Subject: [Netconf] keystone/5: YANG annotation for cleartext-password --> ciphertext-password?

From: Kent Watsen <[email-masked]>
Date: Tue, 28 Feb 2017 02:25:46 +0000

Ref: https://github.com/netconf-wg/keystore/issues/5.

During IETF 96, Andy pointed out the iana-crypt-hash module defined in RFC
7317.  Looking at the 'crypt-hash' type more closely, it appears to not be
what is needed here, as it does not retain the original clear text value.

Background: The crypt-hash type is perfect for a server that needs to
authenticate clients, but what we're looking for here is a way to configure
a client to log into a server, using password-based authentication.  The
immediate goal is to support the ietf-ssh-client module (i.e., an SSH 
client logging into an SSH server), but one can imagine password-based
client auth being used for other protocols as well (e.g., HTTPS, LDAPS,
SMTPS, IMAPS, etc.).

So, after thinking about this more, I think that the original problem was
misstated (see subject line) and the real solution is to just define the
password field as a plain-old string type field, and then rely on access
control (e.g., NACM) to restrict read access to admins.  This solution is
similar to the what we said we'd do for the private-key (github issue #2).

Anyway, that do people think?  Makes sense?  Any objections?  I'll assume
it's okay if there are no responses this week.

Thanks,
Kent