--- /dev/null
+module ietf-crypto-types {\r
+ yang-version 1.1;\r
+ namespace "urn:ietf:params:xml:ns:yang:ietf-crypto-types";\r
+ prefix ct;\r
+\r
+ import ietf-yang-types {\r
+ prefix yang;\r
+ reference\r
+ "RFC 6991: Common YANG Data Types";\r
+ }\r
+\r
+ import ietf-netconf-acm {\r
+ prefix nacm;\r
+ reference\r
+ "RFC 8341: Network Configuration Access Control Model";\r
+ }\r
+\r
+ organization\r
+ "IETF NETCONF (Network Configuration) Working Group";\r
+\r
+ contact\r
+ "WG Web: <http://datatracker.ietf.org/wg/netconf/>\r
+ WG List: <mailto:netconf@ietf.org>\r
+ Author: Kent Watsen <mailto:kent+ietf@watsen.net>\r
+ Author: Wang Haiguang <wang.haiguang.shieldlab@huawei.com>";\r
+\r
+ description\r
+ "This module defines common YANG types for cryptographic\r
+ applications.\r
+\r
+ Copyright (c) 2019 IETF Trust and the persons identified\r
+ as authors of the code. All rights reserved.\r
+\r
+ Redistribution and use in source and binary forms, with\r
+ or without modification, is permitted pursuant to, and\r
+ subject to the license terms contained in, the Simplified\r
+ BSD License set forth in Section 4.c of the IETF Trust's\r
+ Legal Provisions Relating to IETF Documents\r
+ (https://trustee.ietf.org/license-info).\r
+\r
+ This version of this YANG module is part of RFC XXXX\r
+ (https://www.rfc-editor.org/info/rfcXXXX); see the RFC\r
+ itself for full legal notices.;\r
+\r
+ The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',\r
+ 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',\r
+ 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document\r
+ are to be interpreted as described in BCP 14 (RFC 2119)\r
+ (RFC 8174) when, and only when, they appear in all\r
+ capitals, as shown here.";\r
+\r
+ revision 2019-04-29 {\r
+ description\r
+ "Initial version";\r
+ reference\r
+ "RFC XXXX: Common YANG Data Types for Cryptography";\r
+ }\r
+\r
+ /**************************************/\r
+ /* Identities for Hash Algorithms */\r
+ /**************************************/\r
+\r
+ identity hash-algorithm {\r
+ description\r
+ "A base identity for hash algorithm verification.";\r
+ }\r
+\r
+ identity sha-224 {\r
+ base hash-algorithm;\r
+ description\r
+ "The SHA-224 algorithm.";\r
+ reference\r
+ "RFC 6234: US Secure Hash Algorithms.";\r
+ }\r
+ identity sha-256 {\r
+ base hash-algorithm;\r
+ description\r
+ "The SHA-256 algorithm.";\r
+ reference\r
+ "RFC 6234: US Secure Hash Algorithms.";\r
+ }\r
+\r
+ identity sha-384 {\r
+ base hash-algorithm;\r
+ description\r
+ "The SHA-384 algorithm.";\r
+ reference\r
+ "RFC 6234: US Secure Hash Algorithms.";\r
+ }\r
+\r
+ identity sha-512 {\r
+ base hash-algorithm;\r
+ description\r
+ "The SHA-512 algorithm.";\r
+ reference\r
+ "RFC 6234: US Secure Hash Algorithms.";\r
+ }\r
+\r
+ /***********************************************/\r
+ /* Identities for Asymmetric Key Algorithms */\r
+ /***********************************************/\r
+\r
+ identity asymmetric-key-algorithm {\r
+ description\r
+ "Base identity from which all asymmetric key\r
+ encryption Algorithm.";\r
+ }\r
+\r
+ identity rsa1024 {\r
+ base asymmetric-key-algorithm;\r
+ description\r
+ "The RSA algorithm using a 1024-bit key.";\r
+ reference\r
+ "RFC 8017:\r
+ PKCS #1: RSA Cryptography Specifications Version 2.2.";\r
+ }\r
+\r
+ identity rsa2048 {\r
+ base asymmetric-key-algorithm;\r
+ description\r
+ "The RSA algorithm using a 2048-bit key.";\r
+ reference\r
+ "RFC 8017:\r
+ PKCS #1: RSA Cryptography Specifications Version 2.2.";\r
+ }\r
+\r
+ identity rsa3072 {\r
+ base asymmetric-key-algorithm;\r
+ description\r
+ "The RSA algorithm using a 3072-bit key.";\r
+ reference\r
+ "RFC 8017:\r
+ PKCS #1: RSA Cryptography Specifications Version 2.2.";\r
+ }\r
+\r
+ identity rsa4096 {\r
+ base asymmetric-key-algorithm;\r
+ description\r
+ "The RSA algorithm using a 4096-bit key.";\r
+ reference\r
+ "RFC 8017:\r
+ PKCS #1: RSA Cryptography Specifications Version 2.2.";\r
+ }\r
+\r
+ identity rsa7680 {\r
+ base asymmetric-key-algorithm;\r
+ description\r
+ "The RSA algorithm using a 7680-bit key.";\r
