[babel] hmac info model elements

["STARK, BARBARA H" <[e-mail]>]

I'm looking at what's needed in the info model for HMAC.

I don't think the Index and PC of the Interface and Neighbor tables need to (or should) be exposed in the info model.
We had discussed previously that keys should not be readable -- only add and delete keys. In this case, it's good for a non-readable parameter to have a "nickname" or index to reference it with. And it can be useful to know when the key was added. In my experience, these sorts of shared keys are modeled as strings.
Appendix A (incremental deployment and key rotation) indicates it should be possible to configure a mode where authenticated packets are sent but all packets are accepted.
Multiple HMAC algorithms are possible. The draft doesn't say how the nodes know which algorithm is being used (if multiple are implemented). The draft does say that only one HMAC is calculated per key. Is it assumed the algorithm choice is configured?
Should the challenge expiry timer be configurable?
I've decided to have completely separate HMAC and DTLS objects, because they're very different now that I have detailed designs to work with.
I'm adding an "operation" datatype to support key and cert manipulation. This is intended to be consistent with YANG "action" datatype.

Proposed HMAC model:
add to top level information-obj:
babel-hmac-algorithms (enumerated list of supported HMAC computation algorithms)

security-hmac-obj
  security-hmac-enable (boolean: enable / disable this instance)
  security-hmac-mode (Boolean: do or don't authenticate received packets)
  security-hmac-algorithm (string: one of the supported HMAC algorithms)
  security-interfaces (string list of references to interfaces-obj: the interfaces this instance applies to; if empty, it applies to all interfaces)
  security-add-hmac-key (operation: inputs (reference name, key))  
     hmac-key-obj
         key-name (string: reference name)
         key-date (datetime: timestamp when key was added)
         delete-key (operation)
         check-key (operation: inputs (string, HMAC of string)) ; the node does its own HMAC computation of the input string and compares this to the input HMAC of string; if the computed and input HMAC are the same the operation succeeds.

Thoughts?
Barbara