Re: [netconf] crypto-types fallback strategy

[Kent Watsen <[e-mail]>]

The authors are looking for clear direction for the next update to the draft(s).

From the gist of the discussion, the punch list appears to be:

- revert back to using identities, as they were in the -08 revision.
- only define base identities for what's needed immediately for TLS and SSH and keystore key-encryption.
- define these base identities in distinct YANG modules
- have each identity's description statement indicate what the binary key data is encoded.

A bit separate from the above, but still in mind:

  - specify that all TLS public-keys are a DER-encoded SubjectPublicKeyInfo structure
  - specify that all SSH public-keys are a "ssh-public-key-type" type (see below)
  - specify that all encrypted symmetric keys are a DER-encoded OneSymmetricKey structure
  - specify that all encrypted asymmetric keys are a DER-encoded OneAsymmetricKey structure

The "ssh-public-key" type would be defined as:

     typedef ssh-public-key-type {
         type binary;
         mandatory true;
         description
           "The binary public key data for this SSH key, as
            specified by RFC 4253, Section 6.6, i.e.:

              string    certificate or public key format
                        identifier
              byte[n]   key/certificate data.";
         reference
           "RFC 4253: The Secure Shell (SSH) Transport
                      Layer Protocol";
          }

Any concerns?

Kent // author