Subject: [babel] Information model and YANG: about HMAC

From: Juliusz Chroboczek <[email-masked]>
Date: Wed, 07 Nov 2018 12:21:08 +0100

My comment during the meeting, expanded.

HMAC does not carry keys or algorithm identifiers on the wire: algorithm
and key are provisioned by means outside of the Babel protocol (currently
a configuration file, but we're working on implementing key rotation at
runtime), then only the results of the HMAC computation are sent on the
wire.

Hence, the base protocol does not need a registry of HMAC algorithm
identifiers: the only place where HMAC algorithms appear is the config
file, and how they are expressed there is purely a local implementation
decision.

What the information model and YANG do is, among other things, to export
the configuration in an interoperable format.  Hence, if we need to export
the HMAC keys, we'll need a registry of HMAC protocols.

If we do, then the initial value should probably be just one entry:
HMAC-SHA256.

-- Juliusz

---

From: Mahesh Jethanandani <[email-masked]>
Date: Fri, 9 Nov 2018 15:29:22 +0700

Hi Juliusz,

My comments inline.

> On Nov 7, 2018, at 6:21 PM, Juliusz Chroboczek <[email-masked]> wrote:
> 
> a configuration file,

That is correct.

> but we're working on implementing key rotation at

There are and have been several efforts to define key rotation, specially in the now defunct KARP WG, but had a few drafts on this. Let me see if I can dig them up.

> file, and how they are expressed there is purely a local implementation

I am not clear on what you mean by "expressed". I would agree that the HMAC algorithm is something that has to be expressed in YANG for configuration purposes, and also that it be the same for the two ends of the link.

> the HMAC keys, we'll need a registry of HMAC protocols.

The "interoperable" format is the YANG model. There are models that define keychain, and even define some of the HMAC protocols.

> If we do, then the initial value should probably be just one entry:

Great. I will look to adding it.

Thanks.

> 
> -- Juliusz
> 
> 
> 
> _______________________________________________
> babel mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/babel