Re: [netconf] truststore: merging the “ssh-public-key” and “raw-public-key” lists

Balázs Kovács <balazs.kovacs@ericsson.com> Tue, 03 March 2020 13:30 UTC

From: Balázs Kovács <balazs.kovacs@ericsson.com>
To: Kent Watsen <kent+ietf@watsen.net>, "netconf@ietf.org" <netconf@ietf.org>
Thread-Topic: [netconf] truststore: merging the “ssh-public-key” and “raw-public-key” lists
Thread-Index: AQHV5znUghzTm9bqTEiyf088+NRjtag28S4g
Date: Tue, 03 Mar 2020 13:30:19 +0000
Message-ID: <AM0PR07MB518706587D9A9EEF8D1D044483E40@AM0PR07MB5187.eurprd07.prod.outlook.com>
References: <010001705e140aa6-b386aaf0-12df-4cd2-87c9-c34641c5346d-000000@email.amazonses.com>
In-Reply-To: <010001705e140aa6-b386aaf0-12df-4cd2-87c9-c34641c5346d-000000@email.amazonses.com>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts)
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: b89647bc-117b-40a9-edd5-08d7bf770482
X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Mar 2020 13:30:19.3547 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: X41WYghk58OxGkcY6JIutFZnkEdvFimJKcL5t62y/3E47aWt5mCRueAqueoag5Dn0S6S1uOUGimGPzj3mSh06AGqeginrtS2spwDlsNEB5Y=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR07MB5572
Archived-At: <https://mailarchive.ietf.org/arch/msg/netconf/QvNIE8glvls3MTiXQRr5pkfqSVA>
Subject: Re: [netconf] truststore: merging the “ssh-public-key” and “raw-public-key” lists
X-BeenThere: netconf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: NETCONF WG list <netconf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netconf>, <mailto:netconf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netconf/>
List-Post: <mailto:netconf@ietf.org>
List-Help: <mailto:netconf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netconf>, <mailto:netconf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 03 Mar 2020 13:30:23 -0000

Hi Kent,

Sound ok from my side.
Br,
Balazs

-----Original Message-----
From: netconf <netconf-bounces@ietf.org> On Behalf Of Kent Watsen
Sent: Wednesday, February 19, 2020 4:32 PM
To: netconf@ietf.org
Subject: [netconf] truststore: merging the “ssh-public-key” and “raw-public-key” lists

Slide 12 in my 106 presentation contained this snippet:

	module: ietf-truststore
	   +--rw truststore
	        +--rw certificates* [name] {x509-certificates}?
	         |     +-- …
	        +--rw ssh-host-keys* [name] {ssh-host-keys}?
	         |     +-- …
	         +--rw raw-public-keys* [name] {raw-public-keys}?
	               +-- ... 

The slide asked if the “ssh-public-key” and “raw-public-key” lists should be merged.  No comments were received during the meeting, so I said that it might require trying out, and folks can look forward to that discussion later….and here were are!

Looking at truststore's YANG, it turns out that the “ssh-public-key” and “raw-public-key” lists are *identical* with one exception, which is that each refines a common crypto-types grouping with a slightly different “must" expression regarding the “key-format".  Specifically, the ssh-public-key format must be “ct:ssh-public-key-format" and raw-public-key format must be “ct:subject-public-key-info-format”.

However, these "must” statements are low-value as already (at least in my local copy), the SSH and TLS client/server modules have the equivalent “must” expressions.  This being the case, it appears that these two lists should be merged, with the resulting trees-diagram being:

	module: ietf-truststore
	   +--rw truststore
	        +--rw certificates* [name] {x509-certificates}?
	         |     +-- …
	         +--rw public-keys* [name] {public-keys}?
	               +-- … 

In my view, the optics on this are better, as having protocol-specific entries in the truststore (e.g., ssh-host-keys) always seemed wrong to me...

Any objection to this change being made?

PS: this is the last post-106 item I needed to address, in case you’re wondering how many more might be coming...

Kent // contributor

_______________________________________________
netconf mailing list
netconf@ietf.org
https://protect2.fireeye.com/v1/url?k=14d73d81-485e920c-14d77d1a-0cc47ad93de2-8d2c74085f0b9aff&q=1&e=1962dafc-d4d4-496a-acbd-62da48fe7ab7&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fnetconf

[netconf] truststore: merging the “ssh-public-key… Kent Watsen
Re: [netconf] truststore: merging the “ssh-public… Balázs Kovács