Re: [netconf] Question to draft-ietf-netconf-sztp-csr-13

["Rob Wilton (rwilton)" <[e-mail]>]

Hi Kent, authors,

Given that I haven’t get approved this draft from the IESG review yet, then even though it is late, these changes look useful but relatively minor.  If the authors think that these changes are appropriate then I am happy for you to post an updated draft revision with these changes then ping me and I’ll check it before sending it on its way to the RFC editor.
Regards,
Rob


From: netconf <[e-mail]> On Behalf Of Brockhaus, Hendrik
Sent: 23 February 2022 08:44
To: Kent Watsen <[e-mail]>
Cc: [e-mail]; [e-mail]
Subject: Re: [netconf] Question to draft-ietf-netconf-sztp-csr-13

Kent

I understood that this change request comes very late, but to male the change request more concrete I looked into the document and identified four places where p10cr is referenced. In all theses places “p10cr” would need to be replaced with “ir, cr, kur, or p10cr”.

Finally this is the proposed change:

** Section 3.2.

In identity cmp-csr:

s/PKIBody containing only the p10cr structure/PKIBody containing only the ir, cr, kur, or p10cr structure/

And three times in grouping csr-grouping:

s/The body element contains a p10cr CHOICE of type CertificationRequest./The body element contains a ir, cr, kur, or p10cr CHOICE of type CertificationRequest./

But I understood that such change can only be processed if there is a DISCUSS.

Hendrik

Von: netconf <[e-mail]<mailto:[e-mail]>> Im Auftrag von Fries, Steffen
Gesendet: Dienstag, 22. Februar 2022 17:52
An: Kent Watsen <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Betreff: Re: [netconf] Question to draft-ietf-netconf-sztp-csr-13

Hi Kent,

Thank you for your answer.
I agree, it is very late in the process for such a comment. I should have realized it earlier. Nevertheless, I wanted to raise that point as it would allow for more functionality. If there is no DISCUSS, the proposal with an additional definition is probably the easiest way forward.

Best regards
Steffen

From: Kent Watsen <[e-mail]<mailto:[e-mail]>>
Sent: Dienstag, 22. Februar 2022 16:33
To: Fries, Steffen (T CST) <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Subject: Re: Question to draft-ietf-netconf-sztp-csr-13


Hi Steffen,

Yes, the CMP-CSR is bound to P10.

This draft is currently in the final stage of IESG Last Call review.  Comments such as these should have been received during WG Last Call.  Unless an IESG member throws a DISCUSS, the draft will proceed as is.  In such case, a future work may define something like a "cmp-csr-2” leaf to contain an expanded definition.

Kent // contributor



On Feb 15, 2022, at 1:46 PM, Fries, Steffen <[e-mail]<mailto:[e-mail]>> wrote:

Hello Kent,

I’ve got a short clarification question regarding the latest draft. I realized in the description of the YANG modules that there is a difference in section 3.2 between CMC and CMP in the description what can be contained in the respective CSR. Based on the description of the YANG module, CMC seems to be open for different types of certification requests, while CMP is bound to a wrapped P10 not leaving any further choice (like ir, cr, kur). Did I got this right or did I misinterpret the description for the cmc-csr? Sorry for realizing this so late.

Best regards
Steffen