3 namespace "urn:ietf:params:xml:ns:yang:ietf-keystore";
6 import ietf-netconf-acm {
9 "RFC 8341: Network Configuration Access Control Model";
12 import ietf-crypto-types {
15 "RFC AAAA: YANG Data Types and Groupings for Cryptography";
19 "IETF NETCONF (Network Configuration) Working Group";
22 "WG Web: https://datatracker.ietf.org/wg/netconf
23 WG List: NETCONF WG list <mailto:netconf@ietf.org>
24 Author: Kent Watsen <mailto:kent+ietf@watsen.net>";
27 "This module defines a 'keystore' to centralize management
28 of security credentials.
30 Copyright (c) 2023 IETF Trust and the persons identified
31 as authors of the code. All rights reserved.
33 Redistribution and use in source and binary forms, with
34 or without modification, is permitted pursuant to, and
35 subject to the license terms contained in, the Revised
36 BSD License set forth in Section 4.c of the IETF Trust's
37 Legal Provisions Relating to IETF Documents
38 (https://trustee.ietf.org/license-info).
40 This version of this YANG module is part of RFC CCCC
41 (https://www.rfc-editor.org/info/rfcCCCC); see the RFC
42 itself for full legal notices.
44 The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
45 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
46 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document
47 are to be interpreted as described in BCP 14 (RFC 2119)
48 (RFC 8174) when, and only when, they appear in all
49 capitals, as shown here.";
55 "RFC CCCC: A YANG Data Model for a Keystore";
62 feature central-keystore-supported {
64 "The 'central-keystore-supported' feature indicates that
65 the server supports the central keystore (i.e., fully
66 implements the 'ietf-keystore' module).";
69 feature inline-definitions-supported {
71 "The 'inline-definitions-supported' feature indicates that
72 the server supports locally-defined keys.";
75 feature asymmetric-keys {
77 "The 'asymmetric-keys' feature indicates that the server
78 implements the /keystore/asymmetric-keys subtree.";
82 feature symmetric-keys {
84 "The 'symmetric-keys' feature indicates that the server
85 implements the /keystore/symmetric-keys subtree.";
92 typedef symmetric-key-ref {
94 path "/ks:keystore/ks:symmetric-keys/ks:symmetric-key"
98 "This typedef enables modules to easily define a reference
99 to a symmetric key stored in the central keystore.";
102 typedef asymmetric-key-ref {
104 path "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key"
108 "This typedef enables modules to easily define a reference
109 to an asymmetric key stored in the central keystore.";
116 grouping encrypted-by-grouping {
118 "A grouping that defines a 'choice' statement that can be
119 augmented into the 'encrypted-by' node, present in the
120 'symmetric-key-grouping' and 'asymmetric-key-pair-grouping'
121 groupings defined in RFC AAAA, enabling references to keys
122 in the central keystore.";
123 choice encrypted-by {
124 nacm:default-deny-write;
127 "A choice amongst other symmetric or asymmetric keys.";
128 case symmetric-key-ref {
129 if-feature "central-keystore-supported";
130 if-feature "symmetric-keys";
131 leaf symmetric-key-ref {
132 type ks:symmetric-key-ref;
134 "Identifies the symmetric key used to encrypt the
138 case asymmetric-key-ref {
139 if-feature "central-keystore-supported";
140 if-feature "asymmetric-keys";
141 leaf asymmetric-key-ref {
142 type ks:asymmetric-key-ref;
144 "Identifies the asymmetric key whose public key
145 encrypted the associated key.";
153 grouping asymmetric-key-certificate-ref-grouping {
155 "Grouping for the reference to a certificate associated
156 with an asymmetric key stored in the central keystore.";
157 leaf asymmetric-key {
158 nacm:default-deny-write;
159 if-feature "central-keystore-supported";
160 if-feature "asymmetric-keys";
161 type ks:asymmetric-key-ref;
162 must '../certificate';
164 "A reference to an asymmetric key in the keystore.";
167 nacm:default-deny-write;
169 path "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key"
170 + "[ks:name = current()/../asymmetric-key]/"
171 + "ks:certificates/ks:certificate/ks:name";
173 must '../asymmetric-key';
175 "A reference to a specific certificate of the
176 asymmetric key in the keystore.";
180 // inline-or-keystore-* groupings
182 grouping inline-or-keystore-symmetric-key-grouping {
184 "A grouping for the configuration of a symmetric key. The
185 symmetric key may be defined inline or as a reference to
186 a symmetric key stored in the central keystore.
188 Servers that do not define the 'central-keystore-supported'
189 feature SHOULD augment in custom 'case' statements enabling
190 references to alternate keystore locations.";
191 choice inline-or-keystore {
192 nacm:default-deny-write;
195 "A choice between an inlined definition and a definition
196 that exists in the keystore.";
198 if-feature "inline-definitions-supported";
199 container inline-definition {
201 "Container to hold the local key definition.";
202 uses ct:symmetric-key-grouping;
205 case central-keystore {
206 if-feature "central-keystore-supported";
207 if-feature "symmetric-keys";
208 leaf central-keystore-reference {
209 type ks:symmetric-key-ref;
211 "A reference to an symmetric key that exists in
212 the central keystore.";
218 grouping inline-or-keystore-asymmetric-key-grouping {
220 "A grouping for the configuration of an asymmetric key. The
221 asymmetric key may be defined inline or as a reference to
222 an asymmetric key stored in the central keystore.
