Re: [netconf] updates to client/server drafts

[Martin Bjorklund <[e-mail]>]

Juergen Schoenwaelder <[e-mail]> wrote:
> On Thu, Jun 13, 2019 at 01:00:24PM +0200, Martin Bjorklund wrote:
> > Juergen Schoenwaelder <[e-mail]> wrote:
> > > I am strictly against hiding actions by encoding 'verbs' in an ad-hoc
> > > data format. I rather not support creation of keys on the device.
> > 
> > Remember we had this cases:
> > 
> > 1.  upload of keys
> > 2a. generation of keys on the box that will go into hardware protected
> >     storage (and never be accessible)
> > 2b. generation of keys on the box that will be stored on disk
> >     (and never be accessible over the mgmt interface)
> > 3.  generation of keys on the box that become (protected) configuration
> > 
> > 
> > I think the previous version of the draft (with YANG actions) handles
> > 1 and 2 (a and b with trivial updates).
> > 
> > It is only (3) that we don't have a solution for that everybody
> > accepts.
> > 
> > So perhaps we should solve 1 and 2a and 2b, and publish that, and
> > leave 3 for the future?
> 
> This may be a way to move forward. In 2a and 2b, will there be a way
> to remove a generated key via the mgmt interface or do I have to take
> a bigger hammer to accomplish this?

If we can agree on this way forward, I think we can solve the life
cycle issue.  One action to create the key and one to delete it seems
reasonable.


/martin