Re: [Netconf] Draft Charter Proposal for NETCONF WG

["Acee Lindem (acee)" <[e-mail]>]

On 3/22/17, 8:29 PM, "Mahesh Jethanandani" <[e-mail]> wrote:

>Acee,
>
>
>> On Mar 22, 2017, at 3:35 PM, Acee Lindem (acee) <[e-mail]> wrote:
>> 
>> Kent,
>> 
>> 
>> On 3/22/17, 6:21 PM, "Kent Watsen" <[e-mail]> wrote:
>> 
>>> [resending, sorry, wrong key-chain draft alias used before]
>>> 
>>> 
>>> 
>>> Hi Mahesh,
>>> 
>>> 
>>>>> Again, a keystore is not limited to asymmetric keys.   At the moment
>>>>> it is exclusively asymmetric, but that's only because we (the
>>>>>authors)
>>>>> moved the passwords (read symmetric keys) that were present in the
>>>>> previous version to the ietf-ssh-client module, but they may return,
>>>>> as many real-world keystore mechanisms do manage passwords as well
>>>>> (e.g., Mac OSX's Keychain Access utility).
>>>>> 
>>>>> The module names are fine, but we could update the draft title. How
>>>>> about "A System-level Keystore Model"?
>>>> 
>>>> 
>>>> How about "Asymmetric Key System-level Keystore Model"?
>>>> 
>>>> And add a reference to keychain model for symmetric keys.
>>> 
>>> 
>>> Regarding "asymmetric", as mentioned above, while the keystore module
>>> is currently exclusively asymmetric, it's probable that passwords will
>>> be added to it in the future.
>>> 
>>> Regarding "system-level", I'm not 100% sure.  Specifically, the
>>>PCE-PCEP
>>> use of the ietf-tls-client module, which uses the keystore module,
>>>gives
>>> me pause.  Is it still a system-level use then?
>>> 
>>> Maybe one of the authors of the RTGWG key-chain draft to try to express
>>> how the two modules differ,
>> 
>> Is this a trick question? As the author of ietf-keystore, I¹d fully
>>expect
>> that you know the difference.
>
>But that is the point. The keychain draft description is not just for the
>authors of keystore draft.

I don’t see any problem with the description and given the ubiquitous
usage for protocol authentication and encryption, nobody else does.


>
>> 
>>> and why they shouldn't be merged into one
>>> draft.
>> 
>> They shouldn¹t be merged since they serve entirely different purposes
>>and
>> will be implemented and deployed by different sets of network devices.
>
>I would agree, but to not call out the difference between the drafts and
>the models would be a disservice to the larger community.

There is no guarantee that the ietf-keystore draft will even make it to
standardization - especially with all this parochial concern about
positioning with more imperative and mature drafts. Please address in the
context of the ietf-keystore draft.

Thanks,
Acee 


>
>> Furthermore, the key-chain draft is more mature and referenced by 6-10
>> other IETF YANG models.
>> 
>> Thanks,
>> Acee 
>> 
>> 
>>> 
>>> Thanks,
>>> Kent
>>> 
>>> 
>>> 
>> 
>
>
>
>Mahesh Jethanandani
>[e-mail]
>
>
>