Re: [Netconf] Adoption poll for crypto-types and trust-anchors

[Kent Watsen <[e-mail]>]

[good grief, I just found this email didn't get sent before.  it's a little outdated now, as the drafts were published yesterday, but better late than never, right?]

Hi Balazs, no worries!   <Kent2> below.   /kw


On 5/24/18, 3:36 AM, "Balázs Kovács" <[e-mail]<mailto:[e-mail]>> wrote:

Hi Kent,

I did not respond to your answers. Sorry for the delay.
Please see below.
Br,
Balazs


From: Kent Watsen <[e-mail]>
Sent: Monday, May 14, 2018 7:31 PM
To: Balázs Kovács <[e-mail]>; [e-mail]
Subject: Re: [Netconf] Adoption poll for crypto-types and trust-anchors

Hi Balazs,

Please see <Kent> below.


On 5/14/18, 4:50 AM, "Balázs Kovács" <[e-mail]<mailto:[e-mail]>> wrote:

Hi Kent,


Couldn’t you use the existing ‘private-key-grouping’ and  ‘certificate-grouping’ which were in draft-ietf-netconf-keystore-04 instead of this new ‘asymmetric-key-grouping’? Is there any drawback with that? I think it looked better than with having this new certificate feature within the grouping. They also contained some actions that you missed now.



<Kent> As for drawbacks, having the two separate groupings makes them, well, less connected.  I thought that it might be good to bring them together.  That said, so long as the keystore container exists (assuming we bring it back), the consumer doesn't care if it used one or two groupings.  I'm open to discussing this more.  Also, the action statements were only left out to keep things easier to scan, the final module would still have them.



Balazs> How global is a feature statement?



<Kent2> Features are very global; the server either implements the defining module or not.  This can be seen by looking at YANG grammar, where the feature statement can only occur as a descendent to the module or submodule statements and, in particular, cannot appear in anything like a grouping statement.  I think that we should define a grouping that includes



Balazs> SSH implementations might only have private/public key support, but TLS with certificates within same running device. I would still like it to be possible to express certificates for TLS, but keys only for SSH.



<Kent2> I think what we should do let the keystore draft's "asymmetric-key" grouping definition contain the certificates, but then have the ssh client/server draft augment in a feature statement "ssh-x509-certs"





The keystore container looks good to me if it was using ‘private-key-grouping’ and  ‘certificate-grouping’. I assume the trust anchors would be fully separated from this?



<Kent> great, it's good to get a positive confirmation on the keystore container.  Regarding if trust-anchors would be kept separate (assuming we bring the keystore container back), that is a good question.  On one hand, I like the modularity of keeping them separate but, on the other hand, we may want them together so that a) any protection mechanism used to keep the private keys safe could also be used to ensure that the trust-anchors are immutable and b) the certificate-expiration notification could apply to both.   I don't feel strongly about (a), and it seems that a separate trust-anchors could also be protected.   (b) would be nice, though the same notification could be defined in both modules with no loss of functionality.  Thoughts?



Balazs> I tend to lean toward separate modules for keystore and trust anchors, but don’t have a concrete preference.



<Kent2> this is the plan.





Regarding the new ‘local-or-external-asymmetric-key-grouping’, after checking with Balazs L. here, we would suggest that 1) the choice is mandatory 2) the cases are in features, thus an implementation must implement at least one of the cases, and can decide to go for local or external keystore. Regarding the naming, since the external is deliberately pointing out keystore usage, should the grouping be called ‘local-or-keystore-asymmetric-key-grouping’?


<Kent> yes, mandatory true and feature statements would round it out the grouping nicely.  Good suggestion on the naming too.

Balazs> Great.

