Re: [Netconf] regarding keystore and related drafts

[Kent Watsen <[e-mail]>]

Hi Qin,



> Would it be great to see crypto types covers all application requiring 
> asymmetric key.

What do you mean by "all application"?

[Qin]: My impression, the application is SSH specific application, please correct me if I am wrong.

<KENT> the immediate need is to support both SSH and TLS, as they are the transports for NETCONF and RESTCONF, but the hope is that the crypto types could be used for other purposes as well.





> For trust anchors, I think this draft is more related to certificates

It will likely be used mostly for certificates, but the model SSH host keys can be configured as well.

[Qin]: So SSH host keys are not mandatory parameter, correct?

<KENT> there is a list of pinned certificates and there is a list of pinned host-keys (see below for the tree diagram).  Neither of which are mandatory on their own, but something would need to be configured if using one of the SSH or TLS based client or server modules (e.g., ietf-tls-client), as those modules have leafrefs to the trust anchors.  Makes sense?


   module: ietf-trust-anchors
     +--rw trust-anchors
        +--rw pinned-certificates* [name]
        |  +--rw name                  string
        |  +--rw description?          string
        |  +--rw pinned-certificate* [name]
        |     +--rw name    string
        |     +--rw data    binary
        +--rw pinned-host-keys* [name]
           +--rw name               string
           +--rw description?       string
           +--rw pinned-host-key* [name]
              +--rw name    string
              +--rw data    binary

Kent