Subject: [yang-doctors] First review entry WAS:RE: Review of draft-ietf-rtgwg-yang-key-chain-13

From: "Mehmet Ersue" <[email-masked]>
Date: Mon, 20 Feb 2017 13:21:57 +0100

Many Thanks Lada!!!  Looks perfect.

Though, I'm not 100% sure whether we should send such mails always to
[email-masked].
I can imagine yang-doctors, draft authors and the related WG would be
sufficient.

@Benoit: 
What do you think?

Cheers,
Mehmet

> -----Original Message-----
> From: yang-doctors [mailto:[email-masked]] On Behalf Of
> Ladislav Lhotka
> Sent: Monday, February 20, 2017 12:50 PM
> To: [email-masked]
> Cc: [email-masked]; [email-masked];
> [email-masked]
> Subject: [yang-doctors] Review of draft-ietf-rtgwg-yang-key-chain-13
> 
> Reviewer: Ladislav Lhotka
> Review result: Almost Ready
> 
> # General Comments
> 
> ## Cryptographic algorithm types
> 
> What is the reason for representing these as a YANG choice with empty
> leaves? I think it would be more natural to use a single leaf, either an
> enumeration or (if extensibility is important) identityref.
> 
> ## Reusability
> 
> The module defines key-chain as a grouping with the aim of making it
> reusable in other modules. However, this approach has known problems that
> are discussed in draft-ietf-netmod-schema-mount. I am not sure how
> relevant they are in this case but, for one, the "key-chain-ref"
> type is not applicable if the "key-chain" grouping is used in another
module.
> An alternative is not to use the grouping and rely on schema mount.
> 
> ## Key string style
> 
> The difference between ASCII and hexadecimal formats of key strings should
> be explained. I understand that the latter is a hash of the key and, if
so, I'd
> suggest to include "hexadecimal-string" also in state data.
> 
> Also, I believe that storing clear-text key in configuration is insecure
and
> Security Considerations should warn against it.
> 
> ## Example
> 
> It might be useful to include an appendix with example instance data.
> 
> # Specific comments
> 
> ## Sec. 2
> 
> -   paragraph 2: s/where ever/wherever/
> 
> ## Sec. 3
> 
> -   paragraph 1: replace both Key-Id a Key-ID with Key ID (the latter
> is used in other places of the
>     text).
> -   paragraph 2: the suggested way of supporting asymmetric keys looks
> like a hack, I would suggest
>     a more explicit representation, e.g. using a choice.
> 
> ## Sec. 4
> 
> -   The module has inconsistent indentation: up to "grouping
> crypto-algorithm-types", top-level
>     statements are indented with four spaces, the subsequent ones with
five
> spaces.
> 
> ## Sec. 6
> 
> -   The statement "Given that the key chains themselves are sensitive
> data, it is RECOMMENDED
>     that the NETCONF communication channel be encrypted." is misleading
> because RFC 6241
>     requires that transport protocols for NETCONF guarantee
confidentiality
> (and RFC 8040 does the
>     same for RESTCONF).
> 
> 
> _______________________________________________
> yang-doctors mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/yang-doctors

---

From: Ladislav Lhotka <[email-masked]>
Date: Mon, 20 Feb 2017 13:37:52 +0100

> On 20 Feb 2017, at 13:21, Mehmet Ersue <[email-masked]> wrote:
> 

Well, there may be spurious line breaks depending on the width of the browser window. Actually, I think it would be helpful to support some kind of lightweight markup such as markdown.

> Though, I'm not 100% sure whether we should send such mails always to

Certainly not! If I correctly remember, the review form mentioned only [email-masked] and [email-masked] to be in Cc.

Lada

--
Ladislav Lhotka, CZ.NIC Labs
PGP Key ID: 0xB8F92B08A9F76C67

---

From: "Mehmet Ersue" <[email-masked]>
Date: Mon, 20 Feb 2017 13:48:07 +0100

The review form actually includes [email-masked] which we also see in CC of
the automatically generated mail.

Cheers,
Mehmet

> From: Ladislav Lhotka [mailto:[email-masked]]
> Sent: Monday, February 20, 2017 1:38 PM
> To: Mehmet Ersue <[email-masked]>
> Cc: Benoit Claise <[email-masked]>
> Subject: Re: First review entry WAS:RE: [yang-doctors] Review of
draft-ietf-
> rtgwg-yang-key-chain-13
> Well, there may be spurious line breaks depending on the width of the
> browser window. Actually, I think it would be helpful to support some kind
of
> lightweight markup such as markdown.
> 
> >
> Certainly not! If I correctly remember, the review form mentioned only
> [email-masked] and [email-masked] to be in
Cc.
> >> From: yang-doctors [mailto:[email-masked]] On Behalf
> >> Of Ladislav Lhotka
> >> leaves? I think it would be more natural to use a single leaf, either
> >> an enumeration or (if extensibility is important) identityref.
> >>
> >> ## Reusability
> >>
> >> reusable in other modules. However, this approach has known problems
> >> that are discussed in draft-ietf-netmod-schema-mount. I am not sure
> >> how relevant they are in this case but, for one, the "key-chain-ref"
> >> The difference between ASCII and hexadecimal formats of key strings
> >> should be explained. I understand that the latter is a hash of the
> >> key and, if
> > so, I'd
> >>    that the NETCONF communication channel be encrypted." is
> >> misleading because RFC 6241

---

From: Benoit Claise <[email-masked]>
Date: Mon, 20 Feb 2017 19:02:58 +0100

> the automatically generated mail.
I don't think that's necessary. There are too many emails anyway, and 
the datatracker contains the links to all the reviews.
And finally, the YANG doctors emails are archived.

Regards, Benoit
> .