Re: [netconf] More complications

Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de> Tue, 15 June 2021 12:18 UTC

Return-Path: <J.Schoenwaelder@jacobs-university.de>
X-Original-To: netconf@ietfa.amsl.com
Delivered-To: netconf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91F6E3A2D9A for <netconf@ietfa.amsl.com>; Tue, 15 Jun 2021 05:18:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, MSGID_FROM_MTA_HEADER=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=jacobsuniversity.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nMDBKjSu0uWn for <netconf@ietfa.amsl.com>; Tue, 15 Jun 2021 05:18:12 -0700 (PDT)
Received: from EUR05-VI1-obe.outbound.protection.outlook.com (mail-vi1eur05on2067.outbound.protection.outlook.com [40.107.21.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3B553A2D99 for <netconf@ietf.org>; Tue, 15 Jun 2021 05:18:11 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZGYVhK2TD2cws2+G7GZYHfUeTL9zre7EjnIt5UmsmvlpJIa+5Nz5HogbCxNVBi+GTfsMtkGwqF1vvuJU99tLf1KKx13dJHwbZYPyWglD4l03apvytSvGXsOB4fipa3UfBxnDYYdMe/ahCPamG0Hs4Oos44mttATzhDPjSiT4+n/D9e5IVv34tYLKRMyl432DqEfqXKm1fJdQuQR7RE3Ms1jBovZFlGKCjRCMooasFNhgUY98+1IF+M11POgcpvr14oySREutXFNiWYxfiehuj7vFxIepS7z2rJyNMkXyPdefvxgbbs6krCPdX9E44AoSIXnxy+dGGY9W/W6/dTt38g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hiUo+gf1P3fO6QSTEDnBo2gP/mI4rnrYZiJl1yr537k=; b=Ln3+ax5n1hWjovdYGmmgYvZ1bsXTITcqmpUrfaFF/Irh2TX99ZhTuuUAYakpYFUj7vENJAyiyJbqHPDKxEKmoplmC+qB5O/pkPdXe+Pl49MtVQOiSucRPWLUcKU8Scqx1GEvERUQNTYGyactHDwlBA4zoYsrIugsS7iIron4Arzf+7KqubPl5LY1Di3AyWGkbyjXmSaS1dHvWNUmmd8SH5979CfOrvcxFVKDIow7MV9Dm8bUz7d5yjNT1EEYSeY1VBtPX5x/fURlc4RStkZmRMC4Cyw5fFodB7NtZEcvhh3v0jahU32i2xhuYuVXZf0OIrg0s4awhwT5ZCUUE9vOPQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=jacobs-university.de; dmarc=pass action=none header.from=jacobs-university.de; dkim=pass header.d=jacobs-university.de; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jacobsuniversity.onmicrosoft.com; s=selector2-jacobsuniversity-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hiUo+gf1P3fO6QSTEDnBo2gP/mI4rnrYZiJl1yr537k=; b=BlZYCPKevr5UXvWB+QvQF6/sVmVKKSyZE+z5rmUgXLdetMLjvnLi4fa3CNRjWMjoWFEv1Mw92C0gImyz5a5Crq/6pRQZVfW7rDSUY6gZNe+9+xdP1q6HJRUc309kylnDdHdxkujLH7xgRBTd/64g8RYhmNT9fC2nYsp8oceuick=
Authentication-Results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=jacobs-university.de;
Received: from AM0P190MB0641.EURP190.PROD.OUTLOOK.COM (2603:10a6:208:194::23) by AM0P190MB0659.EURP190.PROD.OUTLOOK.COM (2603:10a6:208:198::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4242.16; Tue, 15 Jun 2021 12:18:06 +0000
Received: from AM0P190MB0641.EURP190.PROD.OUTLOOK.COM ([fe80::fd93:9b33:ac92:ea58]) by AM0P190MB0641.EURP190.PROD.OUTLOOK.COM ([fe80::fd93:9b33:ac92:ea58%8]) with mapi id 15.20.4219.025; Tue, 15 Jun 2021 12:18:06 +0000
Date: Tue, 15 Jun 2021 14:18:04 +0200
From: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
To: "netconf@ietf.org" <netconf@ietf.org>
Message-ID: <20210615121804.weihro7eusvnfym6@anna.jacobs.jacobs-university.de>
Reply-To: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
Mail-Followup-To: "netconf@ietf.org" <netconf@ietf.org>
