Re: [netconf] netconf-tls wasRe: Latest ietf-netconf-server draft and related modules

[Juergen Schoenwaelder <[e-mail]>]

While I share sympathy to your points, I am not sure the configuration
interface documents are the right place to address some of your points
since NC over TLS is defined in RFC 5539 and this is the place where
updates may be needed.

/js

On Tue, May 11, 2021 at 11:57:22AM +0000, tom petch wrote:
> I find this I-D confused about which versions of TLS are supported.  It is 1.0/1.1/1.2 or1.2/1.3 or 1.0/1.1/1.2/1.3 or 1.2 or ...
> This needs addressing and the text changed to match.
> 
> I suspect that the IESG will not accept any support for 1.0 or 1.1 given the existence of an RFC deprecating them and that this I-D should not go further than putting in place hooks with which an organisation could augment such support if they wanted to, but even that may be going too far.
> 
> I wonder too about what forms of authentication are acceptable, something that has changed several times in the life of the I-D.  I do  not have a view of which are and which are not but think that guidance from the TLS WG or SecDir or Security AD would be useful now rather than later.
> 
> In a similar vein, TLS 1.3 is keen to ship application data before the handshake is complete, before authentication has happened, which causes problems for applications which want the handshake and authentication to complete first.  I see NETCONF as being such an application and the I-D needs to address that, as it is being addressed by other WG.
> 
> Tom Petch
> _______________________________________________
> netconf mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/netconf

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
Fax:   [phone]         <https://www.jacobs-university.de/>