Re: [netconf] Yangdoctors last call review of draft-ietf-netconf-keystore-20

[Kent Watsen <[e-mail]>]

Hi Juergen,

Likewise trimming to the essential parts.

K.


>>> - Is the feature keystore-supported really needed? Does the YANG
>>> library not already provide the information whether a module has
>>> been implemented or just imported to access type and grouping
>>> definitions? OK, I know see that this is used to make definitions
>>> conditional, hence it makes sense. This means that my comment on
>>> truststore-supported in the other review can be ignored, I found
>>> the answer.
>> 
>> Please see my response to your comment in that draftb
>> 
> 
> See also my comment on the other document. My question was whether
> this bit can already be picked up from the YANG library.

Right, and I did just reply that whilst the two point to the same same, only one can be used in “if-feature” statement expressions, which is what is needed.


> 
>> BTW, b
> 
> I think this is better.

It took me while to determine what text got clipped above which you this is better.  Let me clarify, you think that it would be better to both:

OLD; keystore-supported
NEW: central-keystore-supported

*and*

OLD:  … the keystore, when this module is implemented
NEW: … the central keystore, when this module is implemented

Correct?


>>> - Section 4.3 talks about _highly_ restricted access mechanisms and
>>> _highly_ authorized clients and I am usually a bit confused what
>>> _highly_ means. But I am YANG doctor, not a security reviewer. ;-)
>> 
>> Trying to say that, e.g., the NACM should only allow a "crypto officer" access to the MKb
> 
> So is NACM the 'highly restricted access mechanisms'? Should it be
> 
> OLD
>  highly restricted access mechanisms SHOULD
> 
> NEW
>  access control mechanisms like NACM SHOULD

Replaced.  Better, thanks!


> OLD
>  highly authorized clients
> 
> NEW
>  authorized clients

NEWEST:  ...only to the most trusted authorized clients

Ok?


> My point is that "highly" simply does not mean anything (to me).

Point taken, “highly” doesn’t mean much.




> I browsed the diff, the changes look good to me.


Thanks,


K.