References: <AM7PR07MB624835D8BE54144D97221817A02B9@AM7PR07MB6248.eurprd07.prod.outlook.com> <010001798c0d947e-4d2d14f5-9f0e-450d-ac99-e18c260f0c2b-000000@email.amazonses.com> <AM7PR07MB6248FF0E1E5A053D4FA2BDC4A0299@AM7PR07MB6248.eurprd07.prod.outlook.com> <01000179a0aa5d37-4810234e-8db2-434d-b8fa-780c1648955a-000000@email.amazonses.com> <AM7PR07MB624888AD4CB3C09809B22702A0259@AM7PR07MB6248.eurprd07.prod.outlook.com> <01000179a5bdc371-b665451f-61d4-4364-9d55-e9369f3adc8e-000000@email.amazonses.com> <AM7PR07MB6248BBDEECB1134C56426F73A0239@AM7PR07MB6248.eurprd07.prod.outlook.com> <0100017a0aebfbf3-9e9c22e8-da12-4364-a572-8ce7fd43bf0f-000000@email.amazonses.com> <AM7PR07MB6248E24C8235FBD8573017C8A0309@AM7PR07MB6248.eurprd07.prod.outlook.com> <540b31e5-10a6-495f-cf44-820adb6213b3@sit.fraunhofer.de>
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <540b31e5-10a6-495f-cf44-820adb6213b3@sit.fraunhofer.de>
X-Originating-IP: [212.201.44.244]
X-ClientProxiedBy: PR0P264CA0151.FRAP264.PROD.OUTLOOK.COM (2603:10a6:100:1b::19) To AM0P190MB0641.EURP190.PROD.OUTLOOK.COM (2603:10a6:208:194::23)
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from localhost (212.201.44.244) by PR0P264CA0151.FRAP264.PROD.OUTLOOK.COM (2603:10a6:100:1b::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4219.21 via Frontend Transport; Tue, 15 Jun 2021 12:18:05 +0000
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: b148544b-f03b-48c9-0161-08d92ff7a136
X-MS-TrafficTypeDiagnostic: AM0P190MB0659:
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <AM0P190MB06591B11B909DD50BA10821ADE309@AM0P190MB0659.EURP190.PROD.OUTLOOK.COM>
X-MS-Oob-TLC-OOBClassifiers: OLM:9508;
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: f4P2Dtb8tzDdyq5/yHBEDJ/6K0NEHpyUeWq3TBCsTfiYfEUeJa4EdAICDs7e9Tdz9Alvt6TtwtgeyH6EqUd89WZw3izZiVMgJigXrsGnm4TFmXVg72aOOKzTbRfjSCB79NU6GTosTQTRHfvIpxOM5Kgos1Zsp5LfZhl3vL4kPX+B1co5XdqwFoqND8gM9/MeMbes58uIySRmZ8HDQjJdewWmnTKNigOhgLGk8Axd42FztYnlMl5gfEx1iAzCl7N1XSWRbt/DrTQiwRSJ5rxuzNj4zjEEEgSGRIOx38/R2h8z5lMnKcwQu/xs/+eLW/yLXhzyJVL9AtgfZwl4DOZM0tn4FEDsJtNRL/FM3b2x+41tbb/Ub0PcqNb6pvRahEd07/ag5fJtmlHI1oGvmVTgPWM55CCCMoGPynGiww28xKsXY6H+/8gZCcLUSz0LUw2S66W6QbQevGqrWHHD/sSJy4PmdyhvbJlz+kiZK1FlBPg/POkJ88Czb7Ay4WR3VUpa3njN7UNppIsO8X0OwTiZcSLExybCiBpt793+VwKTg87ABptmEzBvSdnQzeWiSVxuAJn1UdOdluad4CiRuXSOkN1EIxwz2AEV5BloBWDxK9ODjf+WhSWIBvnoqKEPu9UCTxTXheYH3KyqlAtvWA/R5EJ+DwskIbc2NweusDiuehLAQsDX/JK2Uf63Jd0IOAjEqzyjpelz6cZ8U4OQKtEJdJdOUFgJyV5Xf/6fBbihmi6OUfoc0AEpeBMJ9zxOSgh79blw4aXI8LDh64cFL9m/E3HGjo5d7OgsoCUQ3rrJienQUs0x7P/notPenZzc4WfK
X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0P190MB0641.EURP190.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(366004)(6486002)(38100700002)(38350700002)(186003)(66946007)(498600001)(6496006)(966005)(2906002)(53546011)(16526019)(83380400001)(8676002)(3450700001)(956004)(5660300002)(6916009)(86362001)(1076003)(52116002)(66556008)(66476007)(8936002)(26005); DIR:OUT; SFP:1101;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?ZWQ4cXAydGZCN29ocnUxQ2gyTS8xZVIzdTI3WEgzZ2RKR1dibEtBUmpKb0tI?= =?utf-8?B?ZHRqOHBCTkpjZThLaHhWVjJTMjBXT2dkQWRBaGoyclJTK3FUNjdwU3RRY2Yx?