Re: [netconf] updates to client/server drafts

[Juergen Schoenwaelder <[e-mail]>]

On Thu, Jun 13, 2019 at 01:00:24PM +0200, Martin Bjorklund wrote:
> Juergen Schoenwaelder <[e-mail]> wrote:
> > I am strictly against hiding actions by encoding 'verbs' in an ad-hoc
> > data format. I rather not support creation of keys on the device.
> 
> Remember we had this cases:
> 
> 1.  upload of keys
> 2a. generation of keys on the box that will go into hardware protected
>     storage (and never be accessible)
> 2b. generation of keys on the box that will be stored on disk
>     (and never be accessible over the mgmt interface)
> 3.  generation of keys on the box that become (protected) configuration
> 
> 
> I think the previous version of the draft (with YANG actions) handles
> 1 and 2 (a and b with trivial updates).
> 
> It is only (3) that we don't have a solution for that everybody
> accepts.
> 
> So perhaps we should solve 1 and 2a and 2b, and publish that, and
> leave 3 for the future?

This may be a way to move forward. In 2a and 2b, will there be a way
to remove a generated key via the mgmt interface or do I have to take
a bigger hammer to accomplish this?

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
Fax:   [phone]         <https://www.jacobs-university.de/>