Subject: [Netconf] draft-ietf-netconf-reverse-ssh: MUST only be used for a NETCONF server

From: Benoit Claise <[email-masked]>
Date: Tue, 04 Mar 2014 10:27:11 +0000

Dear all,

Yesterday, Andy asked how this MUST could be enforced in 
draft-ietf-netconf-reverse-ssh

        However, these techniques MUST only be used for a NETCONF server to
         initiate a connection to a NETCONF client, as described in this
         document.

The way I understood this statement: the security experts wanted us to 
restrict the scope to only NETCONF. Fine.
However, that "MUST" can't be enforced, at least with RFC 2119 keyword.
This should be changed to "must".

We should obviously validate this with the security experts.

Regards, Benoit

---

From: Kent Watsen <[email-masked]>
Date: Tue, 4 Mar 2014 15:01:05 +0000

CC-ing Steve, who wrote the Applicability Statement.

Kent

From: Benoit Claise <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, March 4, 2014 5:27 AM
To: NetConf <[email-masked]<mailto:[email-masked]>>
Subject: [Netconf] draft-ietf-netconf-reverse-ssh: MUST only be used for a NETCONF server

Dear all,

Yesterday, Andy asked how this MUST could be enforced in draft-ietf-netconf-reverse-ssh
   However, these techniques MUST only be used for a NETCONF server to
    initiate a connection to a NETCONF client, as described in this
    document.
The way I understood this statement: the security experts wanted us to restrict the scope to only NETCONF. Fine.
However, that "MUST" can't be enforced, at least with RFC 2119 keyword.
This should be changed to "must".

Regards, Benoit