+ reference\r
+ "RFC 8017:\r
+ PKCS #1: RSA Cryptography Specifications Version 2.2.";\r
+ }\r
+\r
+ identity rsa15360 {\r
+ base asymmetric-key-algorithm;\r
+ description\r
+ "The RSA algorithm using a 15360-bit key.";\r
+ reference\r
+ "RFC 8017:\r
+ PKCS #1: RSA Cryptography Specifications Version 2.2.";\r
+ }\r
+\r
+ identity secp192r1 {\r
+ base asymmetric-key-algorithm;\r
+ description\r
+ "The ECDSA algorithm using a NIST P256 Curve.";\r
+ reference\r
+ "RFC 6090:\r
+ Fundamental Elliptic Curve Cryptography Algorithms.";\r
+ }\r
+ identity secp224r1 {\r
+ base asymmetric-key-algorithm;\r
+ description\r
+ "The ECDSA algorithm using a NIST P256 Curve.";\r
+ reference\r
+ "RFC 6090:\r
+ Fundamental Elliptic Curve Cryptography Algorithms.";\r
+ }\r
+\r
+ identity secp256r1 {\r
+ base asymmetric-key-algorithm;\r
+ description\r
+ "The ECDSA algorithm using a NIST P256 Curve.";\r
+ reference\r
+ "RFC 6090:\r
+ Fundamental Elliptic Curve Cryptography Algorithms.";\r
+ }\r
+\r
+ identity secp384r1 {\r
+ base asymmetric-key-algorithm;\r
+ description\r
+ "The ECDSA algorithm using a NIST P256 Curve.";\r
+ reference\r
+ "RFC 6090:\r
+ Fundamental Elliptic Curve Cryptography Algorithms.";\r
+ }\r
+\r
+ identity secp521r1 {\r
+ base asymmetric-key-algorithm;\r
+ description\r
+ "The ECDSA algorithm using a NIST P256 Curve.";\r
+ reference\r
+ "RFC 6090:\r
+ Fundamental Elliptic Curve Cryptography Algorithms.";\r
+ }\r
+\r
+ /*************************************/\r
+ /* Identities for MAC Algorithms */\r
+ /*************************************/\r
+\r
+ identity mac-algorithm {\r
+ description\r
+ "A base identity for mac generation.";\r
+ }\r
+\r
+ identity hmac-sha1 {\r
+ base mac-algorithm;\r
+ description\r
+ "Generating MAC using SHA1 hash function";\r
+ reference\r
+ "RFC 3174: US Secure Hash Algorithm 1 (SHA1)";\r
+ }\r
+\r
+ identity hmac-sha1-96 {\r
+ base mac-algorithm;\r
+ description\r
+ "Generating MAC using SHA1 hash function";\r
+ reference\r
+ "RFC 2404: The Use of HMAC-SHA-1-96 within ESP and AH";\r
+ }\r
+\r
+ identity hmac-sha2-224 {\r
+ base mac-algorithm;\r
+ description\r
+ "Generating MAC using SHA2 hash function";\r
+ reference\r
+ "RFC 6234:\r
+ US Secure Hash Algorithms (SHA and SHA-based HMAC and\r
+ HKDF)";\r
+ }\r
+\r
+ identity hmac-sha2-256 {\r
+ base mac-algorithm;\r
+ description\r
+ "Generating MAC using SHA2 hash function";\r
+ reference\r
+ "RFC 6234:\r
+ US Secure Hash Algorithms (SHA and SHA-based HMAC and\r
+ HKDF)";\r
+ }\r
+\r
+ identity hmac-sha2-256-128 {\r
+ base mac-algorithm;\r
+ description\r
+ "Generating a 256 bits MAC using SHA2 hash function and\r
+ truncate it to 128 bits";\r
+ reference\r
+ "RFC 4868:\r
+ Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512\r
+ with IPsec";\r
+ }\r
+\r
+ identity hmac-sha2-384 {\r
+ base mac-algorithm;\r
+ description\r
+ "Generating MAC using SHA2 hash function";\r
+ reference\r
+ "RFC 6234:\r
+ US Secure Hash Algorithms (SHA and SHA-based HMAC and\r
+ HKDF)";\r
+ }\r
+\r
+ identity hmac-sha2-384-192 {\r
+ base mac-algorithm;\r
+ description\r
+ "Generating a 384 bits MAC using SHA2 hash function and\r
+ truncate it to 192 bits";\r
+ reference\r
+ "RFC 4868:\r
+ Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with\r
+ IPsec";\r
+ }\r
+\r
+ identity hmac-sha2-512 {\r
+ base mac-algorithm;\r
+ description\r
+ "Generating MAC using SHA2 hash function";\r
+ reference\r
+ "RFC 6234:\r
+ US Secure Hash Algorithms (SHA and SHA-based HMAC and\r
+ HKDF)";\r
+ }\r
+\r
+ identity hmac-sha2-512-256 {\r
+ base mac-algorithm;\r
+ description\r
+ "Generating a 512 bits MAC using SHA2 hash function and\r
+ truncating it to 256 bits";\r
+ reference\r
+ "RFC 4868:\r
+ Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with\r
+ IPsec";\r
+ }\r
+\r
+ identity aes-128-gmac {\r
+ base mac-algorithm;\r
+ description\r
+ "Generating MAC using the Advanced Encryption Standard (AES)\r
+ Galois Message Authentication Code (GMAC) as a mechanism to\r
+ provide data origin authentication";\r
+ reference\r
+ "RFC 4543:\r