Kent // contributor



Br,

Balazs





From: Kent Watsen [mailto:[e-mail]]
Sent: Friday, May 11, 2018 4:10 PM
To: Balázs Kovács <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
Subject: Re: [Netconf] Adoption poll for crypto-types and trust-anchors

Hi Balazs,

Good point.  Perhaps we could have something like:


grouping asymmetric-key-grouping {
  leaf algorithm { … }
  leaf private-key { … }
  leaf public-key { … }
  container certificates {
    if-feature certificates;
    list certificate {
      key name;
      leaf name { type string; }
      leaf cert { type ct:x509 }
    }
  }
}

container keystore {
  container keys {
    list key {
      key name;
      leaf name { type string; }
      uses asymmetric-key-grouping;
    }
  }
}

grouping local-or-external-asymmetric-key-grouping {
  choice local-or-external {
    case local {
      uses asymmetric-key-grouping;
    }
    case external {
      leaf reference {
        type leafref {
          path "/keystore/keys/key/name";
      }
  }
}

And then downstream modules can choose to which of the two groupings to use.   Thoughts?

Kent


On 5/11/18, 3:40 AM, "Balázs Kovács" <[e-mail]<mailto:[e-mail]>> wrote:

Hi Kent,

Some comments for 2):

I think it all boils down to how the operator defines an identity. If an identity is a protocol, then there would be separate keys for each, if an identity is a group of protocols, then they use the same key. In the end it could be just the device operating a collection of protocols defined as identity. I think the model cannot really restrict how an identity is defined, but it can certainly make it harder or easier to reach the desired configuration. For example, even with the latest version of the keystore draft with the grouping, I can copy the same binary data (the private key) over to all protocols implementing the grouping. However, I would prefer to not configure it by copying binary data, but rather configuring it once and then just set the leafrefs properly. So my take would be that ietf-keystore should support using the same key from multiple protocols, and support separate keys for each protocol too.

Br,
Balazs

From: Kent Watsen [mailto:[e-mail]]
Sent: Monday, May 07, 2018 5:58 PM
To: Balázs Kovács <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
Subject: Re: [Netconf] Adoption poll for crypto-types and trust-anchors

Hi Balazs,

Regarding your two concerns:

1) you're right about that, if added later, it may not be widely implemented.  Back to the technical discussion, some important points have been raised.  Perhaps it is better after all to keep ietf-keystore, the -03 version, before the private key was converted to being a grouping.  Right now, the adoption poll is showing weak support, and this seems to be the core issue.  Hearing from others on this point would be very helpful!

2) There is a difference, the trust anchors can be a large list that sharable by many modules.  For instance, an admin wouldn't want to configure the same set of trust anchors once for RESTCONF and again for NETCONF.  However, private keys are generally application-specific, each having their own.  Sometimes more than one app might share a private key (e.g., /etc/ssl/private/), but this isn't very common.  Maybe the question isn't how common it is, but if it MUST be supported.  For instance, I know that many services (HTTPS, POPS, IMAPS, anything with `stunnel`, etc.) can all be configured to use the same private key.  MUST ietf-tls-server be able to support this?

Kent // contributor


On 5/7/18, 9:47 AM, "Balázs Kovács" <[e-mail]<mailto:[e-mail]>> wrote:

Hi Kent,

I believe between SSH/TLS implementations using keys in clear and a persistent storage there has to be some protection layer for the keys, and keystore did a good job representing the management aspects of this layer. Obviously, this layer is possible to get implemented without a keystore model, but then I think the user side of the keys (e.g., Netconf/Restconf) have to be flexible enough to handle keys locally or refer to central point of management (if anyone would implement that in addition).

Regarding your example with TPM, if considering the most simplistic case, wouldn’t referencing a TPM key be adequate just through presenting the public key value? I guess that could be done without a keystore, and at least is shown that a key is operational for the user-side protocol.

To sum up, I have the following concerns:

-          Centralized management of keys/identity certificates/credentials as standard was appealing to us and we would still prefer it; however, we would be probably ok to have it as future work, if you prefer that. The user side of the keys (e.g., Netconf/Restconf) should be flexible enough to handle keys as both referenced and local data (for example, choice with only one standard case?).
-          I don’t understand the idea behind keeping the trust anchors in central model versus the keys in local model. What is the rationale behind this split?

Best Regards,
Balazs

From: Netconf [mailto:[e-mail]] On Behalf Of Kent Watsen
Sent: Friday, May 04, 2018 8:41 PM
To: [e-mail]<mailto:[e-mail]>
Subject: Re: [Netconf] Adoption poll for crypto-types and trust-anchors

Following up on this, I did think of a way enable configuration to specify, e.g., which DevID cert to use for a factory-defined private key.  The idea is to change the private-key grouping to reference certificates from the "trust-anchors" data tree (as opposed to locally-storing the certificates).  A 'union' or a 'choice' may allow for both options.

