Subject: [Netconf] Updating RFC 5539 WAS:FW: New version of draft-badra-netconf-rfc5539bis

From: "Ersue, Mehmet (NSN - DE/Munich)" <[email-masked]>
Date: Tue, 14 Feb 2012 13:00:01 +0100

Dear NETCONF WG,

we had a discussion on draft-badra-netconf-rfc5539bis in Taipei and
people

were agreeing that this work is needed if we want to keep NETCONF over
TLS

on the standards track.

The revision posted yesterday updates RFC 5539 fitting the changes in
RFC 

6241 and is covered by our charter.

The co-chairs believe that there is sufficient interest on this document

to be a working group item. So we encourage discussion here so that we

can make the next steps and if the interest indeed shows, then make it a

WG document.

Please state your opinion (including draft authors and contributors) on
the 

ML concerning the importance of this draft and updating RFC 5539, within

the next two weeks.

Another important questions is: Who is going to implement the update?

The optimal case would be if we can already discuss any implementation 

experience in IETF #83.

Mehmet & Bert

From: ext Mohamad Badra [mailto:[email-masked]] 
Sent: Monday, February 13, 2012 11:00 PM
To: [email-masked]
Cc: Ersue, Mehmet (NSN - DE/Munich); ext Bert Wijnen (IETF)
Subject: New version of draft-badra-netconf-rfc5539bis

Dear All,

I posted a new version of draft-badra-netconf-rfc5539bis and would
appreciate your comments. Enclosed is the diff file.

The document URL:
http://www.ietf.org/id/draft-badra-netconf-rfc5539bis-01.txt

WG Chairs, I would like to ask adoption the document as WG item.

Best regards,

Badra

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 14 Feb 2012 13:11:07 +0100

On Tue, Feb 14, 2012 at 01:00:01PM +0100, Ersue, Mehmet (NSN - DE/Munich) wrote:
> people were agreeing that this work is needed if we want to keep
> NETCONF over TLS on the standards track.
> 
> The revision posted yesterday updates RFC 5539 fitting the changes
> in RFC 6241 and is covered by our charter.  The co-chairs believe
> that there is sufficient interest on this document to be a working
> group item. So we encourage discussion here so that we can make the
> next steps and if the interest indeed shows, then make it a
> WG document.
> 
> Please state your opinion (including draft authors and contributors)
> on the ML concerning the importance of this draft and updating RFC
> 5539, within the next two weeks.

I think we should adopt this document. But I am biased since I
contributed text to the I-D. I believe there is work left to be done
and since NETMOD is working on a YANG configuration model for SNMP and
that covers the SNMP TLS/DTLS transport, I would like to see a common
YANG way of configuring how to extract a username/securityname out of
an X.509 cert.

> Another important questions is: Who is going to implement the
> update?  The optimal case would be if we can already discuss any
> implementation experience in IETF #83.

Asking for implementation experience for something that is not even a
WG draft may be a bit early. That said, you know that there are people
working on it. ;-)

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: "Bert Wijnen (IETF)" <[email-masked]>
Date: Tue, 14 Feb 2012 13:15:15 +0100

On 2/14/12 1:11 PM, Juergen Schoenwaelder wrote:
> working on it.;-)

Sure it is somewhat early. But if people feel this is important, then
I would have expected them to be working on it one way or another
already. Anyways, specifically in this space, it is best if we can get
some real implementation feedback.
And in light of getting something something similar as for SNMP TLS/DTLS,
again implementation in that space may help is with clue about
extracting a userid from the certs.

Bert

---

From: "Ersue, Mehmet (NSN - DE/Munich)" <[email-masked]>
Date: Wed, 15 Feb 2012 15:51:18 +0100

Hi All,

[Co-chair hat-off]

I as a contributor support the update of RFC 5539 and to adopt 5539bis
draft as WG item.

Concerning memory and CPU usage SSH transport seems to be costly for
small devices. 
TLS appears to be the better option for such devices (e.g. with less
round trips and less chatty) and can be prepared in a lightweight manner
by skipping optional messages.
	
AFAIK Vlad Perelman from Jacobs Univ. Bremen is implementing currently a
TLS binding for NETCONF-Light following the 5539bis draft and the
optional support of TLS Pre-Shared Key authentication described in
chapter 3.2.1.2.

I also think that the YANG module in this draft, defining a common way
to extract a username out of an X.509 certificate, is especially
important and needed.

Cheers, 
Mehmet 

> -----Original Message-----
> From: ext Juergen Schoenwaelder
[mailto:[email-masked]]
> Sent: Tuesday, February 14, 2012 1:11 PM
> To: Ersue, Mehmet (NSN - DE/Munich)
> Cc: Netconf
> Subject: Re: [Netconf] Updating RFC 5539 WAS:FW: New version of
draft-badra-
> netconf-rfc5539bis

---

From: Mohamad Badra <[email-masked]>
Date: Sun, 19 Feb 2012 09:48:32 +0400

I support the update of RFC 5539 and to adopt the document as WG item.

Best regards
Badra

On Wed, Feb 15, 2012 at 6:51 PM, Ersue, Mehmet (NSN - DE/Munich) <
[email-masked]> wrote:

> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf
>