Subject: [Netconf] /keystore/keys/key/public-key: config false --> config true?

From: Kent Watsen <[email-masked]>
Date: Sat, 5 Aug 2017 00:21:46 +0000

Currently, /keystore/keys/key/public-key is config false.  I thought that
it would be okay, based on my thinking that public keys can be derived
from private keys.  For instance, an RSA public key is a proper subset 
of an RSA private key, and thus is derivable from the private key.

However, ECC keys appear to be different.  The keystore draft currently 
uses the ECPrivateKey structure (from RFC 5915) to encode the private 
keys, and that draft says that private keys SHOULD include the public
key, but leaves open the possibility that it's may not be included.

Extrapolating, it seems prudent to go ahead and make the public-key
leaf config true.  Surely, anyone configuring a private-key has the
public-key, so it shouldn't be difficult to supply...

I'll plan to make this change if no objections are expressed.

Thanks,
Kent

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Sat, 5 Aug 2017 07:23:51 +0200

> of an RSA private key, and thus is derivable from the private key.

He?
 
> public-key, so it shouldn't be difficult to supply...

If you allow to write the private key, you have to allow to write the
public key. I assume not all systems may allow to read/write keys (but
I think you take care of this).

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>