[netconf] Truststore: bags, sets, or other?

[Kent Watsen <[e-mail]>]

[CC-ing Russ, who says he knows a lot about bags ;)


The truststore draft [1] has the following general structure:

   module: ietf-truststore
     +--rw truststore
        +--rw certificates* [name] {x509-certificates}?
        |  +--rw name           string
        |  +--rw certificate* [name]
        |     +--rw name                      string
        |     ...
        +--rw host-keys* [name] {ssh-host-keys}?
        |  +--rw name           string
        |  +--rw host-key* [name]
        |     +--rw name        string
        |     ...
        +--rw raw-public-keys* [name] {raw-public-keys}?
           +--rw name              string
           +--rw raw-public-key* [name]
              +--rw name                 string
              ...


I have been struggling with the naming of the top-level nodes (/certificates, /host-keys, etc.) being plural while also being ‘list’ elements.   What is intended is that each of these top-level nodes is a "list of sets/bags of things.    To resolve this issue, I’m thinking about the following change:

OLD:
            +--rw <thing>s* [name] {<thing-feature>}?
               +--rw name string
                  +--rw <thing>* [name]
                     +--rw name string
                      …

NEW:
            +--rw <thing>-bags {<thing-feature>}?
               +--rw <thing>-bag* [name]
                  +--rw name string
                     +--rw <thing>* [name]
                        +--rw name string
                         …

Better, right?   Any other ideas?

Note that the term “bag” is the commonly used term in crypto circles with regard to PKI and, in particular, in reference to the “CertBag” type defined in Section 4.2.3 in RFC 7292 [2].   That said, I don’t think that “bag" is commonly used in reference to SSH host keys or raw public keys.  I don’t know if that is any issue but, in case it is, the choices are:

	1) use “bag” for all three
	2) use “set” for all three
	3) use “bag” for certificates and “set” for the other two
	4) <another idea?>

Thoughts?


[1] https://tools.ietf.org/html/draft-ietf-netconf-trust-anchors <https://tools.ietf.org/html/draft-ietf-netconf-trust-anchors>
[2] https://tools.ietf.org/html/rfc7292#section-4.2.3 <https://tools.ietf.org/html/rfc7292#section-4.2.3>

Kent