Subject: Re: [netconf] [Anima] revising RFC8366 -- Re: BRSKI-AE enum issue -> empty, but what's he encoding ?

From: Kent Watsen <[email-masked]>
Date: Wed, 30 Jun 2021 00:56:24 +0000

> On Jun 29, 2021, at 8:36 PM, Michael Richardson <[email-masked]> wrote:
> 
> 
> Rob Wilton (rwilton) <[email-masked]> wrote:
>> An RFC8366bis is the right option.  If the changes are minor then I may
>> be able to ease the passage through the IESG, but I can't do much to
>> affect the elapsed time.

If considering a bis, can we consider changing the "pinned-domain-cert” node from a X.509v3 cert to a “choice” between that and a chain of certs?   

In particular, from:

   +---- pinned-domain-cert               binary

To:

   +---- (domain-cert-format)
      +---- pinned-domain-cert               binary
      +---- pinned-domain-certs              binary

Or, better, using ietf-crypto-types:

   +---- (domain-cert-format)
      +---- pinned-domain-cert               ct:end-entity-cert-x509
      +---- pinned-domain-certs              ct:end-entity-cert-cms

> I will prepare a draft for this week.
> 
> I thought I wrote a really nice ASCII art version of what documents inherit
> from RFC8366.  I can't find it in my outbox... I wonder if I nuked the draft
> by mistake.

Check this:

https://yangcatalog.org/yang-search/impact_analysis/?modtags=ietf-voucher%402017-10-25.yang&orgtags=&recursion=0&show_rfcs=1&show_subm=1&show_dir=dependents <https://yangcatalog.org/yang-search/impact_analysis/?modtags=[email-masked]&orgtags=&recursion=0&show_rfcs=1&show_subm=1&show_dir=dependents>

K.

---

From: Michael Richardson <[email-masked]>
Date: Tue, 29 Jun 2021 21:23:04 -0400

> If considering a bis, can we consider changing the "pinned-domain-cert”
    > node from a X.509v3 cert to a “choice” between that and a chain of
    > certs?

Yeah, I think it's a good idea.
Could we also have the choice be a RPK?

    > Or, better, using ietf-crypto-types:

:-)

    > https://yangcatalog.org/yang-search/impact_analysis/?modtags=ietf-voucher%402017-10-25.yang&orgtags=&recursion=0&show_rfcs=1&show_subm=1&show_dir=dependents
    > <https://yangcatalog.org/yang-search/impact_analysis/?modtags=[email-masked]&orgtags=&recursion=0&show_rfcs=1&show_subm=1&show_dir=dependents>

Yeah, I knew about that, but others might not.
I was basically trying to distill it down into a few words.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [