Re: [netconf] crypto-types fallback strategy

[Kent Watsen <[e-mail]>]

> On my Linux system, certs tend to be stoed in pem format, so I am
> biased. It seems some other applications like web browsers and server
> also tend to use pem format. But I am happy to be corrected since my
> experience with cert usage is limited.
> 
> Yes, the application or presentation could convert between formats and
> solve all problems. One of the failures of SNMP was that SNMP required
> an application or presentation layer to be usable while CLIs did not
> require other tools. The idea that there is always software between
> the NC/RC server and whoever has to solve an automation problem has
> somehow failed in the past. I believe data models should be written to
> enable automation without requiring lots of additional tooling. And
> yes, there is a need to find a balance.


Use a union statement?  The 'string' type  for PEM and 'binary' for DER?


>>> The SSH implementations that I use have the binary key data rendered
>>> in ASCII. In fact, the whole key record is rendered in ASCII. I
>>> strongly suggest to use formats that are well established.
>> 
>> This is the "key-data" leaf from RFC 7317.  Are you saying that it should've been different?
>> 
>> Regardless, should this be a presentation layer issue?
> 
> See above, if we start to require a presentation layer, we may repeat
> a failure. It might be useful to check who has implemented that part
> of RFC 7317 and how happy operators were with the format. I personally
> would not immediately know how to convert my openssh key in a binary
> format such that that I can use the YANG model. We should try to
> maximize usability and stay away from the idea that a presentation
> layer will be available to make things usable for people that have to
> script customized automation solutions.

Use a union for this too?  string vs binary?

One issue is that your file-format is most likely an OpenSSH-specific format, which is likely duplicated by other SSH implementations.   Is it too much of an assumption to use that format as the defacto 'string' format?  Perhaps we should define a custom type (e.g., openssh-string) to use instead of "string"?


Kent // contributor