IETF Logo Mail Archive

Re: [netconf] crypto-types fallback strategy

"Rob Wilton (rwilton)" <rwilton@cisco.com> Tue, 17 September 2019 16:59 UTC

Return-Path: <rwilton@cisco.com>
X-Original-To: netconf@ietfa.amsl.com
Delivered-To: netconf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70BCA120858 for <netconf@ietfa.amsl.com>; Tue, 17 Sep 2019 09:59:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.499
X-Spam-Level:
X-Spam-Status: No, score=-14.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=ecX5YBDt; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=WUOAUFNe
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h0o79ddKyfuu for <netconf@ietfa.amsl.com>; Tue, 17 Sep 2019 09:59:44 -0700 (PDT)
Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE8AB1200EC for <netconf@ietf.org>; Tue, 17 Sep 2019 09:59:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=17152; q=dns/txt; s=iport; t=1568739583; x=1569949183; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=x5V5wLluPh0H8L34Kg5PXSTjg82cef/OwFiC0lKZ+UY=; b=ecX5YBDto1eMOBK31jo5lIA8SaNiAXdffXZC8rHraTnW2+dSRMAV7L1J HrHX4V1DdIw9jAMLaxwvgk9t3yaae6rGQ8YLU5e5t1jS11/f6B47G8ETg 7Sb+lqZtJiXGX7yYTT6YYQ4nRiuHnCtjO0P2DLsBOqynxr9c+SgAHC++Z E=;
IronPort-PHdr: 9a23:5uwuoRGo1tTg/c/9eVfpW51GYnJ96bzpIg4Y7IYmgLtSc6Oluo7vJ1Hb+e4z1A3SRYuO7fVChqKWqK3mVWEaqbe5+HEZON0pNVcejNkO2QkpAcqLE0r+eeT1bigmG8JqX15+9Hb9Ok9QS47z
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0AJAACHEIFd/4QNJK1dCRoBAQEBAQIBAQEBBwIBAQEBgVMFAQEBAQsBgRUvUANtViAECyoKhBeDRwOEUoYlglyJZYkwhF2BLoEkA1QJAQEBDAEBLQIBAYQ/AheCZSM0CQ4CAwkBAQQBAQECAQUEbYUuDIVKAQEBAQMSEQoTAQE3AQ8CAQgRBAEBKwICAh8RHQgCBAENBQgagwGBHU0DHQECo10CgTiIYXOBMoJ9AQEFhRINC4IXCYE0AYo0gUMYgUA/gVeCTD6CGoIALBWCdDKCJo9RhSWJHY4fQQqCIpEBhBuCNYdHjx6OCooUjnACBAIEBQIOAQEFgVI4gVhwFYMngkILGINPilNzgSmOKgGBIgEB
X-IronPort-AV: E=Sophos;i="5.64,517,1559520000"; d="scan'208,217";a="632443142"
Received: from alln-core-10.cisco.com ([173.36.13.132]) by rcdn-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 17 Sep 2019 16:59:42 +0000
Received: from XCH-RCD-006.cisco.com (xch-rcd-006.cisco.com [173.37.102.16]) by alln-core-10.cisco.com (8.15.2/8.15.2) with ESMTPS id x8HGxgLB024604 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 17 Sep 2019 16:59:42 GMT
Received: from xhs-rtp-001.cisco.com (64.101.210.228) by XCH-RCD-006.cisco.com (173.37.102.16) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 17 Sep 2019 11:59:42 -0500
Received: from xhs-rcd-003.cisco.com (173.37.227.248) by xhs-rtp-001.cisco.com (64.101.210.228) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 17 Sep 2019 12:59:41 -0400
Received: from NAM04-CO1-obe.outbound.protection.outlook.com (72.163.14.9) by xhs-rcd-003.cisco.com (173.37.227.248) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 17 Sep 2019 11:59:41 -0500
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=kMiNpVgexQe9SUCSnd7Vb+oLttNqknGKgIL6zxv/Lo810oj5J1D4sjJtgViLtXELQfcVGh8uAVoPdio1qo5UWzswX9tQLvIHBA+swKmaGjZ+UP8aVjOGarifKYJfVlhtj1oT4IL4BRHKq7w3A0aWXePvWCp6bkMNT83isJ9tS26GqDOGmdhpoTlUZdWx3kw2sOv0osOwrXvV3ctJzvYkwluPdBePujJyoBZRYwB+uuWTgZI2wpmTmgQXxLgg8sVpleH9VRbo1u87ZRfpEPrHpl6hlEqdG0ManIbnQj8BgjILR2aoC5fN2W77rSVBfKDgtXs+Jz2BmFU2suVsm6qsWQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=x5V5wLluPh0H8L34Kg5PXSTjg82cef/OwFiC0lKZ+UY=; b=iaDkUgNB8nSHLjpEL5JD5gUpEAy26kosqKwyeG1Sa2BLHRxa/pkEPAUJB4/9b/aCW9zpjcE+FA1GSUVRCYXmFoSeDdlkbu06W5ovYLYKYHNi/xZ1CDEpEpFFA9+JZMNguTNcbkQ3jlMu1KG7j8A35KMRciX49nMhtXAHP0Tf+VODp3BkWGC6BgGzlgIuACCheHRN6Az3E85Ydj3n0TiEYdw4hfQcnXoO1Rd8gVWYTAHjiyS18x95eTun9Dc+rJPlxH+4dpT9669oJJc7agP+5z2ynTpmPgh7Nq7Vb/bzSNS3zqEGIql2qtg33Q3EHGshjqNsjKjWVu/eC2nlCDazog==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=x5V5wLluPh0H8L34Kg5PXSTjg82cef/OwFiC0lKZ+UY=; b=WUOAUFNeWFfw3NpwAU5J0QVQTSXSlLJCHlF4bl+67eVhtbyT7UuAZtyW5cOWIjUiwrcx926+hpNiY8jDZ9m9acRqSalj1cc3lwFp8I7GNKiIS5F0ZUDd9voq6ED2uLJ5jLLWjlh+Oo72xX/AXy7Fn3VmKa2QXhyg5vk57NqU8BA=
Received: from MN2PR11MB4366.namprd11.prod.outlook.com (52.135.38.209) by MN2PR11MB4064.namprd11.prod.outlook.com (20.179.150.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2263.17; Tue, 17 Sep 2019 16:59:39 +0000
Received: from MN2PR11MB4366.namprd11.prod.outlook.com ([fe80::6db3:f4c:467b:30f6]) by MN2PR11MB4366.namprd11.prod.outlook.com ([fe80::6db3:f4c:467b:30f6%7]) with mapi id 15.20.2263.023; Tue, 17 Sep 2019 16:59:39 +0000