= =?utf-8?B?eVVYc0dmRkw1M1RoQi9HS2tINHpLUFVYNFl0N0dxTVd2ckdEMGNVU21PczYv?= =?utf-8?B?SEdrcFdrZGMxYUxkQll0TzhsWkxtaW4xMFFhUlQ5NGMyenZpdG1aY24wQ0Jm?= =?utf-8?B?TU5ZR1c1WHRubjdGZVFPT3ZSOXJ3TFpiMHRXQmdGVWsxZFdlT3FXYVJhbXdC?= =?utf-8?B?Y2xlL1RITG54cFRTTjkzNGc2M2hLc09zQ1h5WlFNTEpOZ0tzVjBWRDN1NUsx?= =?utf-8?B?OEw4T055emwzYldZbzNEekp6cmh5WnZsSlNRdWI4UjBHNUVlOHVCenZDTGFO?= =?utf-8?B?M21LQ1JhemhCdTZBcitjSndiS0VCKzJ3U043YzJLejB0TVY3K2Z6KzJHV3F6?= =?utf-8?B?TVhRMXdVUjBjRzBzMW9CY1A0MEVabXpPc0F4YWx4MnhjRTFhL2p3U0lXYXJM?= =?utf-8?B?RjQzRmtmWEFwVzBkVW9sYUpIcnV5MXFaOHhkZ3ZYL29nQjRER3NIaWZmNzU0?= =?utf-8?B?cSs2M1lqckkzeDVwODRnOHI2eXZFYUVMSWJPWlJvekxxakJ3Q3lJWjFZWVRI?= =?utf-8?B?T2p5M3ZHQmxFOGhHU1ZFOUlaT2UrcHRBSUpNYW44NmVjVUdCRUo0US9PNkk3?= =?utf-8?B?THZ6dXUxbDRwTndYeGVOL2U5RmhSSVRYMkZlTjAyVEdVakt4ZmV3UGVYZ0xV?= =?utf-8?B?MFVhSkFyWS8rYmlvV2tlZmQxUTJGTm5xS0tnaHY2NUkwZlZJT21LRmcxRlo2?= =?utf-8?B?TUZCTkNEdWY1UktkRXVRcnd1bG4zNzlmL09abElVdFVwM1JxOFBLUGRITXpP?= =?utf-8?B?TFF2R2dCOUowaWEzSlF6OTNuQ1lhT2hPOG03UFY1aTc5RkJmT3NrVGFOTDhC?= =?utf-8?B?Vy8xbm1aK2xTc0dMeVpaMzVwVTNrTEVuVDViOWo2NDdpMllyVDZaRHlrQmNM?= =?utf-8?B?ZkZZRS8veEZSZGl4eUlNSFZGTjd6V2JzY2VPNlNvamcvT0pQN2cwbXBMRzNM?= =?utf-8?B?UVc4ekpaTTZqdy9LQ1d4UFMwZHhld2g1anhFWHNWWkhWNlNMZG5mWFcrSCt3?= =?utf-8?B?aW1CNVZGNWQxQkpYQmE3ZHBpb0lkZEgreTU0emQ0UWtRc1hjUmYzUUdpck1G?= =?utf-8?B?Wm45QTd5RFE3OElJcDVTdlVmbC9HUlRhdTZLd1ZTdmppUjc3STNZUDJVL0Zm?= =?utf-8?B?MXNFaTdQa284SzhzOW1JRkEzd1ZieUc4QzNjK0tIaVNQbTlkd3pmUGZHazlF?= =?utf-8?B?S09PSmVXa3NKMHdCa2xsRXBHdmZ0ZHZsU2J6MHhic0JoNXZSWFYwT1E1M2Zn?= =?utf-8?B?bngyQlIwYVE0Mm5LczdGQzhNN3ptd09Sc0pqejBNU3hET1hLS1lVd2RDL21G?= =?utf-8?B?NC9Md2NrVUJoeXlaWHVPQzNnZnpBZ0QrSHhZZEtHOUVwTndtOUt0OTRFVkZK?= =?utf-8?B?dnB1MHlaZzBLdlhueUo1UGpaTWVBTy9aSExLbDFQczdLOUdrYTlBTis1Sndp?= =?utf-8?B?aFFiMGkreHVhbGNrT3FJTFROM05KSExtSU5OVnJSa091amZmQnVOVlBwdWFK?= =?utf-8?B?ODJTQWtIRVErNW9vY1gzWGFqVmluN2FIdTZwb1JRblBpeVpSNUZmZlJFbmtQ?= =?utf-8?B?UzRaQWpSajE3YzRLUU9QSnhiZTlXeThsWkwzbTJaWFUrUEFCZHhVbXBqbHJq?= =?utf-8?Q?YVz/Q4Ukb6phDTK7rEpxAribnSzO069NitNIiWD?=
X-OriginatorOrg: jacobs-university.de
X-MS-Exchange-CrossTenant-Network-Message-Id: b148544b-f03b-48c9-0161-08d92ff7a136
X-MS-Exchange-CrossTenant-AuthSource: AM0P190MB0641.EURP190.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Jun 2021 12:18:06.0751 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f78e973e-5c0b-4ab8-bbd7-9887c95a8ebd
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: Bkr6RTjPMi7A4vgfc6yUq0g7MeHIISsboymLicygQDB5+3Ny8xnAfmop9J9tVP4N0o871o+PiZdSWn77tKVtU1nmTKulhUe5fVojqYWj6Pc=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0P190MB0659
Archived-At: <https://mailarchive.ietf.org/arch/msg/netconf/jsG6ZeSXVeCT48Vxqq_94M2r7Co>
Subject: Re: [netconf] More complications
X-BeenThere: netconf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: NETCONF WG list <netconf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netconf>, <mailto:netconf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netconf/>
List-Post: <mailto:netconf@ietf.org>
List-Help: <mailto:netconf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netconf>, <mailto:netconf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Jun 2021 12:18:17 -0000

