Re: [netconf] WGLC on draft-ietf-netconf-tls-client-server

[Dhruv Dhody <[e-mail]>]

Hi Kent,

On Wed, Apr 21, 2021 at 6:41 AM Kent Watsen <[e-mail]> wrote:

> Hi Dhruv,
>
> - I am wondering if anything needs to be done for the older versions of
>> TLS which are made historic. The use of features helps, is there any other
>> guidance that needs to be given?
>>
>>
>> We could set the “status” to “deprecated”.  That said, it's one thing to
>> say that a protocol is deprecated and another to say that the configuration
>> for a still somewhat widely-used deprecated-protocol is
>> deprecated…thoughts?
>>
>>
>>
> I agree that we need to allow the configuration of older TLS versions in
> the YANG module.
>
> I found this comment from Ben to be useful -
> https://mailarchive.ietf.org/arch/msg/last-call/oVO7XyHyTtX4bdkpN9PymiovieA/
> . I ended up putting MD5 and SHA-1 support under a feature 'deprecated’.
>
>
> Wait, you put the support under a feature called “deprecated” or under a
> deprecated feature (called something else?
>
>
The former. Maybe I can use a different name to avoid confusion.



>
>
> In this case, I think just adding some text in the description around the
> existing features for older TLS could also do the job.
>
>
>
> That’s easy enough.  For each feature except 1.3, I added to the
> “description” statement:
>
>     "Please note that TLS 1.? is obsoleted and thus it is NOT
>      RECOMMENDED to enable ths feature.”
>
> Is it what you had in mind?
>
>
Yes!

Thanks!
Dhruv



> K.
>
>
>
>