Subject: [Netconf] comments on draft-kwatsen-netconf-ownership-voucher

From: Michael Richardson <[email-masked]>
Date: Wed, 14 Sep 2016 20:31:36 -0400

Kent, I read the quick document you crafted yesterday.  I think it captures
most of what matters, thank you!

   module: ietf-ownership-voucher
         +--rw voucher
         +--rw assertion          enumeration
         +--rw owner-id           string
         +--rw unique-id*         string
         +--rw created-on         yang:date-and-time
         +--rw expires-on?        yang:date-and-time
         +--rw nonce?             string
         +--rw additional-data?

I think that additional-data is probably undesireable.
I think that we need to say that owner-id is actually a hash of public key.
I don't think we can let it be a DN, as that implies some of connection to
some PKI to verify it, and the only point is that we don't have anything
that the vendor didn't burn in.

I would appreciate an example mapped out in JSON.
Could it really be a JWT?  Do we already have such a mapping elsewhere?
Is there any reason we couldn't use the JWT/rfc7519 notation, so that the
mapping just works out?  Maybe I'm missing the value of the YANG here.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-