Re: [Netconf] Draft Charter Proposal for NETCONF WG

[t.petch <[e-mail]>]

----- Original Message -----
From: "Kent Watsen" <[e-mail]>
Sent: Wednesday, March 22, 2017 10:21 PM

> Hi Mahesh,
>
> >> Again, a keystore is not limited to asymmetric keys.   At the
moment
> >> it is exclusively asymmetric, but that's only because we (the
authors)
> >> moved the passwords (read symmetric keys) that were present in the
> >> previous version to the ietf-ssh-client module, but they may
return,
> >> as many real-world keystore mechanisms do manage passwords as well
> >> (e.g., Mac OSX's Keychain Access utility).
> >>
> >> The module names are fine, but we could update the draft title. How
> >> about "A System-level Keystore Model"?
> >
> >
> > How about "Asymmetric Key System-level Keystore Model"?
> >
> > And add a reference to keychain model for symmetric keys.
>
> Regarding "asymmetric", as mentioned above, while the keystore module
> is currently exclusively asymmetric, it's probable that passwords will
> be added to it in the future.
>
> Regarding "system-level", I'm not 100% sure.  Specifically, the
PCE-PCEP
> use of the ietf-tls-client module, which uses the keystore module,
gives
> me pause.  Is it still a system-level use then?
>
> Maybe one of the authors of the RTGWG key-chain draft to try to
express
> how the two modules differ, and why they shouldn't be merged into one
> draft.

Kent

Sorry about mixing up keystore and keychain - I did download the updated
draft last week but failed to find it when I was drafting my post.
However, while I know the English semantics of store and chain, I do
find it more difficult to attach different semantics to keystore and
key-chain, and I do find the Abstracts of the two I-Ds rather similar
which leaves me uncertain about the scope of the work in Netconf.

When the proposed charter says
"  1. Finalize the YANG data module for a system-level keystore
mechanism,
  that can be used to hold onto asymmetric private keys and certificates
  that are trusted by the system advertising support for this module."
I am still uncertain.

You are saying symmetric keys may come in future but should this be part
of the charter now? I am divided on this.

You are saying you are unsure about system-level but what is it then,
not that I have ever realised what is meant by system-level (unless it
means not just for routers, but then the Abstract of key-chain, for the
first five sentences, sounds like a system-wide model with sentence six
only saying it is commonly used for routing protocols, it does not say
it is not also for system-wide use!).

I would then avoid system-level, since I do not understand it:-(
"Generic keystore mechanism" perhaps.

I note that the charter does say 'asymmetric' which I think needs saying
and also adding to the I-D; and I do think that the Netconf I-D should
recognise the existence of other I-Ds relating to the storage of  keys,
although that detail is not a matter for the charter.

Tom Petch

> Thanks,
> Kent
>