Re: [Netconf] Adoption poll for crypto-types and trust-anchors

Balázs Kovács <balazs.kovacs@ericsson.com> Mon, 07 May 2018 13:48 UTC

Return-Path: <balazs.kovacs@ericsson.com>
X-Original-To: netconf@ietfa.amsl.com
Delivered-To: netconf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 12EA3124235 for <netconf@ietfa.amsl.com>; Mon, 7 May 2018 06:48:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.342
X-Spam-Level:
X-Spam-Status: No, score=-1.342 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.979, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=RzsQRBEH; dkim=pass (1024-bit key) header.d=ericsson.com header.b=D/EoPSeo
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y-vUCgao_95T for <netconf@ietfa.amsl.com>; Mon, 7 May 2018 06:47:58 -0700 (PDT)
Received: from sesbmg23.ericsson.net (sesbmg23.ericsson.net [193.180.251.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB604120227 for <netconf@ietf.org>; Mon, 7 May 2018 06:47:57 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/simple; q=dns/txt; i=@ericsson.com; t=1525700876; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=ANKIzyomrNHsC7iTm7QnxwFPqe0XN5o9BqCabAY4Ov8=; b=RzsQRBEHMGX0Yb1OZBSQNOx0BnmkmN4q/Wmt071AlaKx9sOGgbevFc7OYYsYeWQT ek80ASz3QxpwTxwh4PkhrmcLx+48PI5tUDNK2QA4Mab7G5o8NhFJSfQMoa1Cv8Ro jkyeD7fwnSgh78l4OgVueWEMZNzTqP79WeIc1Thl2JE=;
X-AuditID: c1b4fb25-98ba79c0000064d0-8b-5af0590b84fa
Received: from ESESSHC012.ericsson.se (Unknown_Domain [153.88.183.54]) by sesbmg23.ericsson.net (Symantec Mail Security) with SMTP id F6.23.25808.B0950FA5; Mon, 7 May 2018 15:47:56 +0200 (CEST)
Received: from ESESSMB501.ericsson.se (153.88.183.162) by ESESSHC012.ericsson.se (153.88.183.54) with Microsoft SMTP Server (TLS) id 14.3.382.0; Mon, 7 May 2018 15:47:55 +0200
Received: from ESESBMB503.ericsson.se (153.88.183.170) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Mon, 7 May 2018 15:47:54 +0200
Received: from EUR01-VE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB503.ericsson.se (153.88.183.170) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Mon, 7 May 2018 15:47:54 +0200
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=ANKIzyomrNHsC7iTm7QnxwFPqe0XN5o9BqCabAY4Ov8=; b=D/EoPSeoXWys/jwEgIh8KmsoZGFx26/5J3+/aBQf/7TxT6VyUa4MjrmIRUF/1Jwrrhb89OwSayPi1F21ndxfMNHaIsrf08GK0b37TQRxEBVAYDrpW0MUQI36zDxpLuYh16WO0c9MLa6qv7mngCnAxKVd38FOLjNDvAMdf8ykhQc=
Received: from AM5PR0701MB2337.eurprd07.prod.outlook.com (10.169.152.135) by AM5PR0701MB2578.eurprd07.prod.outlook.com (10.173.92.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.755.10; Mon, 7 May 2018 13:47:53 +0000
Received: from AM5PR0701MB2337.eurprd07.prod.outlook.com ([fe80::cc12:f370:83c9:53c4]) by AM5PR0701MB2337.eurprd07.prod.outlook.com ([fe80::cc12:f370:83c9:53c4%5]) with mapi id 15.20.0755.012; Mon, 7 May 2018 13:47:53 +0000
From: =?utf-8?B?QmFsw6F6cyBLb3bDoWNz?= <balazs.kovacs@ericsson.com>
To: Kent Watsen <kwatsen@juniper.net>, "netconf@ietf.org" <netconf@ietf.org>
Thread-Topic: [Netconf] Adoption poll for crypto-types and trust-anchors
Thread-Index: AQHT4wADJ2ALQ9zNKkqYEk+Kq3yYtKQfpfMAgASX5ZA=
Date: Mon, 7 May 2018 13:47:53 +0000
Message-ID: <AM5PR0701MB23377923E96B8A0121B8D00A839B0@AM5PR0701MB2337.eurprd07.prod.outlook.com>
References: <30074620-B60A-420D-8805-80C9EF1E1BDC@juniper.net> <D8937259-459A-4D8C-84B7-D75EE559A9BA@juniper.net>
In-Reply-To: <D8937259-459A-4D8C-84B7-D75EE559A9BA@juniper.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=balazs.kovacs@ericsson.com;
x-originating-ip: [89.135.192.225]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; AM5PR0701MB2578; 7:CCUo6oPmu0SyIDJ/uWsDLujvqmb5Tg2NeaiJlc4LMb9GhZVE1gLFm+asKRUhQui9kWvPFyx/jiNh8mdcZGVImw+GHEBPnICfpwnaPfb7bYCSWf8VAfHRgK6nU+lPIDtAxul0kMC4nFqXUWZjPgG7HjMeemOqlw2P4m3/8o8UVkgcyHiPMiUoH01OMZVv6UYEDAn9wHIhHSn77WUWkOd1ER+yOt6Qj6+yZvQb8wwEBqRMWJVbAqKOqpa9fnhopWke
x-ms-exchange-antispam-srfa-diagnostics: SOS;
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020); SRVR:AM5PR0701MB2578;
