Re: [Rift] Initial implementation of security in RIFT-Python is complete

Looks good, will do the same or similar for RIFT-Python.

(The interop test no longer requires that the YAML schemas are the same.)

What is the difference between “permissive”, “loose”, and “strict”?

— Bruno

> On Apr 25, 2019, at 11:15 PM, Tony Przygienda <tonysietf@gmail.com> wrote:
> 
> Ok, I looked over the stuff in more detail again and I see that the yaml schema is only a limited security model and would hence like to extend it a bit. Let me know what you think
> 
> At the top I'd like to add private-secret to support private/public key and not only shared 
> 
> {?} keys:                              
>     {+} - id: <24-bit key number>
>     {1}   algorithm: [hmac-sha-256]
>     {1}   secret: <string>   
>     {?}   private-secret: <string>     
> 
> under -name (i.e. per node) it would be good to have 
> {?}      tie_validation: [none|permissive|loose|strict]  
> 
> 
> to support testing of the common models of processing of signatures 
> 
> Then under interface we'd need 
> 
> {?}           active_key: <8-bit key number> 
> {?}           accept_keys: <set of 8-bit key number>
> {?}           lie_validation: [none|permissive|loose|strict]  (6) 
> 
> so we can test mix of interfaces using different keys and not using them ta all (we can share the global keys for that purpose since it's simpler but can only use the 8-bit IDs) 
> 
> --- tony
> 
> On Wed, Apr 24, 2019 at 10:47 AM Antoni Przygienda <prz=40juniper.net@dmarc.ietf.org <mailto:40juniper.net@dmarc.ietf.org>> wrote:
> read your guide in detail. makes all perfect sense. will extend schema to what you suggest so inter'op ... 
> 
> thanks
> 
> --- tony 
> 
> From: Bruno Rijsman <brunorijsman@gmail.com <mailto:brunorijsman@gmail.com>>
> Sent: Monday, April 22, 2019 4:16 PM
> To: rift@ietf.org <mailto:rift@ietf.org>
> Subject: Initial implementation of security in RIFT-Python is complete
>  
> I have finished the initial implementation of security in RIFT-Python (security envelope, keys, fingerprints, nonces, packet-nr, etc. etc.)
> 
> See http://bit.ly/rift-python-security-feature-guide <https://urldefense.proofpoint.com/v2/url?u=http-3A__bit.ly_rift-2Dpython-2Dsecurity-2Dfeature-2Dguide&d=DwMCAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=maKXfKzgRTpiLitqHnJiww&m=htkOLD_Mz6ekfr_iYDTC5Q7xzPbroaycphOlQuwgDAg&s=t-P4E1fGgdJ6fiTwi2uXPbhcMxKse2r47pppAq8EO_I&e=> for a detailed feature guide.
> 
> While implementing the code, I gathered a number of comments on the security section of the draft -05. I will report these in a follow-up e-mail.
> 
> -- Bruno
> _______________________________________________
> RIFT mailing list
> RIFT@ietf.org <mailto:RIFT@ietf.org>
> https://www.ietf.org/mailman/listinfo/rift <https://www.ietf.org/mailman/listinfo/rift>