Re: [Netconf] rfc5539bis > - NC over TLS with mutual X.509 authentication

[Kent Watsen <[e-mail]>]

>>I think that limiting this I-D to mutual X.509 authentication resolves
>>the issues that have been raised.
>
>+1

I also +1 to limiting 5539bis to just mutual X.509 auth.  That said, I
thought that this was already the case, or at least the intent, with all
the references to RFCs 5280 and 6125 and what not.




>Also, included below is the following new proposed text for Section 2.4.1,
>and a new section 2.4.2.  The new section 2.4.2 would displace the
>existing 
>section 2.4.2 to have 2.4.3, and so on.  Thoughts on this?

I'm not sure if adding more sections or more words is needed - maybe this
is a case where less is more?   Maybe we *only* need to 1) state that
server authentication MUST be via PKIX as defined in RFCs 5280 and 6125
and 2) state anything not already covered by RFCs 5280 and 6125.




Also, I noticed that you didn't touch the original section 2.4.2. (Client
Identity).   This is the section that is currently missing a statements
along the lines of:
  - the client MUST present a X.509 certificate
  - the client MAY also present a chain of intermediate certs to a trust
anchor the server is expected to trust
  - the server MUST authenticate the client's certificate
  - the server MAY authenticate the client's certificate using PKIX to a
configured trust anchor
  - the server MAY authenticate the client's certificate if it's an exact
match to a previously trusted client certificate.


Also, I think the last two paragraphs in 2.4.2 should be moved to 2.4.3
(group everything about usernames to one section) and the add a statement
to 2.4.3 like:
  - the server MUST have a configurable mapping from the presented client
certificate to the NETCONF username, such as the cert-to-name algorithm
defined in section 4.1 of draft-ietf-netmod-snmp-cfg-08



Thanks,
Kent