x-ms-traffictypediagnostic: AM5PR0701MB2578:
x-microsoft-antispam-prvs: <AM5PR0701MB25784DC45E3FD7778893805C839B0@AM5PR0701MB2578.eurprd07.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(37575265505322)(28532068793085)(158342451672863)(10436049006162)(192374486261705)(138986009662008)(788757137089)(21748063052155);
x-ms-exchange-senderadcheck: 1
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(3231254)(944501410)(52105095)(93006095)(93001095)(3002001)(10201501046)(149027)(150027)(6041310)(20161123564045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(20161123562045)(20161123560045)(6072148)(201708071742011); SRVR:AM5PR0701MB2578; BCL:0; PCL:0; RULEID:; SRVR:AM5PR0701MB2578;
x-forefront-prvs: 066517B35B
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(39860400002)(396003)(39380400002)(366004)(376002)(252514010)(189003)(199004)(13464003)(68736007)(14454004)(105586002)(106356001)(85202003)(606006)(74316002)(6246003)(53936002)(7736002)(478600001)(3846002)(5660300001)(1941001)(6116002)(790700001)(25786009)(81166006)(3660700001)(66066001)(81156014)(8676002)(3280700002)(6436002)(9326002)(229853002)(85182001)(966005)(9686003)(54896002)(236005)(6306002)(110136005)(2906002)(8666007)(55016002)(316002)(99286004)(2501003)(561944003)(59450400001)(86362001)(97736004)(26005)(186003)(2900100001)(575784001)(76176011)(53546011)(476003)(7696005)(446003)(11346002)(102836004)(5250100002)(33656002)(486006)(6506007)(8936002); DIR:OUT; SFP:1101; SCL:1; SRVR:AM5PR0701MB2578; H:AM5PR0701MB2337.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1;
received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts)
x-microsoft-antispam-message-info: UrNQdT7slQS87HTRRQ/XaOtx1JENhyhnf1f6x17XhCYgkudDNc645TisDb/jNFdzBjidW7y73NHlTOzwyRjw4uBYOClKpdRcaJwxcCgg0V+MQXUExeaOcfNE3M4giSPc5gnPuMXVqBD3DwdH4uYFn+Y7iKYJuG7p6GaLC4UQMjUI6xYSBf072X+OmfLzv7lt
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_AM5PR0701MB23377923E96B8A0121B8D00A839B0AM5PR0701MB2337_"
MIME-Version: 1.0
X-MS-Office365-Filtering-Correlation-Id: 02ab363f-205d-49ea-8dc1-08d5b42121cd
X-MS-Exchange-CrossTenant-Network-Message-Id: 02ab363f-205d-49ea-8dc1-08d5b42121cd
X-MS-Exchange-CrossTenant-originalarrivaltime: 07 May 2018 13:47:53.5114 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0701MB2578
X-OriginatorOrg: ericsson.com
X-Brightmail-Tracker: H4sIAAAAAAAAA02SeUhUURTGuW9XHLpNmgfLoKmg3HMpiUolQ/8IMiRJIZoxHy6No8xT0YKS pMWZlASHVCwVTXEBRc3U1FxBUxJcQ4sULc2kJsdoEaR5XgP/+53v+84991yuQCvrWCchXpci 6nUarYqzZQqvvDzhbhdpjvJqMrL+3cW8v6lxlg2kQisq/lCh03cn+TAqyvZ0jKiNTxP1nmfV tnGPekqY5O4aOn1iLjUTNZfQBmQjAPaFwcoG1oBsBSXuR7AxOUWToglBWWk/R4qfCPLypxhS lFOQa8im5ILBaxRYDBaeOCYKqtdatk/7hGB5wcTIYzh8DkaXFyiZ7fEFGLMUsTLvwSEw1t5G Ez0UXgyYWcKnYOjd8laewYehoa/COkEQFFgNlVl+sqzEEqxYOjiZbXAA1Jcu8TIjvBd+vanb aqWxI8wsllBkUwwVHaPbWzvAl4VNluSvQuvX9zzRVVCwMsMSdoaxEiOSdwHcQsHcyNttwx3M JhNNjFYELXMfEDHc4HnnMEc4CVY2ZzgSqkUw9GNxu/sA1OTMM8Roo+FhXwP/GHkV7bgu4SQo zvrMyqzAu2GocJEpsr4AjY9BfbsniRyEfOM8T/go3Ct+yu/USxFfgxwkUYpOjPX28RD18dcl KUnnoRNTGpH1D/U0bxxpReOrQb0IC0hlp7gYZo5Sspo0KSOxF4FAq+wV3CGrpIjRZNwU9UnX 9KlaUepF+wRG5aiYP9kUpcSxmhTxhigmi/r/LiXYOGWi3BqXXd4BfeNMmlN1UEJVRHSbhmLV nXe4rr8PEvbHN+TMmu3ruyYYfrpR7Tj5Svo4wpc5nwl0rf023p79JMxtqW2YDjdOelbNDIX7 Dbq4+/p8vzUR+Pp3elb/evKz6uDzruvll93oS2PLljxzMB1pF3K7vfdi50BB8aqWu6+LUDFS nOa4C62XNP8A1Arq/T8DAAA=
Archived-At: <https://mailarchive.ietf.org/arch/msg/netconf/4d6ItwOcWhNbLG4W170YYnGnGzY>
Subject: Re: [Netconf] Adoption poll for crypto-types and trust-anchors
X-BeenThere: netconf@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Network Configuration WG mailing list <netconf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netconf>, <mailto:netconf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netconf/>
List-Post: <mailto:netconf@ietf.org>
List-Help: <mailto:netconf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netconf>, <mailto:netconf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 07 May 2018 13:48:02 -0000

