Re: [netconf] WGLC on draft-ietf-netconf-over-tls13

[Sean Turner <[e-mail]>]

Jeff,

Thanks for your review. Responses below.

I’ll let these and the other PRs settle for a week before merging.

spt

> On Jan 26, 2023, at 16:55, Hartley, Jeff <[e-mail]> wrote:
> 
> Comments re: https://datatracker.ietf.org/doc/draft-ietf-netconf-over-tls13/
> I concur with others that the overall content of the document is clear from an implementer-reader's standpoint, and it provides useful references.
>  
>  
> 1.  Discussion re: RFC7589 and the Abstract:
> The way the Abstract reads is technically accurate already -- RFC7589 is TLS 1.2-specific, and everything here is TLS 1.3-specific.  Perhaps it's worthwhile reminding readers that some of the functions are not forward/backward-compatible between the two, but that's thoroughly covered in the primary TLS 1.3 docs.
>  
> The format of this document appears to be structured as an addendum for RFC7589, but specific to TLS 1.3.  Thus my concern is, "is this sufficiently stand-alone once TLS 1.2 is deprecated (and thus RFC7589 along with it)?" 
> A) If it's intended to be stand-alone, there's some copy-paste to do from the original.
> B) If not, then describe this as an addendum.

Based on Jürgen’s comment we’re making this an updates I-D, so an addendum. See the following PR:
https://github.com/netconf-wg/netconf-over-tls13/pull/11

Note the cipher suite issue I noted in response to Jügen’s email.

> 2.  On this same topic, there is another reference to RFC7589 in "5. Security Considerations" that should follow the decision above:
> A) If this is a standalone document, it's worth spelling out the full RFC7589 Client Identity requirements here, rewritten to be TLS 1.3-specific.
> B) If this is an addendum to RFC7589, then it's fine as-is, and just fix the Abstract.

Tweaks to the Security Considerations here:
https://github.com/netconf-wg/netconf-over-tls13/pull/10

> 3.  Concurring with others... This section can be safely deleted, as the logic of the adjacent three paragraphs appears to cover the intent sufficiently:
>   "So, this is what {{Section 9.1 of I-D.ietf-tls-rfc8446bis}} says: 
>   ...
>   My guess is not.  These ought to be available in all TLS libraries."

Deleted via the following PR:
https://github.com/netconf-wg/netconf-over-tls13/pull/7

> 4. "Please review ..." verbiage:
> What's the RFC syntax for an import{}?  
>  
> The verbiage intent appears to function as an import or include, thus something like this may suffice:
> "
> The following texts are considered mandatory requirements for this document:
> - Security Considerations in TLS 1.3  [I-D.ietf-tls-rfc8446bis]
> - recommendations regarding Diffie-Hellman exponent reuse in Section 7.4 of [I-D.ietf-uta-rfc7525bis]
> - Security Considerations in NETCONF [RFC6241]
> - certificate revocation checking in Section 7.5 of [I-D.ietf-uta-rfc7525bis]
> - generic host name validation in the TLS context in [RFC6125]

Tweaked this section in a slightly different way; see the following PR:
https://github.com/netconf-wg/netconf-over-tls13/pull/10

> Thanks;
> -Jeff Hartley
>  
> _______________________________________________
> netconf mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/netconf