Re: [netconf] ietf crypto types - permanently hidden

[Kent Watsen <[e-mail]>]

Correct, as I didn’t think there was consensus yet.  Perhaps there is rough-consensus, and it may be that the only way to gauge that is to try and see how much push back there is.

Okay, so how about this, based on this thread, there appears to be support to add a flag to control if a key should be “permanently hidden” or not, in which case configuration is created.

This change will be in the next update, in about a week’s time, if no objections are raised.

Kent // contributor


> On Apr 30, 2019, at 7:30 AM, Balázs Kovács <[e-mail]> wrote:
> 
> Hi Kent,
>  
> I don’t see the your proposal below addressed in latest update  (keystore-09). Was it missed?
>  
> My recommendation is to modify the "generate/install-hidden-key"
> (renamed to just "generate/install-key") actions to have a flag indicating if
> the key should be "permanently hidden" (perhaps by using a TPM) or not, in
> which case configuration is created, same as if the client had used <edit-
> config>, but without needing to touch the key.
> 
> 
> I agree that having a flag to control the behavior is useful and I
> think there should be explicit text how the action fails in case the
> requested action cannot be performed.
>  
> Br,
> Balazs