What I don't like about this proposal is that it is conceptually muddies what is a "trust anchor".  Currently, trust anchors are exclusively used to authenticate remote devices, whereas the DevID certificates are more about how the device authenticates itself to remote devices; furthermore, DeviD certs are the end-entity half of the certificate-chain (not the issuer-half).  Yes, in both cases, the partial chain is manifested as one or more X.509 certificates, and thus syntactically the same, but it still doesn't seem right to call them "trust anchors".

Perhaps we could define some other top-level data-tree for "identity certificates", which could include both a private key and its associated certificates.  This would be the "future TBD thing" mentioned below.   I can see this working, but is it any better to have separate "trust-anchors" and "identity certificates" trees, or a single "keystore" tree that contains both?   One benefit to having a single keystore module is that then the "certificate-expiration" notification has more value, applying to both identity and trust anchor cert, as it's good to know when either types of certificate is expiring.

Kent // contributer


On 5/3/18, 12:58 PM, "Netconf on behalf of Kent Watsen" <[e-mail]<mailto:[e-mail]> on behalf of [e-mail]<mailto:[e-mail]>> wrote:

Hi Balazs, and Balazs,

Thanks for permission to forward this thread to the list.  All, please be sure to read the message below too.

Yes, I'm aware and familiar with various key protection strategies.  The current ietf-keystore module was modeled after MacOS's "keychain access", but it didn't define a protection layer (e.g., internally encrypted and with an access-controlled API), though one could be added later.  The keystore module is very much in-line with what you write and, for that, I think it counts as a "no/do not support" of sorts.

The reason why we're proposing to move away from the keystore module was prompted by Juergen, who questioned if any implementations of SSH or TLS use a KMS and are we creating unnecessary complexity.  As it stands, the current proposal still has SSH/TLS implementations referencing a global "trust-anchors" store, so there is still "complexity", at least in terms of there being a dependency.

The current proposal moves the storage of private keys from being in a centralized keystore (where they can be leafref-ed) to each instance of a ssh/tls client/server.  By doing so, we think that it is less complexity, though I'm not convinced, since the definition of the private key itself is the same, it's just now not leafref-ed.  Perhaps this is an incremental step, whereby we next abandon using the private-key groupings altogether for SSH-specific and TLS-specific variants.  This is very possibly needed, and I might add that no one has implemented any of these modules, AFAIAA.

Adding to this discussion, I was yesterday wondering, with the two new drafts, how a client would configure a server to use a TPM-protected private key and its associated IDevID certificate.  Note that this key and cert are "configured" by the manufacturer and thus, somehow, must be *referenced* (not stored locally) by the ssh/tls client/server modules.   I was able to find a way to reference the private key (via its public key), but I was never able to figure out how to reference the DevID cert (IDevID or LDevID?).    I was thinking that, if we don't go back to using the keystore module, we might be able to modify the private-key grouping definition to enable it to either be locally stored  or be a reference to some future TBD thing.  I haven't tried to do this yet, but being able to do this seems important, and therefore may sway my support for disbanding the keystore module/draft…

Kent // contributor


On 5/3/18, 7:08 AM, "Balazs Lengyel" <[e-mail]<mailto:[e-mail]>> wrote:


Hello Kent,
I would like to add that in Ericsson the preferred solution is central storage for keys. It makes administration and enforcement of good security practices simpler for the operator.
regards Balazs Lengyel
(Feel free to forward this to the list.)

-------- Forwarded Message --------
Subject:

FW: [Netconf] Adoption poll for crypto-types and trust-anchors

Date:

Thu, 3 May 2018 11:15:57 +0200

From:

Balázs Kovács <[e-mail]><mailto:[e-mail]>

To:

Balázs Lengyel <[e-mail]><mailto:[e-mail]>



Bocs, bcc lemaradt



-----Original Message-----

From: Balázs Kovács

Sent: Thursday, May 03, 2018 11:16 AM

To: Kent Watsen <[e-mail]><mailto:[e-mail]>

Subject: RE: [Netconf] Adoption poll for crypto-types and trust-anchors



Hi Kent,



I know you might prefer me sending this to the list, but I try this way first. I was a bit away from keystore works and did a quick check. I see you have the below poll ongoing, and I've seen the presentation you had in London.



