algorithm identifiers on the wire: algorithm
> and key are provisioned by means outside of the Babel protocol (currently
> a configuration file,

That is correct.

> but we're working on implementing key rotation at
> runtime), then only the results of the HMAC computation are sent on the
> wire.

There are and have been several efforts to define key rotation, specially in the now defunct KARP WG, but had a few drafts on this. Let me see if I can dig them up.

> 
> Hence, the base protocol does not need a registry of HMAC algorithm
> identifiers: the only place where HMAC algorithms appear is the config
> file, and how they are expressed there is purely a local implementation
> decision.

I am not clear on what you mean by "expressed". I would agree that the HMAC algorithm is something that has to be expressed in YANG for configuration purposes, and also that it be the same for the two ends of the link.

> 
> What the information model and YANG do is, among other things, to export
> the configuration in an interoperable format.  Hence, if we need to export
> the HMAC keys, we'll need a registry of HMAC protocols.

The "interoperable" format is the YANG model. There are models that define keychain, and even define some of the HMAC protocols.

> 
> If we do, then the initial value should probably be just one entry:
> HMAC-SHA256.

Great. I will look to adding it.

Thanks.

> 
> -- Juliusz
> 
> 
> 
> _______________________________________________
> babel mailing list
> babel@ietf.org
> https://www.ietf.org/mailman/listinfo/babel