[Netconf] FW: Evaluation: draft-ietf-netconf-tls-07.txt to Proposed Standard

"Romascanu, Dan (Dan)" <dromasca@avaya.com> Wed, 04 March 2009 12:40 UTC

Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable
Date: Wed, 04 Mar 2009 13:39:37 +0100
Message-ID: <EDC652A26FB23C4EB6384A4584434A0401493EE8@307622ANEX5.global.avaya.com>
Thread-Topic: Evaluation: draft-ietf-netconf-tls-07.txt to Proposed Standard
Thread-Index: AcmctE6PJ+XXJxdqS+eRZAX3IY0LqwAEeJog
From: "Romascanu, Dan (Dan)" <dromasca@avaya.com>
To: ops-dir@ietf.org, aaa-doctors@ietf.org, Netconf <netconf@ietf.org>
Subject: [Netconf] FW: Evaluation: draft-ietf-netconf-tls-07.txt to Proposed Standard
Precedence: list

 


A URL of this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-netconf-tls-07.txt

Technical Summary

The Network Configuration Protocol (NETCONF) provides mechanisms to
install, manipulate, and delete the configuration of network devices.
This document describes how to use the Transport Layer Security (TLS)
protocol to provide a secure connection for the transport of NETCONF
messages. The mechanisms defined in this document include the support
for certificate-based mutual authentication and key derivation,
utilizing the protected ciphersuite negotiation, mutual authentication
and key management capabilities of the TLS (Transport Layer Security)
protocol.

Working Group Summary

Many WG member were thinking that password-based authentication is
already handled well enough by the existing NETCONF transports (SSH and
BEEP), and the NETCONF-over- TLS specification does not need to handle
passwords.
It has been recommended to scope the document to certificate- based
authentication. 

There was also some controversy on the use of pre-shared keys
(PSKs) derived from passwords. Based on this dicussion the Working Group
decided to remove the text related to PSK based- authentication. See
http://www.ietf.org/mail-archive/web/netconf/current/msg03856.html
        
There was some controversal discussion about the Connection Closure. The
consensus was that the document adopts the closure mechanism from
draft-ietf-syslog-transport-tls-, Section 4.4. 
    
There was also some controversy about the use of a dedicated port of
NETCONF over TLS. The consensus was that a dedicated port should be
requested. 
        
The summary of the last changes can be found in:
http://www.ietf.org/mail-archive/web/netconf/current/msg03873.html
http://www.ietf.org/mail-archive/web/netconf/current/msg03882.html 

There were many WG members who did not strongly support or object to the
document. Nobody objected to the document during or after the WGLC. The
level of review in the WG was adequate , with several 
independent reviews by WG members. There is WG consensus to publish    
the document. 

Document Quality

No vendors have announced that they will utilize this protocol. 
Two implementations with independent code-base and initiated by the
document author are available as open source. The author ensures that
the two implementations have been tested as interoperable.


Personnel

The document was reviewed by Eric Rescorla, Juergen Schoenwaelder, David
Harrington, the WG security advisor Charlie Kaufman, and the security
ADs Pasi Eronen and Tim Polk. 
Mehmet Ersue is the document shepherd, and Dan Romascanu the shepherding
AD. 

RFC Editor Note

  (Insert RFC Editor Note here or remove section)

IRTF Note

  (Insert IRTF Note here or remove section)

IESG Note

  (Insert IESG Note here or remove section)

IANA Note

  (Insert IANA Note here or remove section)

[Netconf] FW: Evaluation: draft-ietf-netconf-tls-… Romascanu, Dan (Dan)