Re: [netconf] Roman Danyliw's Discuss on draft-ietf-netconf-crypto-types-29: (with DISCUSS and COMMENT)

[Kent Watsen <[e-mail]>]

Hi Orie,

> On Feb 1, 2024, at 10:46 AM, Orie Steele <[e-mail]> wrote:
> 
> If it were possible to conform to one of the existing words, I think that
> would be preferable, but I don't know if that is achievable at this point.
> 
> I think explaining that "hidden" is used to describe keys that are "not
> exportable", and "not extractable", would be helpful, especially to readers
> who come with familiarity with those terms.
> 
> Modifying your suggestion from above:
> 
>             "A hidden key is not exportable, and not extractable,
>              and therefore, it is of type 'empty' as its value is
>              inaccessible via management interfaces.  Hidden keys
>              may be referenced by configuration to indicate which
>              key a server should use for a cryptographic operation.
>              How such keys are created is outside the scope of this
>              module.";
> 
> The reason would be for folks searching for those keywords, just as I
> searched for "hidden" in 800-57.

I used this text suggestion - thanks!


> OS

Kent


> 
> 
> On Thu, Feb 1, 2024 at 9:36 AM Kent Watsen <[e-mail]> wrote:
> 
>> Hi Orie,
>> 
>> Thanks for joining the conversation.
>> 
>> On Jan 31, 2024, at 12:50 PM, Orie Steele <[e-mail]>
>> wrote:
>> 
>> It sounds like "hidden" is being used as a substitute for "non
>> extractable" or "non exportable", through the use of software or hardware
>> isolation.
>> 
>> 
>> That characterization seems fair/accurate.
>> 
>> 
>> I searched
>> https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf
>> briefly, and could not find a better term.
>> 
>> 
>> Thank you for searching, I didn’t think to because the word seemed like
>> common English.
>> 
>> 
>> Web crypto and Android use the term "extractable"
>> 
>> - https://developer.mozilla.org/en-US/docs/Web/API/CryptoKey/extractable
>> -
>> https://developer.android.com/privacy-and-security/keystore#SecurityFeatures
>> 
>> Apple uses the term "exportable"
>> 
>> -
>> https://developer.apple.com/documentation/security/1643698-seckeycopyexternalrepresentation
>> 
>> 
>> Interesting, but we’d want the negated forms of these words, so maybe
>> inextricable or unexportable?
>> Yet neither of these seem as short or straightforward as “hidden” -
>> thoughts?
>> 
>> 
>> OS
>> 
>> 
>> Kent
>> 
>> 
>> 
>> On Wed, Jan 31, 2024 at 11:09 AM Kent Watsen <[e-mail]> wrote:
>> 
>>> Hi Roman,
>>> 
>>> Thank you for your valuable comments.
>>> Please see below for responses.
>>> 
>>> Kent
>>> 
>>> 
>>>> On Jan 29, 2024, at 6:07 PM, Roman Danyliw via Datatracker <
>>> [e-mail]> wrote:
>>>> 
>>>> Roman Danyliw has entered the following ballot position for
>>>> draft-ietf-netconf-crypto-types-29: Discuss
>>>> 
>>>> When responding, please keep the subject line intact and reply to all
>>>> email addresses included in the To and CC lines. (Feel free to cut this
>>>> introductory paragraph, however.)
>>>> 
>>>> 
>>>> Please refer to
>>> https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/
>>>> for more information about how to handle DISCUSS and COMMENT positions