+ The Use of Galois Message Authentication Code (GMAC) in\r
+ IPsec ESP and AH";\r
+ }\r
+\r
+ identity aes-192-gmac {\r
+ base mac-algorithm;\r
+ description\r
+ "Generating MAC using the Advanced Encryption Standard (AES)\r
+ Galois Message Authentication Code (GMAC) as a mechanism to\r
+ provide data origin authentication";\r
+ reference\r
+ "RFC 4543:\r
+ The Use of Galois Message Authentication Code (GMAC) in\r
+ IPsec ESP and AH";\r
+ }\r
+\r
+ identity aes-256-gmac {\r
+ base mac-algorithm;\r
+ description\r
+ "Generating MAC using the Advanced Encryption Standard (AES)\r
+ Galois Message Authentication Code (GMAC) as a mechanism to\r
+ provide data origin authentication";\r
+ reference\r
+ "RFC 4543:\r
+ The Use of Galois Message Authentication Code (GMAC) in\r
+ IPsec ESP and AH";\r
+ }\r
+\r
+ identity aes-cmac-96 {\r
+ base mac-algorithm;\r
+ description\r
+ "Generating MAC using Advanced Encryption Standard (AES)\r
+ Cipher-based Message Authentication Code (CMAC)";\r
+ reference\r
+ "RFC 4494: The AES-CMAC-96 Algorithm and its Use with IPsec";\r
+ }\r
+\r
+ identity aes-cmac-128 {\r
+ base mac-algorithm;\r
+ description\r
+ "Generating MAC using Advanced Encryption Standard (AES)\r
+ Cipher-based Message Authentication Code (CMAC)";\r
+ reference\r
+ "RFC 4493: The AES-CMAC Algorithm";\r
+ }\r
+\r
+ /********************************************/\r
+ /* Identities for Encryption Algorithms */\r
+ /********************************************/\r
+\r
+ identity encryption-algorithm {\r
+ description\r
+ "A base identity for encryption algorithm.";\r
+ }\r
+\r
+ identity aes-128-cbc {\r
+ base encryption-algorithm;\r
+ description\r
+ "Encrypt message with AES algorithm in CBC mode with a key\r
+ length of 128 bits";\r
+ reference\r
+ "RFC 3565:\r
+ Use of the Advanced Encryption Standard (AES) Encryption\r
+ Algorithm in Cryptographic Message Syntax (CMS)";\r
+ }\r
+\r
+ identity aes-192-cbc {\r
+ base encryption-algorithm;\r
+ description\r
+ "Encrypt message with AES algorithm in CBC mode with a key\r
+ length of 192 bits";\r
+ reference\r
+ "RFC 3565:\r
+ Use of the Advanced Encryption Standard (AES) Encryption\r
+ Algorithm in Cryptographic Message Syntax (CMS)";\r
+ }\r
+\r
+ identity aes-256-cbc {\r
+ base encryption-algorithm;\r
+ description\r
+ "Encrypt message with AES algorithm in CBC mode with a key\r
+ length of 256 bits";\r
+ reference\r
+ "RFC 3565:\r
+ Use of the Advanced Encryption Standard (AES) Encryption\r
+ Algorithm in Cryptographic Message Syntax (CMS)";\r
+ }\r
+\r
+ identity aes-128-ctr {\r
+ base encryption-algorithm;\r
+ description\r
+ "Encrypt message with AES algorithm in CTR mode with a key\r
+ length of 128 bits";\r
+ reference\r
+ "RFC 3686:\r
+ Using Advanced Encryption Standard (AES) Counter Mode with\r
+ IPsec Encapsulating Security Payload (ESP)";\r
+ }\r
+ identity aes-192-ctr {\r
+ base encryption-algorithm;\r
+ description\r
+ "Encrypt message with AES algorithm in CTR mode with a key\r
+ length of 192 bits";\r
+ reference\r
+ "RFC 3686:\r
+ Using Advanced Encryption Standard (AES) Counter Mode with\r
+ IPsec Encapsulating Security Payload (ESP)";\r
+ }\r
+\r
+ identity aes-256-ctr {\r
+ base encryption-algorithm;\r
+ description\r
+ "Encrypt message with AES algorithm in CTR mode with a key\r
+ length of 256 bits";\r
+ reference\r
+ "RFC 3686:\r
+ Using Advanced Encryption Standard (AES) Counter Mode with\r
+ IPsec Encapsulating Security Payload (ESP)";\r
+ }\r
+\r
+ /****************************************************/\r
+ /* Identities for Encryption and MAC Algorithms */\r
+ /****************************************************/\r
+\r
+ identity encryption-and-mac-algorithm {\r
+ description\r
+ "A base identity for encryption and MAC algorithm.";\r
+ }\r
+\r
+ identity aes-128-ccm {\r
+ base encryption-and-mac-algorithm;\r
+ description\r
+ "Encrypt message with AES algorithm in CCM mode with a key\r
+ length of 128 bits; it can also be used for generating MAC";\r
+ reference\r
+ "RFC 4309:\r
+ Using Advanced Encryption Standard (AES) CCM Mode with\r
+ IPsec Encapsulating Security Payload (ESP)";\r
