Re: [netconf] crypto-types and keystore comments

[Kent Watsen <[e-mail]>]

Hi Martin,

>> True.  But how can we define a way to get a list per instance?  Should
>> there be a "config false" list wherever the "algorithm" node appears
>> (i.e., put the list into the crypto-type groupings having the
>> algorithm node?)
> 
> I don't know, probably.  Do we really want that?  Probably not.

Per-instance may be too granular.   If thinking that said curations occur of protocol boundaries, then maybe have a config false list in ietf-ssh-common and ietf-tis-common?   Not perfect, as an application may use more than one SSH library or more than one TLS library, but it's much less likely.


> This is exaclty why I suggested earlier that we don't spend time
> trying to solve this problem at all now.  I'd rather not put in
> something that we know doesn't really work.

Wait, no, there is a very real issue here that cannot be ignored.  Or do you feel that we should give up entirely on trying to enable servers to proactively express what algorithms they support?



>>> Do you have a pointer to this?
>> 
>> There was an email from Juergen a few months back.
> 
> But that was based on a misunderstanding.  (or you mean something
> else)

Now I'm unsure what you're talking about, do you have a pointer to it?


Kent // contributor