[babel] info-model: dtls

["STARK, BARBARA H" <[e-mail]>]

I've spent some time figuring out info model elements for DTLS. Here is what I ended up with. Thoughts?
Barbara

-------------------------
Under top level babel-information-obj
babel-dtls-enable (like with HMAC, enable/disable globally)
babel-dtls-cert-types: : List of supported DTLS certificate types. Possible values include "X.509" and "RawPublicKey".
babel-dtls: : A babel-dtls-obj object. If this object is implemented, it provides access to parameters related to the DTLS security mechanism. An implementation MAY choose to expose this object as read-only.

--------------------------
Definition of babel-dtls-obj

  object {
       string                rw babel-dtls-interfaces<0..*>;
      [boolean               rw babel-dtls-cached-info;]
      [string                rw babel-dtls-cert-prefer<0..*>;]
       babel-dtls-certs-obj  rw babel-dtls-certs<0..*>;
   } babel-hmac-obj;

babel-dtls-interfaces: : List of references to the babel-interfaces entries this babel-dtls entry applies to. If this list is empty, then it applies to all interfaces. An implementation MAY choose to expose this parameter as read-only ("ro").

babel-dtls-cached-info: : Indicates whether the cached_info extension is included in ClientHello and ServerHello messages. The extension is included if the value is "true". An implementation MAY choose to expose this parameter as read-only ("ro").

babel-dtls-cert-prefer: : List of supported certificate types, in order of preference. The values MUST be among those listed in the babel-dtls-cert-types parameter. This list is used to populate the server_certificate_type extension in a Client Hello. Values that are present in at least one instance in the babel-dtls-certs object with a non-empty babel-cert-private-key will be used to populate the client_certificate_type extension in a Client Hello.

babel-dtls-certs: : A set of babel-dtls-keys-obj objects. This contains both certificates for this implementation to present for authentication, and to accept from others. Certificates with a non-empty babel-cert-private-key can be presented by this implementation for authentication.

------------------------------------
Definition of babel-dtls-certs-obj

  object {
       string                ro babel-cert-value;
       string                ro babel-cert-type;
       binary                -- babel-cert-private-key;
      [operation                babel-cert-test;]
   } babel-hmac-obj;

babel-cert-value: : The DTLS certificate in PEM format {{RFC7468}}. This value can only be provided when this instance is created, and is not subsequently writable.

babel-cert-type: : The name of the certificate type of this object instance. The value MUST be the same as one of the enumerations listed in the babel-dtls-cert-types parameter. This value can only be provided when this instance is created, and is not subsequently writable.

babel-cert-private-key: : The value of the private key. If this is non-empty, this certificate can be used by this implementation to provide a certificate during DTLS handshaking. An implementation MUST NOT allow this parameter to be read. This can be done by always providing an empty string, or through permissions, or other means. This value can only be provided when this instance is created, and is not subsequently writable.

babel-cert-test: : An operation that allows a hash of the provided input string to be created using the certificate public key and the SHA-256 hash algorithm. Input to this operation is a binary string. The output of this operation is the resulting hash, as a binary string.