+ }\r
+\r
+ identity aes-192-ccm {\r
+ base encryption-and-mac-algorithm;\r
+ description\r
+ "Encrypt message with AES algorithm in CCM mode with a key\r
+ length of 192 bits; it can also be used for generating MAC";\r
+ reference\r
+ "RFC 4309:\r
+ Using Advanced Encryption Standard (AES) CCM Mode with\r
+ IPsec Encapsulating Security Payload (ESP)";\r
+ }\r
+\r
+ identity aes-256-ccm {\r
+ base encryption-and-mac-algorithm;\r
+ description\r
+ "Encrypt message with AES algorithm in CCM mode with a key\r
+ length of 256 bits; it can also be used for generating MAC";\r
+ reference\r
+ "RFC 4309:\r
+ Using Advanced Encryption Standard (AES) CCM Mode with\r
+ IPsec Encapsulating Security Payload (ESP)";\r
+ }\r
+\r
+ identity aes-128-gcm {\r
+ base encryption-and-mac-algorithm;\r
+ description\r
+ "Encrypt message with AES algorithm in GCM mode with a key\r
+ length of 128 bits; it can also be used for generating MAC";\r
+ reference\r
+ "RFC 4106:\r
+ The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating\r
+ Security Payload (ESP)";\r
+ }\r
+\r
+ identity aes-192-gcm {\r
+ base encryption-and-mac-algorithm;\r
+ description\r
+ "Encrypt message with AES algorithm in GCM mode with a key\r
+ length of 192 bits; it can also be used for generating MAC";\r
+ reference\r
+ "RFC 4106:\r
+ The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating\r
+ Security Payload (ESP)";\r
+ }\r
+\r
+ identity mac-aes-256-gcm {\r
+ base encryption-and-mac-algorithm;\r
+ description\r
+ "Encrypt message with AES algorithm in GCM mode with a key\r
+ length of 128 bits; it can also be used for generating MAC";\r
+ reference\r
+ "RFC 4106:\r
+ The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating\r
+ Security Payload (ESP)";\r
+ }\r
+ identity chacha20-poly1305 {\r
+ base encryption-and-mac-algorithm;\r
+ description\r
+ "Encrypt message with chacha20 algorithm and generate MAC with\r
+ POLY1305; it can also be used for generating MAC";\r
+ reference\r
+ "RFC 8439: ChaCha20 and Poly1305 for IETF Protocols";\r
+ }\r
+\r
+ /******************************************/\r
+ /* Identities for signature algorithm */\r
+ /******************************************/\r
+\r
+ identity signature-algorithm {\r
+ description\r
+ "A base identity for asymmetric key encryption algorithm.";\r
+ }\r
+\r
+ identity dsa-sha1 {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using DSA algorithm with SHA1 hash\r
+ algorithm";\r
+ reference\r
+ "RFC 4253: The Secure Shell (SSH) Transport Layer Protocol";\r
+ }\r
+\r
+ identity rsassa-pkcs1-sha1 {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using RSASSA-PKCS1-v1_5 with the SHA1\r
+ hash algorithm.";\r
+ reference\r
+ "RFC 4253: The Secure Shell (SSH) Transport Layer Protocol";\r
+ }\r
+\r
+ identity rsassa-pkcs1-sha256 {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using RSASSA-PKCS1-v1_5 with the\r
+ SHA256 hash algorithm.";\r
+ reference\r
+ "RFC 8332:\r
+ Use of RSA Keys with SHA-256 and SHA-512 in the Secure Shell\r
+ (SSH) Protocol\r
+ RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+ identity rsassa-pkcs1-sha384 {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using RSASSA-PKCS1-v1_5 with the\r
+ SHA384 hash algorithm.";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity rsassa-pkcs1-sha512 {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using RSASSA-PKCS1-v1_5 with the\r
+ SHA512 hash algorithm.";\r
+ reference\r
+ "RFC 8332:\r
+ Use of RSA Keys with SHA-256 and SHA-512 in the Secure Shell\r
+ (SSH) Protocol\r
+ RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity rsassa-pss-rsae-sha256 {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using RSASSA-PSS with mask generation\r
+ function 1 and SHA256 hash algorithm. If the public key is\r
+ carried in an X.509 certificate, it MUST use the rsaEncryption\r
+ OID";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity rsassa-pss-rsae-sha384 {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using RSASSA-PSS with mask generation\r
+ function 1 and SHA384 hash algorithm. If the public key is\r