I must say it was a bit surprising to me backing out from centralized keystore model and the statement of centralized keystore being uncommon. Storage of keys is a security sensitive and problematic area. Secret keys at rest usually need to be encrypted. The provisioning or storage of secret encryption keys, the secure storage, and rotation of keys are a complicated enough matter so that it justifies centralized key store implementations. There are centralized key management systems such as Hashicorp Vault, Azure Key Vault, Google Cloud KMS, OpenStack Barbican, etc.. that solve the above matters. These SW can be used by an implementation to outsource the key management issues, and even if it is outsourced, outsourcing from a central implementation does give benefit since the client usually also needs some client credential that is access controlled on KMS server side.



The other aspect I saw as benefit in centralized keystore was on the YANG interface side. As long as only machines are assumed to operate on these IETF modules, I assume distributed management of keys doesn't matter much, but when it starts to drive human interfaces directly then the configurations of protocols that import and use these security groupings become quite complex. Ok for this one you still have the trust anchors, but for keys the central model was dismissed, but for management aspect, I really don't see why is the difference.



Can you clarify? Have you considered KMS implementations when making this proposal of removing keystore?



Br,

Balazs



-----Original Message-----

From: Netconf [mailto:[e-mail]] On Behalf Of Kent Watsen

Sent: Tuesday, May 01, 2018 11:57 PM

To: [e-mail]<mailto:[e-mail]>

Subject: Re: [Netconf] Adoption poll for crypto-types and trust-anchors





[I'll get the ball rolling, please, others chime in too]



I support the adoption of these two drafts to replace the existing keystore draft.



Regarding the "certificate-expiration" notification defined in ietf-crypto-types, I would like to discuss removing it, or moving it to be a descendent of the "certificates-grouping" grouping (also in ietf-crypto-types) and maybe also place a copy of the notification in the ietf-trust-anchors module.  That said, I don't like having several otherwise identical notifications in different namespaces, but I do like how the server can incrementally add support for expirations on a feature-by-feature basis.



Kent // contributor





===== original message =====



This is the start of a *two* week poll for adopting the following two drafts as working group documents, specifically to replace draft-ietf-netconf-keystore, which would be removed as a working group document:



  draft-kwatsen-netconf-crypto-types-00

  draft-kwatsen-netconf-trust-anchors-00



This call for adoption is the result of the Keystore draft presentation given in London.  When the various options were discussed, most preferred to move forward with these two drafts, as opposed to looking to do more factoring or extending to scope to include things not needed by our various client/server drafts.  No one expressed interest in moving forward with draft-ietf-netconf-keystore.  While we could separately confirm this result again on the list, we believe that an adoption call more efficiently achieves two goals at once.



Please send email to the list indicating "yes/support" or "no/do not support".  If indicating no, please state your reservations with the document.  If yes, please also feel free to provide comments you'd like to see addressed once the document is a WG document.



Kent (and Mahesh and Ignas)









_______________________________________________

Netconf mailing list

[e-mail]<mailto:[e-mail]>

https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_netconf&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=qXS002RrOOkzqTDm70cWjg7eJeWqtpC_anWUcc9a_3I&s=1W689R8ht-U3FoffJ5uTT24SAPRtiQ9a9B3VxQxM_Wg&e=





_______________________________________________

Netconf mailing list

[e-mail]<mailto:[e-mail]>

https://www.ietf.org/mailman/listinfo/netconf<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_netconf&d=DwMD-g&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=dy-Dg3ToTuGVBuY3XcOLDkV_tW3vuQDSz6i1wawzjjM&s=4zwr17et_2w1it4jlw_k1ksQ-q-v7_iTSKUI4E_yK4g&e=>

--

Balazs Lengyel                       Ericsson Hungary Ltd.

Senior Specialist

Mobile: [phone]              email: [e-mail]<mailto:[e-mail]>