Re: [Rats] Pull request for the charra YANG model

["Bill Sulzen (bsulzen)" <[e-mail]>]

Eric,

 

Regarding your issue:

 

*	Most devices do not have multiple line cards. Because of that, we
should not have nested keys of [node id] [tpm name]. This adds unnecessary
complexity for the vast majority of users. Instead the tpm should have a
mandatory leafref back to node-id when compute-nodes is not null.

as I read the updated attestation tree, there still is support for multiple
TPMs in a given management plane (i.e. there's still support for multiple
linecards - AKA "composite systems.") But if a given linecard/node within a
management plane entity, then they would have to be differentiated by
tpm-name rather than by node-id. Is that correct?

 

Thanks,

Bill

 

From: Eric Voit (evoit) 
Sent: Wednesday, June 10, 2020 12:18 PM
To: [e-mail]; [e-mail];
Shwetha Bhandari (shwethab) <[e-mail]>; Bill Sulzen (bsulzen)
<[e-mail]>; [e-mail]; [e-mail]; Guy
Fedorkow <[e-mail]>
Cc: [e-mail]
Subject: Pull request for the charra YANG model

 

Henk,         Michael,

Shwetha,   Bill,

Frank,        Tom,

Guy,

 

As authors of the Charra YANG model, I wanted to let you know I have created
a pull request
<https://github.com/ietf-rats-wg/basic-yang-module/pull/8/files> .  I am
proposing some fixes due to a number of concerns
<https://github.com/ietf-rats-wg/basic-yang-module/issues/6>  I had about
the YANG model:

 

*	PCR numbers should be their own type, not a UINT8. PCRs should be
limited to [0..31]
*	We should use ENUMs instead of strings for TCG and IETF crypto
algorithm types. Strings allow lots of errors to be introduced which we can
protect using a larger, more detailed ENUM construct.
*	Most devices do not have multiple line cards. Because of that, we
should not have nested keys of [node id] [tpm name]. This adds unnecessary
complexity for the vast majority of users. Instead the tpm should have a
mandatory leafref back to node-id when compute-nodes is not null.
*	The YANG doctors will not let us have a TPM-Name of "ALL". Instead
of "ALL" we should be able to assume that an RPC means all hardware based
TPMs if a specific TPM is not named in the RPC. 
*	We should add leaf for a unique 'certificate-name' is used. This
allows for a cleaner certificate migration path, and most RPC users won't
need to track node-ids. 
*	We should have optional YANG features for TPM1.2 and TPM2.0 so that
RPCs are not exposed when there are no such TPMs of that type are supported.
*	We should create new reusable groupings rather than repeat
definitions. 

If your guys have suggestions and improvements for this pull request, that
would be great.   I also think the netequip boot pull request
<https://github.com/ietf-rats-wg/basic-yang-module/pull/5>  can also be
integrated.

 

Thanks,

Eric