+ carried in an X.509 certificate, it MUST use the rsaEncryption\r
+ OID";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity rsassa-pss-rsae-sha512 {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using RSASSA-PSS with mask generation\r
+ function 1 and SHA512 hash algorithm. If the public key is\r
+ carried in an X.509 certificate, it MUST use the rsaEncryption\r
+ OID";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity rsassa-pss-pss-sha256 {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using RSASSA-PSS with mask generation\r
+ function 1 and SHA256 hash algorithm. If the public key is\r
+ carried in an X.509 certificate, it MUST use the RSASSA-PSS\r
+ OID";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity rsassa-pss-pss-sha384 {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using RSASSA-PSS with mask generation\r
+ function 1 and SHA256 hash algorithm. If the public key is\r
+ carried in an X.509 certificate, it MUST use the RSASSA-PSS\r
+ OID";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity rsassa-pss-pss-sha512 {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using RSASSA-PSS with mask generation\r
+ function 1 and SHA256 hash algorithm. If the public key is\r
+ carried in an X.509 certificate, it MUST use the RSASSA-PSS\r
+ OID";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity ecdsa-secp256r1-sha256 {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using ECDSA with curve name secp256r1\r
+ and SHA256 hash algorithm.";\r
+ reference\r
+ "RFC 5656: Elliptic Curve Algorithm Integration in the\r
+ Secure Shell Transport Layer\r
+ RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity ecdsa-secp384r1-sha384 {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using ECDSA with curve name secp384r1\r
+ and SHA384 hash algorithm.";\r
+ reference\r
+ "RFC 5656: Elliptic Curve Algorithm Integration in the\r
+ Secure Shell Transport Layer\r
+ RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity ecdsa-secp521r1-sha512 {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using ECDSA with curve name secp521r1\r
+ and SHA512 hash algorithm.";\r
+ reference\r
+ "RFC 5656: Elliptic Curve Algorithm Integration in the\r
+ Secure Shell Transport Layer\r
+ RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity ed25519 {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using EdDSA as defined in RFC 8032 or\r
+ its successors.";\r
+ reference\r
+ "RFC 8032: Edwards-Curve Digital Signature Algorithm (EdDSA)";\r
+ }\r
+\r
+ identity ed448 {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using EdDSA as defined in RFC 8032 or\r
+ its successors.";\r
+ reference\r
+ "RFC 8032: Edwards-Curve Digital Signature Algorithm (EdDSA)";\r
+ }\r
+\r
+ identity eccsi {\r
+ base signature-algorithm;\r
+ description\r
+ "The signature algorithm using ECCSI signature as defined in\r
+ RFC 6507.";\r
+ reference\r
+ "RFC 6507:\r
+ Elliptic Curve-Based Certificateless Signatures for\r
+ Identity-based Encryption (ECCSI)";\r
+ }\r
+\r
+ /**********************************************/\r
+ /* Identities for key exchange algorithms */\r
+ /**********************************************/\r
+\r
+ identity key-exchange-algorithm {\r
+ description\r
+ "A base identity for Diffie-Hellman based key exchange\r
+ algorithm.";\r
+ }\r
+\r
+ identity psk-only {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Using Pre-shared key for authentication and key exchange";\r
+ reference\r
+ "RFC 4279:\r
+ Pre-Shared Key cipher suites for Transport Layer Security\r
+ (TLS)";\r
+ }\r
+\r
+ identity dhe-ffdhe2048 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Ephemeral Diffie Hellman key exchange with 2048 bit\r
+ finite field";\r
+ reference\r
+ "RFC 7919:\r
+ Negotiated Finite Field Diffie-Hellman Ephemeral Parameters\r
+ for Transport Layer Security (TLS)";\r
+ }\r
+\r
+ identity dhe-ffdhe3072 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Ephemeral Diffie Hellman key exchange with 3072 bit finite\r
+ field";\r
+ reference\r
+ "RFC 7919:\r
