Subject: Re: [Netconf] mbj review of draft-ietf-netconf-restconf-server-model-09

From: Juergen Schoenwaelder <[email-masked]>
Date: Sun, 1 May 2016 09:42:24 +0200

I have briefly looked at the abstract / intro of both documents and I
am not sure I got from this why we do have two keychain models. Perhaps
both documents should be send to the security area as input for a joint
keychain data model?

/js

On Sat, Apr 30, 2016 at 03:10:38PM -0700, Mahesh Jethanandani wrote:
> That or we could also rename it to protocol-key-chain to disambiguate it
> from system-key-chain.
> 
> On Sat, Apr 30, 2016 at 11:40 AM, Acee Lindem (acee) <[email-masked]> wrote:
> 
> > So hopefully we’ve put the issue of combining the module to bed for good…
> > If look at the date nodes for these two models, it is patently clear that
> > these serve two different purposes.
> >
> > What about the naming issue? I got a comment that I should take “routing-“
> > back out due to the fact that this is what that these key-chains can be
> > used for many non-routing purposes. For example, BFD -
> > http://www.juniper.net/documentation/en_US/junos14.2/topics/reference/configuration-statement/key-chain-edit-security-authentication-key-chains.html
> >
> > Thanks,
> > Acee
> >
> > From: rtgwg <[email-masked]> on behalf of Acee Lindem <
> > [email-masked]>
> > Date: Monday, April 18, 2016 at 6:04 PM
> > To: Mahesh Jethanandani <[email-masked]>
> > Cc: Martin Bjorklund <[email-masked]>, Tom Petch <[email-masked]>, "
> > [email-masked]" <[email-masked]>, "[email-masked]"
> > <[email-masked]>, Routing WG <[email-masked]>
> > Subject: Re: [Netconf] mbj review of
> > draft-ietf-netconf-restconf-server-model-09
> >
> >
> >
> > From: Mahesh Jethanandani <[email-masked]>
> > Date: Monday, April 18, 2016 at 4:43 PM
> > To: Acee Lindem <[email-masked]>
> > Cc: Kent Watsen <[email-masked]>, Tom Petch <[email-masked]>,
> > Martin Bjorklund <[email-masked]>, "[email-masked]" <[email-masked]>,
> > Routing WG <[email-masked]>, "[email-masked]" <
> > [email-masked]>
> > Subject: Re: [Netconf] mbj review of
> > draft-ietf-netconf-restconf-server-model-09
> >
> >
> > On Apr 18, 2016, at 10:25 AM, Acee Lindem (acee) <[email-masked]> wrote:
> >
> > I did get some negative feedback with respect to adding “routing-“ to the
> > model name since key chains are used for other non-routing applications as
> > well.
> >
> >
> > One of those non-routing protocols is BFD. I am fine if the model is
> > called protocol-key-chain, but I wonder what happens the next entity
> > needing key-chain is not a protocol.
> >
> > The bigger question in my mind is, are these really different types of
> > key-chains models, or are we talking about one key-chain model?
> >
> >
> > The rtgwg key chain model is the one we all know and love associated with
> > the graceful rollover of configurable keys. The netconf model is list of
> > certificates for a public key. Please look at the information content of
> > the two models. I hope I don’t have to answer this question again ;^)
> >
> > Acee
> >
> >
> >
> >
> >
> > Mahesh Jethanandani
> > [email-masked]
> >
> >
> >
> >
> 
> 
> -- 
> Mahesh Jethanandani
> [email-masked]

> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Sun, 1 May 2016 13:38:12 +0000

>both documents should be send to the security area as input for a joint

Please look at the data nodes in the two models - one is about keys and
the other is about certificates.

At least for the IETF key-chain in the routing WG, there is significant
precedence across MANY networking products. Representatives from Cisco,
Juniper, Nokia, Ericsson, and Huawei participated in the design team as
all these vendors have implementations.

Acee 

>>http://www.juniper.net/documentation/en_US/junos14.2/topics/reference/con
>>figuration-statement/key-chain-edit-security-authentication-key-chains.ht
>>ml
>> >
>> > Thanks,
>> > Acee
>> >

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Sun, 1 May 2016 14:03:08 +0000

What if there is a non-protocol application? If we change it again, I’d still prefer reverting to simply ietf-key-chain to match the multitude of network device implementations.

There is one other alternative that reflects any potential usage. How  about agnostic-config-eclectic-extended-keychain? But wait, that is a bit long, perhaps we can use an acronym acee-key-chain ;^)

Acee

From: Mahesh Jethanandani <[email-masked]<mailto:[email-masked]>>
Date: Saturday, April 30, 2016 at 6:10 PM
To: Acee Lindem <[email-masked]<mailto:[email-masked]>>
Cc: Martin Bjorklund <[email-masked]<mailto:[email-masked]>>, Tom Petch <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Routing WG <[email-masked]<mailto:[email-masked]>>
Subject: Re: [Netconf] mbj review of draft-ietf-netconf-restconf-server-model-09

That or we could also rename it to protocol-key-chain to disambiguate it from system-key-chain.

On Sat, Apr 30, 2016 at 11:40 AM, Acee Lindem (acee) <[email-masked]<mailto:[email-masked]>> wrote:
So hopefully we’ve put the issue of combining the module to bed for good… If look at the date nodes for these two models, it is patently clear that these serve two different purposes.

