Re: [netconf] crypto-types fallback strategy

[Kent Watsen <[e-mail]>]

> Moving Russ and Sean to BCC; they can subscribe to the list if they want :)

Okay but, be aware that this thread is the culmination of me interacting with Sean and Russ for a couple weeks...


> >  - specify that all TLS public-keys are a DER-encoded SubjectPublicKeyInfo structure
>  
> No, they should be an X509 certificate object.

There is a separate field for certificates, which is an X.509 certificate.

The desire to use SubjectPublicKeyInfo is per tests (2) and (4) described here: https://mailarchive.ietf.org/arch/msg/netconf/ysukDdbCA0a70heF1a_ldZNr4yE <https://mailarchive.ietf.org/arch/msg/netconf/ysukDdbCA0a70heF1a_ldZNr4yE>.



> Private keys and symmetric keys can be encrypted; is that a separate keytype derived from their base key types?

I don't understand the question.  I think your tip-toeing on a concern that a key should only be encrypted with a certain other key, if only the ensure that the strength of the encrypting key is not less than the key being encrypted.  Is this what you mean?

draft-ietf-netconf-keystore currently uses a YANG "leafref" for the model to point to the other key in the keystore used to do the encryption.  The leafref has not constraints on its at the moment.


Kent // contributor