[netconf] ietf crypto types - permanently hidden

[Balázs Kovács <[e-mail]>]

Hi,

The 'generate-hidden-key' action is meant for cases when the key must be generated in the device and not the operator is configuring it. The 'generate-hidden-key' is said to produce a 'permanently-hidden' asymmetric key. The description of 'permanently-hidden' is as follows:

                "The private key is inaccessible due to being
                  protected by the system (e.g., a cryptographic
                  hardware module).  It is not possible to
                  configure a permanently hidden key, as a real
                  private key value must be set.  Permanently
                  hidden keys cannot be archived or backed up.";

Th second sentence doesn't sound right. I can create a permanently hidden key any time by calling the 'generate-hidden-key' action, or if the device or the model allows I could even switch to non-hidden key, I believe, by providing the binary. So I find the second sentence irrelevant in this description.

More importantly, I find the "Permanently hidden keys cannot be archived or backed up" statement false. Isn't that implementation specific how archiving is done? If a device puts the hidden keys on some storage, it may still be possible to back them up. I would prefer to remove this sentence and leave backup considerations to implementations.

Could these changes be done?

Br,
Balazs