Re: [netconf] draft-ietf-netconf-trust-anchors and unconstrained public keys

[Kent Watsen <[e-mail]>]

Hi Carl,

It's always nice to see authors promote their drafts!  ;)

> Section 4.2 states:
> 
> 	This module also enables the configuration of certificates, where each certificate may constrain the usage of the public key according to local policy.
> 
> Assuming local policy means relying party defined policy, this won't work unless the signature on the certificate is ignored. Defining or using a structure in this draft that supports local application of constraints may help avoid reliance on public keys that are unnecessarily broad. RFC 5914 defines a structure that allows for associating constraints with raw public keys or certificates. The default representation of the TA structure in 5914 is simply a certificate, so it'd fit here pretty easily. Historically, trust anchors have been essentially unconstrained but that may not always be the case going forward. 

Reading RFC 5914, the impact of what you're suggesting seems to be that the truststore should also contain a list of TrustAnchorInfo structures...is this correct?

Can this be augmented into the truststore by a future effort, or does it have to be in the first release of the truststore format?

I've never heard of RFC 5914 before, is it widely used?

Kent // author