From: "Rob Wilton (rwilton)" <rwilton@cisco.com>
To: "Salz, Rich" <rsalz@akamai.com>, Kent Watsen <kent+ietf@watsen.net>
CC: Russ Housley <housley@vigilsec.com>, "netconf@ietf.org" <netconf@ietf.org>, Sean Turner <sean@sn3rd.com>, Rifaat Shekh-Yusef <rifaat.ietf@gmail.com>
Thread-Topic: [netconf] crypto-types fallback strategy
Thread-Index: AQHVaNxVu0aQE+n/K0iPwVgOy8FH/KcpQIdQgAVLFQCAARKfAIAATvkAgAABvxCAAC5vAIAAAggg
Date: Tue, 17 Sep 2019 16:59:39 +0000
Message-ID: <MN2PR11MB4366B5C09B4348FDAE33E2BCB58F0@MN2PR11MB4366.namprd11.prod.outlook.com>
References: <0100016d21ee2101-fb4f3288-1975-4a7d-a499-cb42ff8d9e14-000000@email.amazonses.com> <MN2PR11MB4366AE6CF9E03B15EBEA3A39B5B30@MN2PR11MB4366.namprd11.prod.outlook.com> <0100016d3afa694e-ce58ee3a-792f-4c0e-89bb-83d0128a5194-000000@email.amazonses.com> <MN2PR11MB4366F63419F6BD4EF106766FB58F0@MN2PR11MB4366.namprd11.prod.outlook.com> <8053FDA0-77EA-488F-B5A7-F203359105E0@akamai.com> <MN2PR11MB43669B3A47A39FD93B47292FB58F0@MN2PR11MB4366.namprd11.prod.outlook.com> <6924CAD5-F740-4512-8689-E0307AF0BD88@akamai.com>
In-Reply-To: <6924CAD5-F740-4512-8689-E0307AF0BD88@akamai.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rwilton@cisco.com;
x-originating-ip: [173.38.220.61]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 3b17b6e2-084b-4878-5617-08d73b906da9
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600167)(711020)(4605104)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:MN2PR11MB4064;
x-ms-traffictypediagnostic: MN2PR11MB4064:
x-microsoft-antispam-prvs: <MN2PR11MB4064DF603C273C6E2EE54FCCB58F0@MN2PR11MB4064.namprd11.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:9508;
x-forefront-prvs: 01630974C0
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(39860400002)(396003)(376002)(136003)(366004)(346002)(51914003)(189003)(199004)(64756008)(66556008)(66446008)(4326008)(256004)(14444005)(54906003)(446003)(11346002)(6306002)(99286004)(476003)(486006)(316002)(110136005)(7736002)(26005)(9326002)(8676002)(81156014)(81166006)(7696005)(8936002)(74316002)(6436002)(66066001)(5660300002)(54896002)(6506007)(76176011)(66476007)(66946007)(86362001)(14454004)(2906002)(52536014)(102836004)(76116006)(186003)(9686003)(71200400001)(55016002)(3846002)(33656002)(478600001)(790700001)(6116002)(6246003)(229853002)(71190400001)(53546011)(25786009); DIR:OUT; SFP:1101; SCL:1; SRVR:MN2PR11MB4064; H:MN2PR11MB4366.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1;
received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: WDP7JLAqvvr9GqclBsu4mGDhAuB0sA1N7I1U91fy2fVgr/OIQGEK5I2W6tAcCEeUkgWc4HEU+YnpDCmq8F+qjRnH0PUFU6FKN9KTsDjc585x7Du1kmQV2Z9+8xLVhK4fXRWryiSgTkiBcoy+YybFKmsR5lTNMO1Cts5OFwDOXPeFURkLnFk04oZ2gxF3ANA0U6x+kM7nCSyG7RZvsA+tLaZmBsj2ZScXp8c0LjtLOtTGMiUn73gyUAfPYwL1YCPCQDnv5PLm+1vzYbQgT5YGAnTip3uvc1+dQyKP3drPe8Gcp85lg7fuuoV5XQ15MIZmmMtf4KSPm/jjCkfoelmdR00zO+mRWGHUdb9odUHj+w3Ns+es1wOxwUqZ+83IhauI7ATWuKd8FnFlQAjvhhaAtC24NbUmmgdQy4pPV8cGgy4=
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_MN2PR11MB4366B5C09B4348FDAE33E2BCB58F0MN2PR11MB4366namp_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 3b17b6e2-084b-4878-5617-08d73b906da9
X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Sep 2019 16:59:39.3910 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: BL24rdfi4XQ0jhb5YTHMIbU3lypaO5TnjTsmmafCMUmtzWMDVnzloBj5fSRSTXigdOYblhYCwPVNFUF3HqKhEw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB4064
X-OriginatorOrg: cisco.com
X-Outbound-SMTP-Client: 173.37.102.16, xch-rcd-006.cisco.com
X-Outbound-Node: alln-core-10.cisco.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/netconf/PeKc755iRyJ0qJbzosfpyVSDSSE>
Subject: Re: [netconf] crypto-types fallback strategy
X-BeenThere: netconf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: NETCONF WG list <netconf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netconf>, <mailto:netconf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netconf/>
List-Post: <mailto:netconf@ietf.org>
List-Help: <mailto:netconf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netconf>, <mailto:netconf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 17 Sep 2019 16:59:47 -0000

