Re: [yang-doctors] [Netconf] last call review of draft-ietf-netconf-keystore-02

[Kent Watsen <[e-mail]>]

Hi Tom,


> Mostly yes.
>
> I think the one further change that I would like is to move away from
>   o  An unordered list of pinned SSH host key sets...
>
> I think that the scope should be a public key, not limited to SSH and
> not restricted to what is referred to as  a host key.  Typically this
> would be in a client enabling it to trust a server to establish a secure
> channel which may then be used for further authentication.  I see this
> as far more common than SSH.

Agreed.

> And since the scope is asymmetric cryptography, I would state the
>obvious in the Abstract
>
> This document defines a YANG module for a system-level mechanism,
> called a "keystore", containing security-sensitive data including
> private keys, pinned certificates, and public keys, such as pinned SSH
> host-keys, for use in asymmetric cryptography.

You're touching a point similar to what that Juergen raised.  I think
the solution here is to refactor the ietf-keystore module into a base
module, which doesn't mention anything protocol-specific, and augmenting
modules that are protocol specific.  If this were done, then the
abstract might read:

   This document defines a YANG module for a system-level mechanism,
   called a "keystore", containing security-sensitive data, such as
   asymmetric private keys.  This document defines additional modules
   that augment the base keystore module adding support for X.509
   and SSH.

What do you think?

Kent