Re: [netconf] IANA templates for algorithms

[Kent Watsen <[e-mail]>]

Hi Rich,


>>   Neither of these registries help us, at least not directly.  Yes, they provide enumerations for on-the-wire protocol values, but they fail to provide an enumeration for, e.g., a 2048-bit RSA key.
> 
> Yes, RSA size is not relevant to the protocols.

Not to TLS, but I think that size may be relevant to SSH.  For instance, RFC 4432 defines both "rsa1024-sha” and "rsa2048-sha256”.   But these enumerations are for ciphers (i.e., more than we need/want to generate a key).

FWIW, `ssh-keygen` has the “-b bits” parameter and `openssl genrsa` has the “[numbits]” parameter.   The SSH/TLS protocols don’t define how the keys are created (it's out-of-scope to those drafts), hence why their registries don’t need to define enumerations for the base algorithms.

Of course, it is our goal to enable the configuration/generation of the keys themselves; effectively mimicking the CLI commands


>>       2) engage an "expert reviewer" to see if any of the new entries
>            regard an undefined algorithm and, if so, a TBD process is
>            used to add the new algorithms to the appropriate YANG
>            module (e.g., iana-symmetric-algorithms), which would be
>            automatically published by IANA.
> 
> By undefined, you mean "unknown to YANG" I assume, and not "a new crypto alg not previously used in TLS (for example).”

Yes, unknown to the YANG modules that we’re trying to define, but also unknown to the TBD “base algorithms” registry mentioned in (2a) below.


>>     2a) update some new TBD registry (e.g., “base algorithms”).
>            This would need to be done by a crypto expert (not the
>            NETCONF WG or YANG Doctors).  Good candidates might
>            be the Security ADs or, perhaps better, the WG that published
>            the source RFC.
> 
> I don't know if the sec folks would be interested in this but I could be wrong.  It might be good to have a brief chat F2F in Vancouver, which I can help set up.

That would be great!  FWIW, I’m on good terms with Ben Kaduk, Sean Turner, and Russ Housley, but maybe you were thinking SecDir?  Would it be good prepare something (e.g., slides) to help explain it?  IDK, it seems easy enough to just talk to, but that’s just my POV.

Regading “interest", do you mean in terms of a) acknowledging it’s a problem, b) supporting the creation of a registry, c) participating in the creation of the registry, or d) maintaining the registry (the expert reviews)?   The minimal would be (a+b), so our attempt to do (c) isn’t torpedoed by SecDir/IESG.  For (d), it would be best if they could assign an expert reviewer (perhaps SecDir), as the prospect of (presumably) just me doing it doesn’t seem right...

Kent // contributor