+ Negotiated Finite Field Diffie-Hellman Ephemeral Parameters\r
+ for Transport Layer Security (TLS)";\r
+ }\r
+\r
+ identity dhe-ffdhe4096 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Ephemeral Diffie Hellman key exchange with 4096 bit\r
+ finite field";\r
+ reference\r
+ "RFC 7919:\r
+ Negotiated Finite Field Diffie-Hellman Ephemeral Parameters\r
+ for Transport Layer Security (TLS)";\r
+ }\r
+\r
+ identity dhe-ffdhe6144 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Ephemeral Diffie Hellman key exchange with 6144 bit\r
+ finite field";\r
+ reference\r
+ "RFC 7919:\r
+ Negotiated Finite Field Diffie-Hellman Ephemeral Parameters\r
+ for Transport Layer Security (TLS)";\r
+ }\r
+\r
+ identity dhe-ffdhe8192 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Ephemeral Diffie Hellman key exchange with 8192 bit\r
+ finite field";\r
+ reference\r
+ "RFC 7919:\r
+ Negotiated Finite Field Diffie-Hellman Ephemeral Parameters\r
+ for Transport Layer Security (TLS)";\r
+ }\r
+\r
+ identity psk-dhe-ffdhe2048 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Key exchange using pre-shared key with Diffie-Hellman key\r
+ generation mechanism, where the DH group is FFDHE2048";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity psk-dhe-ffdhe3072 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Key exchange using pre-shared key with Diffie-Hellman key\r
+ generation mechanism, where the DH group is FFDHE3072";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity psk-dhe-ffdhe4096 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Key exchange using pre-shared key with Diffie-Hellman key\r
+ generation mechanism, where the DH group is FFDHE4096";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity psk-dhe-ffdhe6144 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Key exchange using pre-shared key with Diffie-Hellman key\r
+ generation mechanism, where the DH group is FFDHE6144";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity psk-dhe-ffdhe8192 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Key exchange using pre-shared key with Diffie-Hellman key\r
+ generation mechanism, where the DH group is FFDHE8192";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity ecdhe-secp256r1 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Ephemeral Diffie Hellman key exchange with elliptic group\r
+ over curve secp256r1";\r
+ reference\r
+ "RFC 8422:\r
+ Elliptic Curve Cryptography (ECC) Cipher Suites for\r
+ Transport Layer Security (TLS) Versions 1.2 and Earlier";\r
+ }\r
+\r
+ identity ecdhe-secp384r1 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Ephemeral Diffie Hellman key exchange with elliptic group\r
+ over curve secp384r1";\r
+ reference\r
+ "RFC 8422:\r
+ Elliptic Curve Cryptography (ECC) Cipher Suites for\r
+ Transport Layer Security (TLS) Versions 1.2 and Earlier";\r
+ }\r
+\r
+ identity ecdhe-secp521r1 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Ephemeral Diffie Hellman key exchange with elliptic group\r
+ over curve secp521r1";\r
+ reference\r
+ "RFC 8422:\r
+ Elliptic Curve Cryptography (ECC) Cipher Suites for\r
+ Transport Layer Security (TLS) Versions 1.2 and Earlier";\r
+ }\r
+\r
+ identity ecdhe-x25519 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Ephemeral Diffie Hellman key exchange with elliptic group\r
+ over curve x25519";\r
+ reference\r
+ "RFC 8422:\r
+ Elliptic Curve Cryptography (ECC) Cipher Suites for\r
+ Transport Layer Security (TLS) Versions 1.2 and Earlier";\r
+ }\r
+\r
+ identity ecdhe-x448 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Ephemeral Diffie Hellman key exchange with elliptic group\r
+ over curve x448";\r
+ reference\r
+ "RFC 8422:\r
+ Elliptic Curve Cryptography (ECC) Cipher Suites for\r
+ Transport Layer Security (TLS) Versions 1.2 and Earlier";\r
+ }\r
+\r
+ identity psk-ecdhe-secp256r1 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Key exchange using pre-shared key with elliptic group-based\r
