Re: [netconf] netconf-tls wasRe: Summary of updates

[Kent Watsen <[e-mail]>]

[CC-ing Gary again...]


Hi Tom,


> I still think that the I-D lacks clarity about supported versions.
> 
> <tp2.0>
> OK, some references.

Grepping for the string “tp2.0” returns no results.


> tlscmn
> 
> tls-ecc
> needs RFC8446

Why?  8446 refs and defers to 8422, right?


> 
> tls-dhe
> needs 8446

Okay, 8446 obsoletes 5246.


> tls-3des
> ok no support in 1.3

Ack.  Unmodified.



> tls-gcm 
> needs 8446

Okay, but it’s strange that 8446 doesn’t ref/obsolete 5288…I guess because it uses the NIST “GCM” ref instead…perhaps this draft should as well?



> identity ciphersuite
> I do not see the 1.3 values from 8446 B.4

grepping for “ciphersuite” returns no matches…?


> hello-params
> needs 8446

Added.


> tls-client
> I note that the feature statements do not have references which some YANG doctors say they should have.

Added (for X.509, PSK, and RPK)


> container client-identity
> needs 8446 and a reference in the body to 8446 s.4.4.2

Added.


> case psk
> needs Normative References to the two
> draft-ietf-tls-external-psk-*

"external-psk-guidance” is Informational and "external-psk-importer” while Standards Track, only regards an interface for importing the PSKs into TLS.  It seems that the existing ref to RFC 4279 (which is NOT obsolete) is pretty good, right?


> tls-server
> 
> container server-identity
> as client-identity

Added.


> case psk
> as for tls-client

Same.


> Tom Petch

THANK YOU!

Updates can be found in https://github.com/netconf-wg/tls-client-server/commit/b94588b5a33c0852cfacbc415ca0a626bc1c5763.


K.