Subject: Re: [Netconf] mbj review of draft-ietf-netconf-restconf-server-model-09

From: "Acee Lindem (acee)" <[email-masked]>
Date: Mon, 18 Apr 2016 17:25:46 +0000

Hi Kent, 
I did follow up on this. The reason for “key-chain” in the model name is
that “keychain” is not a well-known compound word. Additionally, Cisco
OSs, use “key chain” and Ericsson uses “key-chain”. I’d be interested in
other thoughts on this.

I did get some negative feedback with respect to adding “routing-“ to the
model name since key chains are used for other non-routing applications as
well. What are your thoughts on this given that you now see the ubiquitous
usage of key chains across vendors?

Thanks,
Acee

On 4/18/16, 12:54 PM, "Kent Watsen" <[email-masked]> wrote:

>
>I discussed this naming issue with Acee (CC-ed) in the hallway at BA.  He
>said that he used "key-chain" because that is what Cisco/Redback CLI
>uses.  We then searched on "juniper key-chain" and found that JUNOS uses
>"keychain".  I'm not sure if a more exhaustive search has been made.
>
>I think the netconf draft should stick with "keychain" for now.  I'd like
>to see some discussion in the routing area if they might be better off
>using "keychain"...
>
>Kent
>
>
>
>
>
>
>On 4/8/16, 12:12 PM, "t.petch" <[email-masked]> wrote:
>
>>----- Original Message -----
>>From: "Kent Watsen" <[email-masked]>
>>To: "Martin Bjorklund" <[email-masked]>; <[email-masked]>
>>Sent: Thursday, April 07, 2016 4:15 AM
>>
>>>
>>> Hi Martin,
>>>
>>> Thank you for your review.  Below are my responses:
>>>
>>
>><snip>
>>
>>>
>>> >o  Section 5
>>> >
>>> >  ietf-system-keychain vs. ietf-routing-key-chain
>>> >
>>> >  Is it "keychain" or "key-chain"?
>>>
>>> I've never seen "key-chain" before.  Many OSs (e.g., mac, linux,
>>openbsd, freebsd) have a utility called "keychain".
>>>
>>
>>Kent
>>
>>The IETF is riddled with them e.g.
>>
>>"   The key-chain YANG model groups several keys into a single key
>>chain."
>>
>>in draft-chen-rtgwg-key-table-yang along with 16 other YANG I-Ds that I
>>have seen lately, containing snippets such as
>>
>>     container key-chains {
>>       list key-chain-list {
>>         key "name";
>>         description
>>           "List of key-chains.";
>>         uses key-chain;
>>
>>I think that there should be a consistent spelling across the IETF.
>>
>>Tom Petch
>>
>>
>>
>>
>>
>>>
>>>
>>> >o  General remark.
>>> >
>>> >  Unless it is too much of a burden, I think it would make sense to
>>> >  move the generic tls and ssh grouping models (and keychain) into a
>>> >  separate draft.   It might also be useful with corresponding
>>> >  groupings for ssh/tls clients (which you almost already have).
>>>
>>> This will be discussed in tomorrow's meeting
>>>
>>>
>>> Thanks,
>>> Kent
>>> >
>>> _______________________________________________
>>> Netconf mailing list
>>> [email-masked]
>>> https://www.ietf.org/mailman/listinfo/netconf
>>

---

From: Mahesh Jethanandani <[email-masked]>
Date: Mon, 18 Apr 2016 13:43:35 -0700

> On Apr 18, 2016, at 10:25 AM, Acee Lindem (acee) <[email-masked]> wrote:
> 
> well. 

One of those non-routing protocols is BFD. I am fine if the model is called protocol-key-chain, but I wonder what happens the next entity needing key-chain is not a protocol.

The bigger question in my mind is, are these really different types of key-chains models, or are we talking about one key-chain model?

Mahesh Jethanandani
[email-masked]

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Mon, 18 Apr 2016 22:04:54 +0000

From: Mahesh Jethanandani <[email-masked]<mailto:[email-masked]>>
Date: Monday, April 18, 2016 at 4:43 PM
To: Acee Lindem <[email-masked]<mailto:[email-masked]>>
Cc: Kent Watsen <[email-masked]<mailto:[email-masked]>>, Tom Petch <[email-masked]<mailto:[email-masked]>>, Martin Bjorklund <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Routing WG <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [Netconf] mbj review of draft-ietf-netconf-restconf-server-model-09

On Apr 18, 2016, at 10:25 AM, Acee Lindem (acee) <[email-masked]<mailto:[email-masked]>> wrote:

The rtgwg key chain model is the one we all know and love associated with the graceful rollover of configurable keys. The netconf model is list of certificates for a public key. Please look at the information content of the two models. I hope I don’t have to answer this question again ;^)

Acee

Mahesh Jethanandani
[email-masked]<mailto:[email-masked]>

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Sat, 30 Apr 2016 18:40:12 +0000

So hopefully we’ve put the issue of combining the module to bed for good… If look at the date nodes for these two models, it is patently clear that these serve two different purposes.

