Re: [netconf] crypto-types fallback strategy

[Schönwälder, Jürgen <[e-mail]>]

On Wed, Sep 18, 2019 at 05:12:25PM +0000, Kent Watsen wrote:
> > 
> > I would check what is commonly used in existing configuration
> > interfaces. We are not inventing the wheel here. And whatever we
> > define better is usable with existing implementations and tools.
> 
> These are the native types used by OpenSSL and OpenSSH, what more verification do we need?   
> 
> Possibly we could discuss supporting PEM, in addition to DER, but I'd image that, if PEM is supported at all, the presentation layer (Web UI, CLI) would convert it to/from PEM as needed (i.e., the underlying model only needs to support DER).
>

On my Linux system, certs tend to be stoed in pem format, so I am
biased. It seems some other applications like web browsers and server
also tend to use pem format. But I am happy to be corrected since my
experience with cert usage is limited.

Yes, the application or presentation could convert between formats and
solve all problems. One of the failures of SNMP was that SNMP required
an application or presentation layer to be usable while CLIs did not
require other tools. The idea that there is always software between
the NC/RC server and whoever has to solve an automation problem has
somehow failed in the past. I believe data models should be written to
enable automation without requiring lots of additional tooling. And
yes, there is a need to find a balance.
 
> > The SSH implementations that I use have the binary key data rendered
> > in ASCII. In fact, the whole key record is rendered in ASCII. I
> > strongly suggest to use formats that are well established.
> 
> This is the "key-data" leaf from RFC 7317.  Are you saying that it should've been different?
> 
> Regardless, should this be a presentation layer issue?

See above, if we start to require a presentation layer, we may repeat
a failure. It might be useful to check who has implemented that part
of RFC 7317 and how happy operators were with the format. I personally
would not immediately know how to convert my openssh key in a binary
format such that that I can use the YANG model. We should try to
maximize usability and stay away from the idea that a presentation
layer will be available to make things usable for people that have to
script customized automation solutions.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
Fax:   [phone]         <https://www.jacobs-university.de/>