The way TLS is used with NETCONF is defined in RFC 7589. If any of
that needs clarification to properly support TLS 1.3, then we need to
revise RFC 7589. Defining the proper configuration knobs should follow
from that.

And as Kent reminds us, the scope of the TLS configuration draft is
much wider than just NETCONF over TLS. Hence, dropping support for
certain TLS 1.3 features, that may be essential in some use cases,
should be done with great care. (And lets keep in mind that dropping
standard configuration knobs just means that there are no standard
configuration knobs, it does not mean that a certain protocol feature
won't be used, it will just be configured using other non-standard
means).

/js

On Tue, Jun 15, 2021 at 01:53:19PM +0200, Henk Birkholz wrote:
> Hi all,
> 
> a fellow IETF'ler poked me to pay attention to this thread. Sorry for the
> latency.
> 
> Hm - dropping PSK support for TLS 1.3 seems to be leaving a bunch of
> implementations in the IoT space behind that are inching towards migration,
> currently.
> 
> How urgent is this? I can certainly massage the current YANG module, but (in
> theory) I am occupied by another SDO meeting this week.
> 
> Viele Grüße,
> 
> Henk
> 
> 
> On 15.06.21 13:36, tom petch wrote:
> > From: Kent Watsen <kent+ietf@watsen.net>
> > Sent: 14 June 2021 15:27
> > 
> > [CC-ing Henk, to whom a question is directed to below]
> > 
> > 
> > Hi Tom,
> > 
> > > Top posting a new and different issue.
> > 
> > Thanks for updating the subject line.
> > 
> > 
> > > server case psk references ServerKeyExchange and psk-identity-hint neither of which exist in TLS1.3.  The client sends an extension PreSharedKeyExtension which contains a list of identities from which the server selects one as selected-identity for which the identifier is uint16 indexing into the client's list. RFC8446 s.4.2.11.
> > > 
> > > The client description also needs amending.
> > > 
> > > TLS1.2 was extended to use tickets in this area to aid session resumption; these have now gone and been replaced by this extension.  I would not suggest adding support for tickets.
> > > 
> > > As I may have said before, TLS 1.3 is different.
> > 
> > Henk, could you help with these edits?   Support for PSK and raw public key were added to draft-ietf-netconf-tls-client-server per your request and, if memory serves me, didn’t you help me with the YANG update too?   I suppose what is needed is a either a “choice” statement (with cases for 1.2 and 1.3) *or* sibling-container statements (in case it’s necessary both are configured in case, e.g., the client sends one or the other)...
> > 
> > <tp>
> > Or else drop support for PSK with TLS1.3 at this time because too little is known about it outside the use for HTTP.  I am starting to see I-D about how to use TLS1.3 with application X, even for HTTP,  and I think that such an I-D will be needed for many applications with or without PSK.
> > 
> > Tom Petch
> > 
> > > Tom Petch
> > 
> > Kent
> > 
> 
> _______________________________________________
> netconf mailing list
> netconf@ietf.org
> https://www.ietf.org/mailman/listinfo/netconf

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <https://www.jacobs-university.de/>