Hi Rich,

From: Salz, Rich <rsalz@akamai.com>
Sent: 17 September 2019 17:47
To: Rob Wilton (rwilton) <rwilton@cisco.com>; Kent Watsen <kent+ietf@watsen.net>
Cc: Russ Housley <housley@vigilsec.com>; netconf@ietf.org; Sean Turner <sean@sn3rd.com>; Rifaat Shekh-Yusef <rifaat.ietf@gmail.com>
Subject: Re: [netconf] crypto-types fallback strategy

Thanks for the reply.

I think the most important thing is to get it *right* and in a way that the security folks (including those way much more knowledgeable than I) will accept it. We seem to agree that narrowing the scope is a good way to get there.

I also still think, more strongly now, that building definitions around the algorithms, rather than the type of key material, is wrong.
[RW]
Please may I ask you to clarify what you mean by this last comment.

Do you mean that you don’t like the base identities (e.g. hash-algorithm, asymmetric-key-algorithm, mac-algorithm, encryption-algorithm, encryption-and-mac-algorithm, signature-algorithm, key-exchange-algorithm), which really just define how the identities can be used.

Or is your objection to my suggestion of putting the identity definitions into different YANG modules (e.g.

  *   Ietf-crypto-sha-types.yang for the SHA hash identities (RFC 6234)
  *   Ietf-crypto-rsa-types for RSA asymmetric-key-algorithm (RC 8017)
  *   Ietf-crypto-elliptic-curve-types for the Elliptic Curve based algorithms (RFC 6090, 5480, 8422)
  *   Ietf-crypto-mac-types – I’m not really sure how to organize the MAC algorithm types, or even if they need to be defined now.
  *   Ietf-crypto-aes-types – AES encryption types (RFC 4309)
  *   Ietf-crypto-ssh-types – das-sha1, rsaasa-pkcs1-sha1 (RFC 4253)
  *   Ietf-crypto-tls-types – (RFC 8446)
  *   Ietf-cyprto-dhe-types – Diffier Hellman key exchange (RFC 7919).  Actually, the key-exchanges algorithm types might need to be split up a bit further.
), e.g. which is really just an organization structure for the identities?

Thanks,
Rob

v2.23.0 | Report a Bug | By Email