Hi Kent,

I believe between SSH/TLS implementations using keys in clear and a persistent storage there has to be some protection layer for the keys, and keystore did a good job representing the management aspects of this layer. Obviously, this layer is possible to get implemented without a keystore model, but then I think the user side of the keys (e.g., Netconf/Restconf) have to be flexible enough to handle keys locally or refer to central point of management (if anyone would implement that in addition).

Regarding your example with TPM, if considering the most simplistic case, wouldn’t referencing a TPM key be adequate just through presenting the public key value? I guess that could be done without a keystore, and at least is shown that a key is operational for the user-side protocol.

To sum up, I have the following concerns:


  *   Centralized management of keys/identity certificates/credentials as standard was appealing to us and we would still prefer it; however, we would be probably ok to have it as future work, if you prefer that. The user side of the keys (e.g., Netconf/Restconf) should be flexible enough to handle keys as both referenced and local data (for example, choice with only one standard case?).
  *   I don’t understand the idea behind keeping the trust anchors in central model versus the keys in local model. What is the rationale behind this split?

Best Regards,
Balazs

From: Netconf [mailto:netconf-bounces@ietf.org] On Behalf Of Kent Watsen
Sent: Friday, May 04, 2018 8:41 PM
To: netconf@ietf.org
Subject: Re: [Netconf] Adoption poll for crypto-types and trust-anchors

Following up on this, I did think of a way enable configuration to specify, e.g., which DevID cert to use for a factory-defined private key.  The idea is to change the private-key grouping to reference certificates from the "trust-anchors" data tree (as opposed to locally-storing the certificates).  A 'union' or a 'choice' may allow for both options.

