Subject: [Netconf] Mandatory local configuration in Keystore groupings

From: Balazs Lengyel <[email-masked]>
Date: Wed, 4 Jul 2018 13:26:42 +0200

Hello Kent,

I was reading draft-ietf-netconf-keystore-05. I noticed that in the
groupings

local-or-keystore-end-entity-certificate-grouping,
local-or-keystore-asymmetric-key-grouping and local-or-keystore-asymmetric-key-with-certs-grouping

the keystore case is qualified with an

if-feature
"keystore-implemented"

statement. However the local case is not qualified with if-feature.
In ,many of our network nodes we want to implement a central
keystore, and do NOT want to allow local security configuration. So
please add

if-feature "not
keystore-implemented"

or

if-feature "local-keystore-allowed"

to the local case of these groupings.

regards Balazs Lengyel

--
Balazs Lengyel Ericsson Hungary Ltd.
Senior Specialist
Mobile: +36-70-330-7909 email: [email-masked]

---

From: Kent Watsen <[email-masked]>
Date: Thu, 5 Jul 2018 16:03:53 +0000

Hi Balazs,

This issue is (was?) also being discussed here:  https://mailarchive.ietf.org/arch/msg/netconf/tpmAeH9KLBWF0YglZ8CJmm4MW4o.

Expanding on (c) on that page, assuming we do this at all, the choices are:

  1: add "if-defined 'not keystore-implemented'" to the "local" choice.  This would
       be a *global* on/off switch, not per use of the grouping.

  2: add "if-defined 'local-keys-supported'" to the "local" choice.  This would be a
       *global* on/off switch, not per use of the grouping.

  3: do nothing; let downstream modules augment-in their own if-feature statements
      for the "choice" statement when the groupings are used.  This would allow define
       for *local* (not global) on/off switch.

  4. remove support for keystore being optional to implement.  That is, regarding your
      comment in the link below to support keys that are not shared, we could require
       that the keys still exist in keystore and leave it to the application to ensure it doesn't
       reference such keys more than once.

      https://mailarchive.ietf.org/arch/msg/netconf/xYYf0NSeT9mgtJ1KH-h7SYLSmXA

Thoughts?

Kent

On 7/4/18, 7:26 AM, "Netconf on behalf of Balazs Lengyel" <[email-masked]<mailto:[email-masked]> on behalf of [email-masked]<mailto:[email-masked]>> wrote:

Hello Kent,
I was reading draft-ietf-netconf-keystore-05. I noticed that in the groupings
local-or-keystore-end-entity-certificate-grouping, local-or-keystore-asymmetric-key-grouping and local-or-keystore-asymmetric-key-with-certs-grouping
the keystore case is qualified with an
if-feature "keystore-implemented"
statement. However the local case is not qualified with if-feature. In ,many of our network nodes we want to implement a central keystore, and do NOT want to allow local security configuration. So please add
if-feature "not keystore-implemented"
or
if-feature "local-keystore-allowed"
to the local case of these groupings.

regards Balazs Lengyel

--

Senior Specialist

Mobile: +36-70-330-7909              email: [email-masked]<mailto:[email-masked]>