Re: [netconf] crypto-types fallback strategy

["Rob Wilton (rwilton)" <[e-mail]>]

From: Kent Watsen <[e-mail]>
Sent: 18 September 2019 18:12
To: Juergen Schoenwaelder <[e-mail]>
Cc: Rob Wilton (rwilton) <[e-mail]>; [e-mail]; Rifaat Shekh-Yusef <[e-mail]>
Subject: Re: [netconf] crypto-types fallback strategy

[moving Russ and Sean to BCC, per Rich's action]




I tend to agree that sometimes less modules is more. For me, the
problem is likely more that I am not entirely sure what the proper
base types would be, which may depend on what exactly they are used
for. I guess I wait until I see the description text...


Okay, we'll keep just the one YANG module.
[RW]
Do you mean one module for all the identities of just the base identities?

Thanks,
Rob





A bit separate from the above, but still in mind:

 - specify that all TLS public-keys are a DER-encoded SubjectPublicKeyInfo structure
 - specify that all SSH public-keys are a "ssh-public-key-type" type (see below)
 - specify that all encrypted symmetric keys are a DER-encoded OneSymmetricKey structure
 - specify that all encrypted asymmetric keys are a DER-encoded OneAsymmetricKey structure

I would check what is commonly used in existing configuration
interfaces. We are not inventing the wheel here. And whatever we
define better is usable with existing implementations and tools.

These are the native types used by OpenSSL and OpenSSH, what more verification do we need?

Possibly we could discuss supporting PEM, in addition to DER, but I'd image that, if PEM is supported at all, the presentation layer (Web UI, CLI) would convert it to/from PEM as needed (i.e., the underlying model only needs to support DER).



The SSH implementations that I use have the binary key data rendered
in ASCII. In fact, the whole key record is rendered in ASCII. I
strongly suggest to use formats that are well established.

This is the "key-data" leaf from RFC 7317.  Are you saying that it should've been different?

Regardless, should this be a presentation layer issue?

Kent // contributor