What I don't like about this proposal is that it is conceptually muddies what is a "trust anchor".  Currently, trust anchors are exclusively used to authenticate remote devices, whereas the DevID certificates are more about how the device authenticates itself to remote devices; furthermore, DeviD certs are the end-entity half of the certificate-chain (not the issuer-half).  Yes, in both cases, the partial chain is manifested as one or more X.509 certificates, and thus syntactically the same, but it still doesn't seem right to call them "trust anchors".

Perhaps we could define some other top-level data-tree for "identity certificates", which could include both a private key and its associated certificates.  This would be the "future TBD thing" mentioned below.   I can see this working, but is it any better to have separate "trust-anchors" and "identity certificates" trees, or a single "keystore" tree that contains both?   One benefit to having a single keystore module is that then the "certificate-expiration" notification has more value, applying to both identity and trust anchor cert, as it's good to know when either types of certificate is expiring.

Kent // contributer


On 5/3/18, 12:58 PM, "Netconf on behalf of Kent Watsen" <netconf-bounces@ietf.org<mailto:netconf-bounces@ietf.org> on behalf of kwatsen@juniper.net<mailto:kwatsen@juniper.net>> wrote:

Hi Balazs, and Balazs,

Thanks for permission to forward this thread to the list.  All, please be sure to read the message below too.

Yes, I'm aware and familiar with various key protection strategies.  The current ietf-keystore module was modeled after MacOS's "keychain access", but it didn't define a protection layer (e.g., internally encrypted and with an access-controlled API), though one could be added later.  The keystore module is very much in-line with what you write and, for that, I think it counts as a "no/do not support" of sorts.

The reason why we're proposing to move away from the keystore module was prompted by Juergen, who questioned if any implementations of SSH or TLS use a KMS and are we creating unnecessary complexity.  As it stands, the current proposal still has SSH/TLS implementations referencing a global "trust-anchors" store, so there is still "complexity", at least in terms of there being a dependency.

The current proposal moves the storage of private keys from being in a centralized keystore (where they can be leafref-ed) to each instance of a ssh/tls client/server.  By doing so, we think that it is less complexity, though I'm not convinced, since the definition of the private key itself is the same, it's just now not leafref-ed.  Perhaps this is an incremental step, whereby we next abandon using the private-key groupings altogether for SSH-specific and TLS-specific variants.  This is very possibly needed, and I might add that no one has implemented any of these modules, AFAIAA.

Adding to this discussion, I was yesterday wondering, with the two new drafts, how a client would configure a server to use a TPM-protected private key and its associated IDevID certificate.  Note that this key and cert are "configured" by the manufacturer and thus, somehow, must be *referenced* (not stored locally) by the ssh/tls client/server modules.   I was able to find a way to reference the private key (via its public key), but I was never able to figure out how to reference the DevID cert (IDevID or LDevID?).    I was thinking that, if we don't go back to using the keystore module, we might be able to modify the private-key grouping definition to enable it to either be locally stored  or be a reference to some future TBD thing.  I haven't tried to do this yet, but being able to do this seems important, and therefore may sway my support for disbanding the keystore module/draft…

Kent // contributor


On 5/3/18, 7:08 AM, "Balazs Lengyel" <balazs.lengyel@ericsson.com<mailto:balazs.lengyel@ericsson.com>> wrote:


Hello Kent,
I would like to add that in Ericsson the preferred solution is central storage for keys. It makes administration and enforcement of good security practices simpler for the operator.
regards Balazs Lengyel
(Feel free to forward this to the list.)

-------- Forwarded Message --------
Subject:

FW: [Netconf] Adoption poll for crypto-types and trust-anchors

Date:

Thu, 3 May 2018 11:15:57 +0200

From:

Balázs Kovács <balazs.kovacs@ericsson.com><mailto:balazs.kovacs@ericsson.com>

To:

Balázs Lengyel <balazs.lengyel@ericsson.com><mailto:balazs.lengyel@ericsson.com>



Bocs, bcc lemaradt



-----Original Message-----

From: Balázs Kovács

Sent: Thursday, May 03, 2018 11:16 AM

To: Kent Watsen <kwatsen@juniper.net><mailto:kwatsen@juniper.net>

Subject: RE: [Netconf] Adoption poll for crypto-types and trust-anchors



Hi Kent,



I know you might prefer me sending this to the list, but I try this way first. I was a bit away from keystore works and did a quick check. I see you have the below poll ongoing, and I've seen the presentation you had in London.



