[netconf] Comments on draft-ietf-netconf-keystore v17

["Eric Voit (evoit)" <[e-mail]>]

Hi Kent,

This is a well written document, and I do support progression.  I do have
some comments/questions...


(1) Section 1: You say:
   Special consideration has been given for systems that have
   cryptographic hardware, such as a Trusted Protection Module (TPM).
   These systems are unique in that the cryptographic hardware hides the
   secret key values.  To support such hardware, symmetric keys may have
   the value "hidden-key" and asymmetric keys may have the value
   "hidden-private-key".  While how such keys are created or destroyed
   is outside the scope of this document, the Keystore can contain
   entries for such keys, enabling them to be referenced by other
   configuration elements.

Question: Internally there might be several keystores on a router.  An
example is that there could be a TPMs for each different line card on a
router.  How is this YANG model about to expose which keys are associated
with specific TPMs?   E.g.: where in the model would you recommend such
augmentations to the grouping statements be made?


(2) This is likely a minor question:   I have seen a need for
"local-or-keystore-public-key-grouping" rather than
"local-or-keystore-asymmetric-key-grouping".  The only reason for the need
is that the private-key is never accessible (TPM again), and the private key
entries of the YANG model are never used.   Is there a reason why you didn't
have "local-or-keystore-public-key-grouping" beyond what could be perceived
as redundancy?


(3) Section 5:3 You Say:
   It was noted that, in this case, the second server would be
   unable to decrypt any of the keys encrypted by the first server.

Question: It is possible for the first server to encrypt a keystore using
the public key of the second server so that only the private key of the
second server would have access to these keys.  How do you see this option
playing in the migration process?

Thanks,
Eric