Subject: [netconf] [ssh/tls]-client-server updates

From: Kent Watsen <[email-masked]>
Date: Fri, 18 Jun 2021 17:46:31 +0000

Detailed change logs for the just-published updates are at bottom, but the primary update is the creation of IANA-maintained modules for protocol-specific algorithms.  Key points:

	1) identities are used (not enumerations)

	2) the “container” and “list” names are simply 
	    “supported-algorithm[s]”  as the module’s 
	    namespace disambiguates them from
	    each other.

	3) deprecated and obsolete algorithms have
	    their “status” node set accordingly.

After waiting a sufficient amount of time for WG-review, it would be appropriate to request SecDir reviews, per Tom’s comment from before.

Thanks,
Kent

ssh-client-server:

   *  Renamed "{ietf-ssh-client}userauth-*" to "client-ident-*"

   *  Renamed "{ietf-ssh-server}userauth-*" to "local-user-auth-*"

   *  Moved algorithms in ietf-ssh-common (plus more) to IANA-maintained
      modules

   *  Added "config false" lists for algorithms supported by the server.

   *  Fixed issues found during YANG Doctor review.

tls-client-server:

   *  Added TLS 1.3 references.

   *  Clarified support for various TLS protocol versions.

   *  Moved algorithms in ietf-tls-common (plus more) to IANA-maintained
      modules

   *  Added "config false" lists for algorithms supported by the server.

   *  Fixed issues found during YANG Doctor review.

---

From: tom petch <[email-masked]>
Date: Fri, 25 Jun 2021 10:57:35 +0000

From: netconf <[email-masked]> on behalf of Kent Watsen <[email-masked]>
Sent: 18 June 2021 18:46
To: [email-masked]
Subject: [netconf] [ssh/tls]-client-server updates

More a comment for crypto-types or keystore but I have not seen an e-mail about those lately.

I see, courtesy of the RFC Editor, that X.690 has been updated to a 2021 version (which the RFC Editor would like to use).

Any one know what the differences are?

Assuming we know those, should we use it as  a reference?  Sometimes the new-fangled version of another SDO's work is not right for the IETF and we stay with the previous versions.

Tom Petch

<snip>

---

From: Kent Watsen <[email-masked]>
Date: Mon, 28 Jun 2021 19:36:21 +0000

Hi Tom,

> More a comment for crypto-types or keystore but I have not seen an e-mail about those lately.

I only found X.690 refs in the "crypto-types" and "sztp-csr” drafts.  Regardless...

> Any one know what the differences are?

I looked at the 2021 version here (https://www.itu.int/rec/T-REC-X.690), but it doesn’t contain a “difference to previous version” section.

I did find this (https://www.itu.int/en/ITU-T/asn1/Pages/Changing-from-ASN-119881990-to-ASN-12008.aspx), but it only covers the 1990 —> 2015 update.

> Assuming we know those, should we use it as  a reference?  Sometimes the new-fangled version of another SDO's work is not right for the IETF and we stay with the previous versions.

Firstly, we don’t know the changes…at least I don’t yet.

Second, I don’t believe the world of libraries and tools are going to flip overnight.   All the schema and compilers use the 2015 and, in some cases, I wouldn’t be surprised is the 1990 version was used.  For instance, note that  RFC 5280 was published in 2008!

My thoughts are to stay with 2015, at least until someone (ITU?) can provide a reasonable diff…

PS: X.680 was also just updated (https://www.itu.int/rec/T-REC-X.680)

> Tom Petch

K.

---

From: tom petch <[email-masked]>
Date: Tue, 29 Jun 2021 08:51:46 +0000

From: Kent Watsen <[email-masked]>
Sent: 28 June 2021 20:36

Hi Tom,

<tp>
Kent 

Thanks for that.  As I said, it was the RFC Editor which was proposing the updated version to the authors of an  I-D so you may get a similar proposal in due course (by which time, we may know more about it).

Tom Petch

K.