I must say it was a bit surprising to me backing out from centralized keystore model and the statement of centralized keystore being uncommon. Storage of keys is a security sensitive and problematic area. Secret keys at rest usually need to be encrypted. The provisioning or storage of secret encryption keys, the secure storage, and rotation of keys are a complicated enough matter so that it justifies centralized key store implementations. There are centralized key management systems such as Hashicorp Vault, Azure Key Vault, Google Cloud KMS, OpenStack Barbican, etc.. that solve the above matters. These SW can be used by an implementation to outsource the key management issues, and even if it is outsourced, outsourcing from a central implementation does give benefit since the client usually also needs some client credential that is access controlled on KMS server side.



The other aspect I saw as benefit in centralized keystore was on the YANG interface side. As long as only machines are assumed to operate on these IETF modules, I assume distributed management of keys doesn't matter much, but when it starts to drive human interfaces directly then the configurations of protocols that import and use these security groupings become quite complex. Ok for this one you still have the trust anchors, but for keys the central model was dismissed, but for management aspect, I really don't see why is the difference.



Can you clarify? Have you considered KMS implementations when making this proposal of removing keystore?



Br,

Balazs



-----Original Message-----

From: Netconf [mailto:netconf-bounces@ietf.org] On Behalf Of Kent Watsen

Sent: Tuesday, May 01, 2018 11:57 PM

To: netconf@ietf.org<mailto:netconf@ietf.org>

Subject: Re: [Netconf] Adoption poll for crypto-types and trust-anchors





[I'll get the ball rolling, please, others chime in too]



I support the adoption of these two drafts to replace the existing keystore draft.



Regarding the "certificate-expiration" notification defined in ietf-crypto-types, I would like to discuss removing it, or moving it to be a descendent of the "certificates-grouping" grouping (also in ietf-crypto-types) and maybe also place a copy of the notification in the ietf-trust-anchors module.  That said, I don't like having several otherwise identical notifications in different namespaces, but I do like how the server can incrementally add support for expirations on a feature-by-feature basis.



Kent // contributor





===== original message =====



This is the start of a *two* week poll for adopting the following two drafts as working group documents, specifically to replace draft-ietf-netconf-keystore, which would be removed as a working group document:



  draft-kwatsen-netconf-crypto-types-00

  draft-kwatsen-netconf-trust-anchors-00



This call for adoption is the result of the Keystore draft presentation given in London.  When the various options were discussed, most preferred to move forward with these two drafts, as opposed to looking to do more factoring or extending to scope to include things not needed by our various client/server drafts.  No one expressed interest in moving forward with draft-ietf-netconf-keystore.  While we could separately confirm this result again on the list, we believe that an adoption call more efficiently achieves two goals at once.



Please send email to the list indicating "yes/support" or "no/do not support".  If indicating no, please state your reservations with the document.  If yes, please also feel free to provide comments you'd like to see addressed once the document is a WG document.



Kent (and Mahesh and Ignas)









_______________________________________________

Netconf mailing list

Netconf@ietf.org<mailto:Netconf@ietf.org>

https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_netconf&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=qXS002RrOOkzqTDm70cWjg7eJeWqtpC_anWUcc9a_3I&s=1W689R8ht-U3FoffJ5uTT24SAPRtiQ9a9B3VxQxM_Wg&e=





_______________________________________________

Netconf mailing list

Netconf@ietf.org<mailto:Netconf@ietf.org>

https://www.ietf.org/mailman/listinfo/netconf<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_netconf&d=DwMD-g&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=dy-Dg3ToTuGVBuY3XcOLDkV_tW3vuQDSz6i1wawzjjM&s=4zwr17et_2w1it4jlw_k1ksQ-q-v7_iTSKUI4E_yK4g&e=>

--

Balazs Lengyel                       Ericsson Hungary Ltd.

Senior Specialist

Mobile: +36-70-330-7909              email: Balazs.Lengyel@ericsson.com<mailto:Balazs.Lengyel@ericsson.com>