+ Ephemeral Diffie Hellman key exchange over curve secp256r1";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity psk-ecdhe-secp384r1 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Key exchange using pre-shared key with elliptic group-based\r
+ Ephemeral Diffie Hellman key exchange over curve secp384r1";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity psk-ecdhe-secp521r1 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Key exchange using pre-shared key with elliptic group-based\r
+ Ephemeral Diffie Hellman key exchange over curve secp521r1";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity psk-ecdhe-x25519 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Key exchange using pre-shared key with elliptic group-based\r
+ Ephemeral Diffie Hellman key exchange over curve x25519";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity psk-ecdhe-x448 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Key exchange using pre-shared key with elliptic group-based\r
+ Ephemeral Diffie Hellman key exchange over curve x448";\r
+ reference\r
+ "RFC 8446:\r
+ The Transport Layer Security (TLS) Protocol Version 1.3";\r
+ }\r
+\r
+ identity diffie-hellman-group14-sha1 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Using DH group14 and SHA1 for key exchange";\r
+ reference\r
+ "RFC 4253: The Secure Shell (SSH) Transport Layer Protocol";\r
+ }\r
+\r
+ identity diffie-hellman-group14-sha256 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Using DH group14 and SHA256 for key exchange";\r
+ reference\r
+ "RFC 8268:\r
+ More Modular Exponentiation (MODP) Diffie-Hellman (DH)\r
+ Key Exchange (KEX) Groups for Secure Shell (SSH)";\r
+ }\r
+\r
+ identity diffie-hellman-group15-sha512 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Using DH group15 and SHA512 for key exchange";\r
+ reference\r
+ "RFC 8268:\r
+ More Modular Exponentiation (MODP) Diffie-Hellman (DH)\r
+ Key Exchange (KEX) Groups for Secure Shell (SSH)";\r
+ }\r
+\r
+ identity diffie-hellman-group16-sha512 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Using DH group16 and SHA512 for key exchange";\r
+ reference\r
+ "RFC 8268:\r
+ More Modular Exponentiation (MODP) Diffie-Hellman (DH)\r
+ Key Exchange (KEX) Groups for Secure Shell (SSH)";\r
+ }\r
+\r
+ identity diffie-hellman-group17-sha512 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Using DH group17 and SHA512 for key exchange";\r
+\r
+ reference\r
+ "RFC 8268:\r
+ More Modular Exponentiation (MODP) Diffie-Hellman (DH)\r
+ Key Exchange (KEX) Groups for Secure Shell (SSH)";\r
+ }\r
+\r
+ identity diffie-hellman-group18-sha512 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Using DH group18 and SHA512 for key exchange";\r
+ reference\r
+ "RFC 8268:\r
+ More Modular Exponentiation (MODP) Diffie-Hellman (DH)\r
+ Key Exchange (KEX) Groups for Secure Shell (SSH)";\r
+ }\r
+\r
+ identity ecdh-sha2-secp256r1 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Elliptic curve-based Diffie Hellman key exchange over curve\r
+ secp256r1 and using SHA2 for MAC generation";\r
+ reference\r
+ "RFC 6239: Suite B Cryptographic Suites for Secure Shell\r
+ (SSH)";\r
+ }\r
+\r
+ identity ecdh-sha2-secp384r1 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "Elliptic curve-based Diffie Hellman key exchange over curve\r
+ secp384r1 and using SHA2 for MAC generation";\r
+ reference\r
+ "RFC 6239: Suite B Cryptographic Suites for Secure Shell\r
+ (SSH)";\r
+ }\r
+\r
+ identity rsaes-oaep {\r
+ base key-exchange-algorithm;\r
+ description\r
+ "RSAES-OAEP combines the RSAEP and RSADP primitives with the\r
+ EME-OAEP encoding method";\r
+ reference\r
+ "RFC 8017:\r
+ PKCS #1: RSA Cryptography Specifications Version 2.2.";\r
+ }\r
+\r
+ identity rsaes-pkcs1-v1_5 {\r
+ base key-exchange-algorithm;\r
+ description\r
+ " RSAES-PKCS1-v1_5 combines the RSAEP and RSADP primitives\r
+ with the EME-PKCS1-v1_5 encoding method";\r
+ reference\r
+ "RFC 8017:\r
+ PKCS #1: RSA Cryptography Specifications Version 2.2.";\r
+ }\r
+\r
+ /**********************************************************/\r
+ /* Typedefs for identityrefs to above base identities */\r
+ /**********************************************************/\r