What about the naming issue? I got a comment that I should take “routing-“ back out due to the fact that this is what that these key-chains can be used for many non-routing purposes. For example, BFD - http://www.juniper.net/documentation/en_US/junos14.2/topics/reference/configuration-statement/key-chain-edit-security-authentication-key-chains.html

Thanks,
Acee

From: rtgwg <[email-masked]<mailto:[email-masked]>> on behalf of Acee Lindem <[email-masked]<mailto:[email-masked]>>
Date: Monday, April 18, 2016 at 6:04 PM
To: Mahesh Jethanandani <[email-masked]<mailto:[email-masked]>>
Cc: Martin Bjorklund <[email-masked]<mailto:[email-masked]>>, Tom Petch <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Routing WG <[email-masked]<mailto:[email-masked]>>
Subject: Re: [Netconf] mbj review of draft-ietf-netconf-restconf-server-model-09

Acee

Mahesh Jethanandani

---

From: Mahesh Jethanandani <[email-masked]>
Date: Sat, 30 Apr 2016 15:10:38 -0700

That or we could also rename it to protocol-key-chain to disambiguate it
from system-key-chain.

On Sat, Apr 30, 2016 at 11:40 AM, Acee Lindem (acee) <[email-masked]> wrote:

> So hopefully we’ve put the issue of combining the module to bed for good…
> If look at the date nodes for these two models, it is patently clear that
> these serve two different purposes.
>
> What about the naming issue? I got a comment that I should take “routing-“
> back out due to the fact that this is what that these key-chains can be
> used for many non-routing purposes. For example, BFD -
> http://www.juniper.net/documentation/en_US/junos14.2/topics/reference/configuration-statement/key-chain-edit-security-authentication-key-chains.html
>
> Thanks,
> Acee
>
> From: rtgwg <[email-masked]> on behalf of Acee Lindem <
> [email-masked]>
> To: Mahesh Jethanandani <[email-masked]>
> Cc: Martin Bjorklund <[email-masked]>, Tom Petch <[email-masked]>, "
> [email-masked]" <[email-masked]>, "[email-masked]"
> <[email-masked]>, Routing WG <[email-masked]>
> Subject: Re: [Netconf] mbj review of
> draft-ietf-netconf-restconf-server-model-09
>
>
>
> From: Mahesh Jethanandani <[email-masked]>
> To: Acee Lindem <[email-masked]>
> Cc: Kent Watsen <[email-masked]>, Tom Petch <[email-masked]>,
> Martin Bjorklund <[email-masked]>, "[email-masked]" <[email-masked]>,
> Routing WG <[email-masked]>, "[email-masked]" <
> [email-masked]>
> Subject: Re: [Netconf] mbj review of
> draft-ietf-netconf-restconf-server-model-09
>
>
> One of those non-routing protocols is BFD. I am fine if the model is
> called protocol-key-chain, but I wonder what happens the next entity
> needing key-chain is not a protocol.
>
> The bigger question in my mind is, are these really different types of
> key-chains models, or are we talking about one key-chain model?
>
>
> The rtgwg key chain model is the one we all know and love associated with
> the graceful rollover of configurable keys. The netconf model is list of
> certificates for a public key. Please look at the information content of
> the two models. I hope I don’t have to answer this question again ;^)
>
> Acee
>
>
>
>
>
> Mahesh Jethanandani
> [email-masked]
>
>
>
>

-- 
Mahesh Jethanandani
[email-masked]

---

From: Mahesh Jethanandani <[email-masked]>
Date: Sat, 30 Apr 2016 14:52:37 -0700

That or we could also rename it to protocol-key-chain to disambiguate it from system-key-chain.

> On Apr 30, 2016, at 11:40 AM, Acee Lindem (acee) <[email-masked] <mailto:[email-masked]>> wrote:
> 
> What about the naming issue? I got a comment that I should take “routing-“ back out due to the fact that this is what that these key-chains can be used for many non-routing purposes. For example, BFD - http://www.juniper.net/documentation/en_US/junos14.2/topics/reference/configuration-statement/key-chain-edit-security-authentication-key-chains.html <http://www.juniper.net/documentation/en_US/junos14.2/topics/reference/configuration-statement/key-chain-edit-security-authentication-key-chains.html>
> 
> Thanks,
> Acee
> 
> From: rtgwg <[email-masked] <mailto:[email-masked]>> on behalf of Acee Lindem <[email-masked] <mailto:[email-masked]>>
> To: Mahesh Jethanandani <[email-masked] <mailto:[email-masked]>>
> Cc: Martin Bjorklund <[email-masked] <mailto:[email-masked]>>, Tom Petch <[email-masked] <mailto:[email-masked]>>, "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>, "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>, Routing WG <[email-masked] <mailto:[email-masked]>>
> From: Mahesh Jethanandani <[email-masked] <mailto:[email-masked]>>
> To: Acee Lindem <[email-masked] <mailto:[email-masked]>>
> Cc: Kent Watsen <[email-masked] <mailto:[email-masked]>>, Tom Petch <[email-masked] <mailto:[email-masked]>>, Martin Bjorklund <[email-masked] <mailto:[email-masked]>>, "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>, Routing WG <[email-masked] <mailto:[email-masked]>>, "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>
>> On Apr 18, 2016, at 10:25 AM, Acee Lindem (acee) <[email-masked] <mailto:[email-masked]>> wrote:
>> 
> [email-masked] <mailto:[email-masked]>
> 
> 
> 

Mahesh Jethanandani
[email-masked] <mailto:[email-masked]>