Re: [netconf] Truststore: bags, sets, or other?

[Balázs Kovács <[e-mail]>]

Hi,

I agree that bag is an appropriate term in the certificate management or crypto-domain. So  +1 for that.

Br,
Balazs

-----Original Message-----
From: netconf <[e-mail]> On Behalf Of Kent Watsen
Sent: Monday, February 3, 2020 9:22 PM
To: Rob Wilton (rwilton) <[e-mail]>
Cc: Russ Housley <[e-mail]>; [e-mail]
Subject: Re: [netconf] Truststore: bags, sets, or other?

Searching online for “bag”, I found definitions vary (even amongst university CS sites) regarding if duplicates are allowed.  FWIW, this variation also exists in IETF RFCs, as CMS uses the ASN.1’s "SET OF” syntax (duplicates not allowed) whereas PKCS#12 uses ASN.1’s “SEQUENCE” syntax (duplicates allowed).  In any case, if duplicates are present, they have no impact on processing behavior (e.g., a certificate isn’t somehow more trusted if it appears more than once).

Of course, YANG only has ‘list’ and ‘leaf-list’ statements for collections.  So perfect mappings aren’t always possible.  As Martin noted in his message, the substring "set” is used in published modules (e.g., module-set).  Interestingly, lists generally allow for duplicates, but YANG lists don’t, due to being keyed, unless the scope is reduce to the non-key fields, e.g., assuming certificate ‘C’, both {key1, C} and {key2, C} could be in the Truststore at the same time.

I still feel that “bag” is the best term to use here due to it being a distinctive crypto-domain term used for set-like collections.  I’m assuming that this (using “bag”) is okay since no real objection has been voiced yet, but please let me know if that is a misunderstanding on my part.

Kent // contributor


> On Feb 3, 2020, at 9:51 AM, Rob Wilton (rwilton) <[e-mail]> wrote:
> 
> +1
> 
> This would also be my normal interpretation of a structure described as a "bag", although they don't seem to be that commonly used.
> 
> Thanks,
> Rob
> 
> 
> -----Original Message-----
> From: netconf <[e-mail]> On Behalf Of Schönwälder, 
> Jürgen
> Sent: 01 February 2020 08:09
> To: Kent Watsen <[e-mail]>
> Cc: Russ Housley <[e-mail]>; [e-mail]
> Subject: Re: [netconf] Truststore: bags, sets, or other?
> 
> A common interpretation in various data structure libraries is this:
> 
> set: unordered collection of something, duplicates not allowed
> bag: unordered collection of something, duplicates allowed
> 
> /js
> 
> On Fri, Jan 31, 2020 at 10:06:10PM +0000, Kent Watsen wrote:
>> Hi Martin,
>> 
>>>> NEW:
>>>>           +--rw <thing>-bags {<thing-feature>}?
>>>>              +--rw <thing>-bag* [name]
>>>>                 +--rw name string
>>>>                    +--rw <thing>* [name]
>>>>                       +--rw name string
>>>>                        …
>>>> 
>>>> Better, right?   Any other ideas?
>>> 
>>> We have current published modules with both "-list" and "-set".  No 
>>> "-bag" so far.
>>> 
>>> For example:
>>> 
>>> "list rule-list" in ietf-netconf-acm
>>> 
>>> "list module-set" in ietf-yang-library
>> 
>> True.
>> 
>> 
>>> There are some examples of "s" as well, but these are plural "s" for 
>>> a normal list of singletons, and should have been named w/o the 
>>> plural "s" (if we were to be consistent).
>>> 
>>> I would try to avoid "s" for a "list-of-lists", but then pick the 
>>> suffix that feels most natural in the domain.  (For example, rather 
>>> "list access-control-list" than "list access-control-set”).
>> 
>> Agreed.
>> 
>>> Perhaps you can argue that "-list" works better for ordered 
>>> sequences, and "-set" and "-bag" for unordered.  But then there are 
>>> "ordeded sets" and "unordered lists" (and even apparently "ordered 
>>> bag", in UML).
>> 
>> Perhaps.
>> 
>>> The plural "s" is better for a surrounding container (if one exists).
>> 
>> Agreed.
>> 
>> 
>> I also received a private response from Russ, who rather not join the netconf list, but said:
>> 
>> 1) “bag” was originally created to deal with issues with ASN.1 the SET and SEQUENCE types, and since have entered general crypto parlance outside the PKCS#12 context.
>> 
>> 2) “bag” is the ideal term for when conveying a unordered collection of X.509 certificates.
>> 
>> 3) “bag” is not known to be used in the context of SSH host keys or RPKs, but there isn’t anything wrong or bad with doing so either.
>> 
>> All said, I believe the best course is to use “bag” and, more specifically, to use the "/x-bags/x-bag/…” structure that is present at the top of this message.   Assuming there are no objections, this change will be in the next update.
>> 
>> 
>> Kent
>> 
> 
>> _______________________________________________
>> netconf mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/netconf
> 
> 
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
> Fax:   [phone]         <https://www.jacobs-university.de/>
> _______________________________________________
> netconf mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/netconf

_______________________________________________
netconf mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/netconf