[Netconf] mbj comments on draft-kwatsen-netconf-crypto-types-00

[Martin Bjorklund <[e-mail]>]

Hi,

Some quick comments on draft-kwatsen-netconf-crypto-types-00:


o  identity hash-algorithm

  I suggest you remove the sentence:

       This identity is used in the ietf-zerotouch-information
       module (draft-ietf-netconf-zerotouch)";


o  leaf private-key

        "A binary that contains the value of the private key.  The
         interpretation of the content is defined by the key
         algorithm.  For example, a DSA key is an integer,

  Is it clear how an integer is stored in a "binary"?


o      action generate-private-key {

  Will the public key be instatiated as well?


o  It should be stated that if the client tries to set the private-key
   to "hardware-protected" (or invalid binary data), the server
   returns an error.


o  What happens if the client first configures a key, and then invokes
   the action "generate-private-key"?   Will it just be a mismatch
   beteen the config and operational state?

   Maybe the action should only be available when no private key
   exists?


o  Should the algorithm be mandatory in the config; then it is not
   needed as an input parameter to the action.

   What happens if the algorithm doesn't match the key, either both in
   config, or the key in hardware?


o    grouping certificates-grouping {

      description
        "Certificates associated with this key.

   Which key?  There is no key in this grouping.



/martin