Subject: [netconf] CSR grouping introduced in draft-ietf-netconf-sztp-csr-06

From: "Fries, Steffen" <[email-masked]>
Date: Tue, 24 Aug 2021 15:25:14 +0000

Hi Kent,

I just went over the changes regarding the csr-grouping (https://datatracker.ietf.org/doc/html/draft-ietf-netconf-sztp-csr-08#section-3.2) you introduced in draft-ietf-netconf-sztp-csr-06. To my understanding (I'm not too deep into YANG yet) the new grouping of the csr in the YANG module ietf-ztp-types can now be used directly.
This should enable the direct application in BRSKI-AE, which we were looking for to avoid double definition. Thanks for the incorporation. While we are currently using only the PKCS#10 approach, the module provides also the option to switch to cmp-csr or cmc-csr. So were are open also for other formats.

Best regards
Steffen
--
Steffen Fries
Siemens AG

---

From: Kent Watsen <[email-masked]>
Date: Wed, 25 Aug 2021 02:12:05 +0000

You’re welcome.

K.

> On Aug 24, 2021, at 11:25 AM, Fries, Steffen <[email-masked]> wrote:
> 
> Hi Kent,
>  
> I just went over the changes regarding the csr-grouping (https://datatracker.ietf.org/doc/html/draft-ietf-netconf-sztp-csr-08#section-3.2 <https://datatracker.ietf.org/doc/html/draft-ietf-netconf-sztp-csr-08#section-3.2>) you introduced in draft-ietf-netconf-sztp-csr-06. To my understanding (I’m not too deep into YANG yet) the new grouping of the csr in the YANG module ietf-ztp-types can now be used directly.
> _______________________________________________
> Anima mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/anima <https://www.ietf.org/mailman/listinfo/anima>

---

From: Michael Richardson <[email-masked]>
Date: Thu, 26 Aug 2021 13:52:38 -0400

> You’re welcome.

This is where I think we are now: I'm writing this to confirm our understanding!

I think that we are now going to build a new traditional YANG module (not a
ietf-restconf) that contains this sztp-csr grouping.  We are going to use
this over: HTTP, CoAP and CoAP-over-BTLE.
For HTTP, I know we want to use JSON serialization only.

For CoAP (over-BTLE), CBOR (with SID) would make more sense, but that might
be premature optimization.

I think that we could use trust-anchors directly as is, but I'm not sure yet.
In any case, we have a new YANG module to add to async

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide