Re: [lmap] AD evaluation: draft-ietf-lmap-information-model-16

[Juergen Schoenwaelder <[e-mail]>]

On Wed, Jan 25, 2017 at 10:57:19AM -0500, Alissa Cooper wrote:
> Juergen,
> 
> > On Jan 25, 2017, at 4:18 AM, Juergen Schoenwaelder <[e-mail]> wrote:
> > 
> > Trevor,
> > 
> > this is also the explanation I came up with but the document does not
> > really explain this. Alissa, would this resolve your comment if I try
> > to add text that tries to explain this distinction? Would it help to
> > add examples?
> 
> Explanation and examples would help, especially if some clear delineation about what belongs in each credential set can be given, albeit while remaining generic. But the bigger question is ...
> 
> > 
> > - SSH host keys are I think examples of MA credentials while SSH user
> >  authentication keys and authorization lists are channel
> >  credentials.
> > 
> > - X.509 certificates defining trust to X.509 root authorities are
> >  examples of MA credentials. while X.509 client ceritifcates for TLS
> >  communication are channel credentials.
> 
> … can you explain why you want the controller to be able to change each of these on the MA, from how they were pre-configured?
>

I will try to write some text. Here is the story line: The channel
credentials are relatively obvious (I think) since (i) credentials
often have an expire time (e.g., valid until in X.509 certificates)
and (ii) a controller may want to push channel credentials that are
necessary to talk to a collector or a different controller - i.e., an
initial bootstrap controller may want to redirect a device to another
controller taking care of the device subsequently. If you think about
this, then it may indeed be necessary to update MA credentials as well
in order to allow the MA to verify the credentials presented by a
collector or a different controller.

For an MA embedded in a more complex system, the management of the
credentials may not be controller specific or it may be done entirely
by a different component. In the YANG models, the LMAP model does not
deal with credential management at all. Instead, credentials are deal
with with the NETCONF/RESTCONF data models. And they again refer to
security protocol specific models (for SSH and TLS) and these again
refer to a keystore data model. All this is relatively complex and all
the LMAP information models says is that the functionality to manage
credentials is needed - but it leaves it opaque.

Do you think it is wrong to say that an LMAP controller may need to
update channel and MA credentials in the information model?

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
Fax:   [phone]         <http://www.jacobs-university.de/>