Re: [netconf] Regarding today's updates

[Kent Watsen <[e-mail]>]

Minor updates (not all drafts updated)

   crypto-types:
       *  [Re]-added a "Strength of Keys Configured" Security Consideration
       *  Prefixed "cleartext-" in the "key" and "private-key" node names.

   trust-anchors:
       *  Fixed a copy/paste issue in the "Data at Rest" Security
          Considerations section.

   keystore + ssh-client-server + tls-client-server:
       *  Updated examples to reflect new "cleartext-" prefix in the
          crypto-types draft.

K.






> On Jul 8, 2020, at 9:39 PM, Kent Watsen <[e-mail]> wrote:
> 
> TR;DL;  
> 
>     - first 3 WGLC drafts updated per comments received
>         - please review to ensure your comments were addressed!
> 
>     - remaining drafts 99% WGLC-ready 
>         - just a few niggles left  ;)
> 
> K.
> 
> 
> crypto-types
> 
>    *  Updated draft title (refer to "Groupings" too).
> 
>    *  Removed 'end-entity-certs-grouping' as it wasn't being used
>       anywhere.
> 
>    *  Removed 'trust-anchor-certs-grouping' as it was no longer being
>       used after modifying 'local-or-truststore-certs-grouping' to use
>       lists (not leaf-lists).
> 
>    *  Renamed "cert" to "cert-data" in trust-anchor-cert-grouping.
> 
>    *  Added "csr-info" typedef, to complement the existing "csr"
>       typedef.
> 
>    *  Added "ocsp-request" and "ocsp-response" typedefs, to complement
>       the existing "crl" typedef.
> 
>    *  Added "encrypted" cases to both symmetric-key-grouping and
>       asymmetric-key-pair-grouping (Moved from Keystore draft).
> 
>    *  Expanded "Data Model Overview section(s) [remove "wall" of tree
>       diagrams].
> 
>    *  Updated the Security Considerations section.
> 
> 
> 
> truststore
> 
>    *  Corrected module prefix registered in the IANA Considerations
>       section.
> 
>    *  Modified 'local-or-truststore-certs-grouping' to use a list (not a
>       leaf-list).
> 
>    *  Added new example section "The Local or Truststore Groupings".
> 
>    *  Clarified expected behavior for "built-in" certificates in
>       <operational>
> 
>    *  Expanded "Data Model Overview section(s) [remove "wall" of tree
>       diagrams].
> 
>    *  Updated the Security Considerations section.
> 
> 
> 
> keystore
> 
>    *  Removed dangling/unnecessary ref to RFC 8342.
> 
>    *  r/MUST/SHOULD/ wrt strength of keys being configured over
>       transports.  [UPDATE: oops, I think I deleted it altogether later]
> 
>    *  Added an example for the "certificate-expiration" notification.
> 
>    *  Clarified that OS MAY have a multiplicity of underlying keystores
>       and/or HSMs.
> 
>    *  Clarified expected behavior for "built-in" keys in <operational>
> 
>    *  Clarified the "Migrating Configuration to Another Server" section.
> 
>    *  Expanded "Data Model Overview section(s) [remove "wall" of tree
>       diagrams].
> 
>    *  Updated the Security Considerations section.
> 
> 
> 
> tcp-client-server
> 
>    *  Expanded "Data Model Overview section(s) [remove "wall" of tree
>       diagrams].
> 
>    *  Updated the Security Considerations section.
> 
> 
> 
> ssh-client-server
> 
>    *  Added a "must 'public-key or password or hostbased or none or
>       certificate'" statement to the "user" node in ietf-ssh-client
> 
>    *  Expanded "Data Model Overview section(s) [remove "wall" of tree
>       diagrams].
> 
>    *  Moved the "ietf-ssh-common" module section to proceed the other
>       two module sections.
> 
>    *  Updated the Security Considerations section.
> 
> 
> 
> tls-client-server
> 
>    *  Modified the 'must' expression in the "ietf-tls-client:server-
>       authention" node to cover the "raw-public-keys" and "psks" nodes
>       also.
> 
>    *  Added a "must 'ca-certs or ee-certs or raw-public-keys or psks'"
>       statement to the ietf-tls-server:client-authentication" node.
> 
>    *  Added "mandatory true" to "choice auth-type" and a "presence"
>       statement to its ancestor.
> 
>    *  Expanded "Data Model Overview section(s) [remove "wall" of tree
>       diagrams].
> 
>    *  Moved the "ietf-ssh-common" module section to proceed the other
>       two module sections.
> 
>    *  Updated the Security Considerations section.
> 
> 
> 
> http-client-server
> 
>    *  Added a parent "container" to "client-identity-grouping" so that
>       it could be better used by the proxy model.
> 
>    *  Added a "choice" to the proxy model enabling selection of proxy
>       types.
> 
>    *  Added 'http-client-stack-grouping' and 'http-server-stack-
>       grouping' convenience groupings.
> 
>    *  Expanded "Data Model Overview section(s) [remove "wall" of tree
>       diagrams].
> 
>    *  Updated the Security Considerations section.
> 
> 
> 
> netconf-client-server
> 
>    *  Expanded "Data Model Overview section(s) [remove "wall" of tree
>       diagrams].
> 
>    *  Removed expanded tree diagrams that were listed in the Appendix.
> 
>    *  Updated the Security Considerations section.
> 
> 
> 
> restconf-client-server
> 
>    *  Moved and changed "must" statement so that either TLS *or* HTTP
>       auth must be configured.
> 
>    *  Expanded "Data Model Overview section(s) [remove "wall" of tree
>       diagrams].
> 
>    *  Updated the Security Considerations section.
> 
> 
> 
> 
> _______________________________________________
> netconf mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/netconf