What about the naming issue? I got a comment that I should take “routing-“ back out due to the fact that this is what that these key-chains can be used for many non-routing purposes. For example, BFD - http://www.juniper.net/documentation/en_US/junos14.2/topics/reference/configuration-statement/key-chain-edit-security-authentication-key-chains.html

Thanks,
Acee

From: rtgwg <[email-masked]<mailto:[email-masked]>> on behalf of Acee Lindem <[email-masked]<mailto:[email-masked]>>
Date: Monday, April 18, 2016 at 6:04 PM
To: Mahesh Jethanandani <[email-masked]<mailto:[email-masked]>>
Cc: Martin Bjorklund <[email-masked]<mailto:[email-masked]>>, Tom Petch <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Routing WG <[email-masked]<mailto:[email-masked]>>
Subject: Re: [Netconf] mbj review of draft-ietf-netconf-restconf-server-model-09

From: Mahesh Jethanandani <[email-masked]<mailto:[email-masked]>>
Date: Monday, April 18, 2016 at 4:43 PM
To: Acee Lindem <[email-masked]<mailto:[email-masked]>>
Cc: Kent Watsen <[email-masked]<mailto:[email-masked]>>, Tom Petch <[email-masked]<mailto:[email-masked]>>, Martin Bjorklund <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Routing WG <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [Netconf] mbj review of draft-ietf-netconf-restconf-server-model-09

On Apr 18, 2016, at 10:25 AM, Acee Lindem (acee) <[email-masked]<mailto:[email-masked]>> wrote:

One of those non-routing protocols is BFD. I am fine if the model is called protocol-key-chain, but I wonder what happens the next entity needing key-chain is not a protocol.

The bigger question in my mind is, are these really different types of key-chains models, or are we talking about one key-chain model?

The rtgwg key chain model is the one we all know and love associated with the graceful rollover of configurable keys. The netconf model is list of certificates for a public key. Please look at the information content of the two models. I hope I don’t have to answer this question again ;^)

Acee

Mahesh Jethanandani
[email-masked]<mailto:[email-masked]>

--
Mahesh Jethanandani
[email-masked]<mailto:[email-masked]>

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Sun, 1 May 2016 16:55:55 +0200

> the other is about certificates.

I looked at the abstract and the intro and the yang module description
and they did not tell me why there are two different models. I think
this needs to be clarified.

So if I use TLS with pre-shared keys, I have to use the 'routing' key
chain and if I use TLS with certificates, I have to use the 'netconf'
key chain?

In any case, review of both models by the security area may be a good
idea (and I still believe these models should ideally be done in the
security area) and not in OPS or RTG.

/js

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Sun, 1 May 2016 18:26:07 +0000

>this needs to be clarified.

Have you heard the expression, “You can’t judge a book by its cover”?

>chain and if I use TLS with certificates, I have to use the 'netconf'

I won’t speak for certificates but if you were going use pre-shared keys,
you would simply import the key-chain model in the same manner as the
applications that are currently using it. For example,
https://www.ietf.org/id/draft-ietf-ospf-yang-04.txt - Note that you will
have to look beyond the abstract for the example of this…

Thanks,
Acee

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Mon, 2 May 2016 08:35:31 +0200

> Have you heard the expression, “You can’t judge a book by its cover”?

Can we please be serious and simply improve things?

Thanks,

/js

---

From: t.petch <[email-masked]>
Date: Mon, 2 May 2016 10:37:46 +0100

----- Original Message -----
From: "Mahesh Jethanandani" <[email-masked]>
To: "Acee Lindem (acee)" <[email-masked]>
Sent: Saturday, April 30, 2016 11:10 PM

Mahesh

Myself, I prefer 'rDNS'.

If we have two models and one is about keys and the other is about
certificates, as Acee says,
then I would call one ...-keys and the other ...-certs.  In this case
that would be

key(-)chain-keys and key(-)chain-certs.

Or, to make it more distinct (and error-prone)

key-chain-keys
keychain-certs

Tom Petch

> used for many non-routing purposes. For example, BFD -
http://www.juniper.net/documentation/en_US/junos14.2/topics/reference/co
nfiguration-statement/key-chain-edit-security-authentication-key-chains.
html
> key-chains models, or are we talking about one key-chain model?

 The rtgwg key chain model is the one we all know and love associated
with

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Mon, 2 May 2016 10:08:35 +0000

>Can we please be serious and simply improve things?

Here is the abstract to the key-chain draft? What is unclear?

   This document describes the key chain YANG data model.  A key chain
   is a list of elements each containing a key, send lifetime, accept
   lifetime, and algorithm.  By properly overlapping the send and accept
   lifetimes of multiple key chain elements, keys and algorithms may be
   gracefully updated.  By representing them in a YANG data model, key
   distribution can be automated.  Key chains are commonly used for
   routing protocol authentication and other applications.  In some
   applications, the protocols do not use the key chain element key
   directly, but rather a key derivation function is used to derive a
   short-lived key from the key chain element key.

The draft with the other model (of which you are an author, is much less
clear) as to the usage and context of key-chains. Statements shouldn’t be
made as resolution of the draft solely based on the abstract - what more
can I say… 

Acee

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Mon, 2 May 2016 12:48:40 +0200

> That or we could also rename it to protocol-key-chain to disambiguate it

But then protocol-key-chain and system-key-chain seems to be largely
confusing. I heard that one is for symmetric keys and the other for
assymmetric keys. Or one is for keys and the other is for
certificates? You seem to say it is protocol vs. system, which I am
not sure is correct (or I simply keep being confused).

/js