Re: [Netconf] WGLC for draft-ietf-netconf-tls-04.txt

["David B Harrington" <[e-mail]>]

 

> The problem I have is why specify two cipher suites out of 
> the legion that are
> available.  One strong one must be present (BCP0061), why 
> specify another,
> unless there is a use case, an applicability, where it is likely to
be
> widespread or a markedly better choice.
> 
> My take has always been that TLS, PKI etc works well when the 
> server is large,
> powerful, central etc, capable of doing anything that the 
> IETF might suggest;
> and clients are workstations equipped with a human operator, 
> able to decide what
> to do about certificate error messages ('name does not match' 
> 'date is in the
> future' etc).  HTTP fits that well (what a surprise:-), 
> syslog does not (and is
> a simplex protocol to boot).  So fingerprints and syslog seem 
> like good
> bedfellows.
> 
> So with netconf, why mention PSK at all? Fingerprints I would 
> understand from
> parallels to syslog, PSK I do not.  And I suspect that the 
> user who goes to
> RFC4279 for enlightenment will be disappointed; fine RFC but 
> an explanation of
> applicability is not there, IMHO.

FYI, Fingerprints were added to syslog because TLS has been declared
the mandatory-to-implement transport, because UDP does not support
congestion control. TLS is not the mandatory-to-implement transport
for Netconf, so specific support of fingerprints is not needed for
Netconf for the reasons it is with syslog.

dbh

_______________________________________________
Netconf mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/netconf