[netconf] Regarding today's updates

Kent Watsen <kent+ietf@watsen.net> Thu, 09 July 2020 01:39 UTC

Return-Path: <01000173313a1282-63366836-4a52-453a-a111-fd3334b2506e-000000@amazonses.watsen.net>
X-Original-To: netconf@ietfa.amsl.com
Delivered-To: netconf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5AA0F3A0BC7 for <netconf@ietfa.amsl.com>; Wed, 8 Jul 2020 18:39:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Level:
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazonses.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FDpE7e7eEm6j for <netconf@ietfa.amsl.com>; Wed, 8 Jul 2020 18:39:17 -0700 (PDT)
Received: from a48-93.smtp-out.amazonses.com (a48-93.smtp-out.amazonses.com [54.240.48.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AB71F3A0BA5 for <netconf@ietf.org>; Wed, 8 Jul 2020 18:39:17 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1594258756; h=From:Content-Type:Mime-Version:Subject:Message-Id:Date:To:Feedback-ID; bh=jJ1CuCZzpr26X3x4oj2YiQ5+q7iXv0tJOhaVXPuLHLE=; b=LQ1fC+spcqJSbbcWNsdh7YZgSuGmuIo2f3WkFPHUBVZw7b/Ab1Gg4iAECVjlvsSs JhzubVlJ7W1JC2MixGa7XqzJMSpcCnTykkWGBgYjU47EVXyt4aGClcOEiX0FY6B68Kr oUY+8Y6ms3am1wuCDNdAmF1PG0aeE0U7IYSfe/Ig=
From: Kent Watsen <kent+ietf@watsen.net>
Content-Type: multipart/alternative; boundary="Apple-Mail=_9FAD2F7D-A104-4A14-B049-1604EEE66987"
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\))
Message-ID: <01000173313a1282-63366836-4a52-453a-a111-fd3334b2506e-000000@email.amazonses.com>
Date: Thu, 9 Jul 2020 01:39:16 +0000
To: "netconf@ietf.org" <netconf@ietf.org>
X-Mailer: Apple Mail (2.3608.80.23.2.2)
X-SES-Outgoing: 2020.07.09-54.240.48.93
Feedback-ID: 1.us-east-1.DKmIRZFhhsBhtmFMNikgwZUWVrODEw9qVcPhqJEI2DA=:AmazonSES
Archived-At: <https://mailarchive.ietf.org/arch/msg/netconf/43wJ-qwSKXjvCRt8DTQveAjHhZ0>
Subject: [netconf] Regarding today's updates
X-BeenThere: netconf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: NETCONF WG list <netconf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netconf>, <mailto:netconf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netconf/>
List-Post: <mailto:netconf@ietf.org>
List-Help: <mailto:netconf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netconf>, <mailto:netconf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 09 Jul 2020 01:39:19 -0000

TR;DL;  

    - first 3 WGLC drafts updated per comments received
        - please review to ensure your comments were addressed!

    - remaining drafts 99% WGLC-ready 
        - just a few niggles left  ;)

K.


crypto-types

   *  Updated draft title (refer to "Groupings" too).

   *  Removed 'end-entity-certs-grouping' as it wasn't being used
      anywhere.

   *  Removed 'trust-anchor-certs-grouping' as it was no longer being
      used after modifying 'local-or-truststore-certs-grouping' to use
      lists (not leaf-lists).

   *  Renamed "cert" to "cert-data" in trust-anchor-cert-grouping.

   *  Added "csr-info" typedef, to complement the existing "csr"
      typedef.

   *  Added "ocsp-request" and "ocsp-response" typedefs, to complement
      the existing "crl" typedef.

   *  Added "encrypted" cases to both symmetric-key-grouping and
      asymmetric-key-pair-grouping (Moved from Keystore draft).

   *  Expanded "Data Model Overview section(s) [remove "wall" of tree
      diagrams].

   *  Updated the Security Considerations section.



truststore

   *  Corrected module prefix registered in the IANA Considerations
      section.

   *  Modified 'local-or-truststore-certs-grouping' to use a list (not a
      leaf-list).

   *  Added new example section "The Local or Truststore Groupings".

   *  Clarified expected behavior for "built-in" certificates in
      <operational>

   *  Expanded "Data Model Overview section(s) [remove "wall" of tree
      diagrams].

   *  Updated the Security Considerations section.



keystore

   *  Removed dangling/unnecessary ref to RFC 8342.

   *  r/MUST/SHOULD/ wrt strength of keys being configured over
      transports.  [UPDATE: oops, I think I deleted it altogether later]

   *  Added an example for the "certificate-expiration" notification.

   *  Clarified that OS MAY have a multiplicity of underlying keystores
      and/or HSMs.

   *  Clarified expected behavior for "built-in" keys in <operational>

   *  Clarified the "Migrating Configuration to Another Server" section.

   *  Expanded "Data Model Overview section(s) [remove "wall" of tree
      diagrams].

   *  Updated the Security Considerations section.



tcp-client-server

   *  Expanded "Data Model Overview section(s) [remove "wall" of tree
      diagrams].

   *  Updated the Security Considerations section.



ssh-client-server

   *  Added a "must 'public-key or password or hostbased or none or
      certificate'" statement to the "user" node in ietf-ssh-client

   *  Expanded "Data Model Overview section(s) [remove "wall" of tree
      diagrams].

   *  Moved the "ietf-ssh-common" module section to proceed the other
      two module sections.

   *  Updated the Security Considerations section.



tls-client-server

   *  Modified the 'must' expression in the "ietf-tls-client:server-
      authention" node to cover the "raw-public-keys" and "psks" nodes
      also.

   *  Added a "must 'ca-certs or ee-certs or raw-public-keys or psks'"
      statement to the ietf-tls-server:client-authentication" node.

   *  Added "mandatory true" to "choice auth-type" and a "presence"
      statement to its ancestor.

   *  Expanded "Data Model Overview section(s) [remove "wall" of tree
      diagrams].

   *  Moved the "ietf-ssh-common" module section to proceed the other
      two module sections.

   *  Updated the Security Considerations section.



http-client-server

   *  Added a parent "container" to "client-identity-grouping" so that
      it could be better used by the proxy model.

   *  Added a "choice" to the proxy model enabling selection of proxy
      types.

   *  Added 'http-client-stack-grouping' and 'http-server-stack-
      grouping' convenience groupings.

   *  Expanded "Data Model Overview section(s) [remove "wall" of tree
      diagrams].

   *  Updated the Security Considerations section.



netconf-client-server

   *  Expanded "Data Model Overview section(s) [remove "wall" of tree
      diagrams].

   *  Removed expanded tree diagrams that were listed in the Appendix.

   *  Updated the Security Considerations section.



restconf-client-server

   *  Moved and changed "must" statement so that either TLS *or* HTTP
      auth must be configured.

   *  Expanded "Data Model Overview section(s) [remove "wall" of tree
      diagrams].

   *  Updated the Security Considerations section.