NETCONF over TLS

1
NETCONF over TLS

• Mohamad Badra
• draft-badra-tls-netconf-04.txt
• 70th IETF, December 2007, Vancouver

2
Not many people use certificate-based client
authentication

• TLS SRP (password authentication) is
  informational
• Some individuals submissions
• Solutions
• PKCS5 with password-based key derivation
• The PSK (RFC 4279) is replaced with the
  derivation result
• Use the Password directly as PSK
• Others?

3
Identity management Access Control

• Certificate case the identity is determined from
  the subject or subjectAltName fields in the
  certificate.
• PSK or password case the PSK identity.
• User-based access-control model
• RFC 4680 and RFC 4681 (TLS User Mapping
  Extension)

4
Ongoing works

• Updating the document with password based client
  authentication
• Profiles could be added for NETCONF
• More reviews.

5
Thank you!