224 Servers that do not define the 'central-keystore-supported'
225 feature SHOULD augment in custom 'case' statements enabling
226 references to alternate keystore locations.";
227 choice inline-or-keystore {
228 nacm:default-deny-write;
231 "A choice between an inlined definition and a definition
232 that exists in the keystore.";
234 if-feature "inline-definitions-supported";
235 container inline-definition {
237 "Container to hold the local key definition.";
238 uses ct:asymmetric-key-pair-grouping;
241 case central-keystore {
242 if-feature "central-keystore-supported";
243 if-feature "asymmetric-keys";
244 leaf central-keystore-reference {
245 type ks:asymmetric-key-ref;
247 "A reference to an asymmetric key that exists in
248 the central keystore. The intent is to reference
249 just the asymmetric key without any regard for
250 any certificates that may be associated with it.";
256 grouping inline-or-keystore-asymmetric-key-with-certs-grouping {
258 "A grouping for the configuration of an asymmetric key and
259 its associated certificates. The asymmetric key and its
260 associated certificates may be defined inline or as a
261 reference to an asymmetric key (and its associated
262 certificates) in the central keystore.
264 Servers that do not define the 'central-keystore-supported'
265 feature SHOULD augment in custom 'case' statements enabling
266 references to alternate keystore locations.";
267 choice inline-or-keystore {
268 nacm:default-deny-write;
271 "A choice between an inlined definition and a definition
272 that exists in the keystore.";
274 if-feature "inline-definitions-supported";
275 container inline-definition {
277 "Container to hold the local key definition.";
278 uses ct:asymmetric-key-pair-with-certs-grouping;
281 case central-keystore {
282 if-feature "central-keystore-supported";
283 if-feature "asymmetric-keys";
284 leaf central-keystore-reference {
285 type ks:asymmetric-key-ref;
287 "A reference to an asymmetric-key (and all of its
288 associated certificates) in the keystore, when
289 this module is implemented.";
295 grouping inline-or-keystore-end-entity-cert-with-key-grouping {
297 "A grouping for the configuration of an asymmetric key and
298 its associated end-entity certificate. The asymmetric key
299 and its associated end-entity certificate may be defined
300 inline or as a reference to an asymmetric key (and its
301 associated end-entity certificate) in the central keystore.
303 Servers that do not define the 'central-keystore-supported'
304 feature SHOULD augment in custom 'case' statements enabling
305 references to alternate keystore locations.";
306 choice inline-or-keystore {
307 nacm:default-deny-write;
310 "A choice between an inlined definition and a definition
311 that exists in the keystore.";
313 if-feature "inline-definitions-supported";
314 container inline-definition {
316 "Container to hold the local key definition.";
317 uses ct:asymmetric-key-pair-with-cert-grouping;
320 case central-keystore {
321 if-feature "central-keystore-supported";
322 if-feature "asymmetric-keys";
323 container central-keystore-reference {
324 uses asymmetric-key-certificate-ref-grouping;
326 "A reference to a specific certificate associated with
327 an asymmetric key stored in the central keystore.";
333 // the keystore grouping
335 grouping keystore-grouping {
337 "Grouping definition enables use in other contexts. If ever
338 done, implementations MUST augment new 'case' statements
339 into the various inline-or-keystore 'choice' statements to
340 supply leafrefs to the model-specific location(s).";
341 container asymmetric-keys {
342 nacm:default-deny-write;
343 if-feature "asymmetric-keys";
345 "A list of asymmetric keys.";
346 list asymmetric-key {
349 "An asymmetric key.";
353 "An arbitrary name for the asymmetric key.";
355 uses ct:asymmetric-key-pair-with-certs-grouping;
358 container symmetric-keys {
359 nacm:default-deny-write;
360 if-feature "symmetric-keys";
362 "A list of symmetric keys.";
370 "An arbitrary name for the symmetric key.";
372 uses ct:symmetric-key-grouping;
377 /*********************************/
378 /* Protocol accessible nodes */
379 /*********************************/
382 if-feature central-keystore-supported;
384 "A central keystore containing a list of symmetric keys and
385 a list of asymmetric keys.";
386 nacm:default-deny-write;
387 uses keystore-grouping {
388 augment "symmetric-keys/symmetric-key/key-type/encrypted-key/"
389 + "encrypted-key/encrypted-by" {
391 "Augments in a choice statement enabling the encrypting
392 key to be any other symmetric or asymmetric key in the
394 uses encrypted-by-grouping;
396 augment "asymmetric-keys/asymmetric-key/private-key-type/"
397 + "encrypted-private-key/encrypted-private-key/"
400 "Augments in a choice statement enabling the encrypting
401 key to be any other symmetric or asymmetric key in the
403 uses encrypted-by-grouping;