+\r
+ typedef hash-algorithm-ref {\r
+ type identityref {\r
+ base hash-algorithm;\r
+ }\r
+ description\r
+ "This typedef enables importing modules to easily define an\r
+ identityref to the 'hash-algorithm' base identity.";\r
+ }\r
+\r
+ typedef signature-algorithm-ref {\r
+ type identityref {\r
+ base signature-algorithm;\r
+ }\r
+ description\r
+ "This typedef enables importing modules to easily define an\r
+ identityref to the 'signature-algorithm' base identity.";\r
+ }\r
+\r
+ typedef mac-algorithm-ref {\r
+ type identityref {\r
+ base mac-algorithm;\r
+ }\r
+ description\r
+ "This typedef enables importing modules to easily define an\r
+ identityref to the 'mac-algorithm' base identity.";\r
+ }\r
+\r
+ typedef encryption-algorithm-ref {\r
+ type identityref {\r
+ base encryption-algorithm;\r
+ }\r
+ description\r
+ "This typedef enables importing modules to easily define an\r
+ identityref to the 'encryption-algorithm'\r
+ base identity.";\r
+ }\r
+\r
+ typedef encryption-and-mac-algorithm-ref {\r
+ type identityref {\r
+ base encryption-and-mac-algorithm;\r
+ }\r
+ description\r
+ "This typedef enables importing modules to easily define an\r
+ identityref to the 'encryption-and-mac-algorithm'\r
+ base identity.";\r
+ }\r
+\r
+ typedef asymmetric-key-algorithm-ref {\r
+ type identityref {\r
+ base asymmetric-key-algorithm;\r
+ }\r
+ description\r
+ "This typedef enables importing modules to easily define an\r
+ identityref to the 'asymmetric-key-algorithm'\r
+ base identity.";\r
+ }\r
+\r
+ typedef key-exchange-algorithm-ref {\r
+ type identityref {\r
+ base key-exchange-algorithm;\r
+ }\r
+ description\r
+ "This typedef enables importing modules to easily define an\r
+ identityref to the 'key-exchange-algorithm' base identity.";\r
+ }\r
+\r
+ /***************************************************/\r
+ /* Typedefs for ASN.1 structures from RFC 5280 */\r
+ /***************************************************/\r
+\r
+ typedef x509 {\r
+ type binary;\r
+ description\r
+ "A Certificate structure, as specified in RFC 5280,\r
+ encoded using ASN.1 distinguished encoding rules (DER),\r
+ as specified in ITU-T X.690.";\r
+ reference\r
+ "RFC 5280:\r
+ Internet X.509 Public Key Infrastructure Certificate\r
+ and Certificate Revocation List (CRL) Profile\r
+ ITU-T X.690:\r
+ Information technology - ASN.1 encoding rules:\r
+ Specification of Basic Encoding Rules (BER),\r
+ Canonical Encoding Rules (CER) and Distinguished\r
+ Encoding Rules (DER).";\r
+ }\r
+\r
+ typedef crl {\r
+ type binary;\r
+ description\r
+ "A CertificateList structure, as specified in RFC 5280,\r
+ encoded using ASN.1 distinguished encoding rules (DER),\r
+ as specified in ITU-T X.690.";\r
+ reference\r
+ "RFC 5280:\r
+ Internet X.509 Public Key Infrastructure Certificate\r
+ and Certificate Revocation List (CRL) Profile\r
+ ITU-T X.690:\r
+ Information technology - ASN.1 encoding rules:\r
+ Specification of Basic Encoding Rules (BER),\r
+ Canonical Encoding Rules (CER) and Distinguished\r
+ Encoding Rules (DER).";\r
+ }\r
+\r
+ /***********************************************/\r
+ /* Typedefs for ASN.1 structures from 5652 */\r
+ /***********************************************/\r
+\r
+ typedef cms {\r
+ type binary;\r
+ description\r
+ "A ContentInfo structure, as specified in RFC 5652,\r
+ encoded using ASN.1 distinguished encoding rules (DER),\r
+ as specified in ITU-T X.690.";\r
+ reference\r
+ "RFC 5652:\r
+ Cryptographic Message Syntax (CMS)\r
+ ITU-T X.690:\r
+ Information technology - ASN.1 encoding rules:\r
+ Specification of Basic Encoding Rules (BER),\r
+ Canonical Encoding Rules (CER) and Distinguished\r
+ Encoding Rules (DER).";\r
+ }\r
+\r
+ typedef data-content-cms {\r
+ type cms;\r
+ description\r
+ "A CMS structure whose top-most content type MUST be the\r
+ data content type, as described by Section 4 in RFC 5652.";\r
+ reference\r
+ "RFC 5652: Cryptographic Message Syntax (CMS)";\r
+ }\r
+\r
+ typedef signed-data-cms {\r
+ type cms;\r
+ description\r
+ "A CMS structure whose top-most content type MUST be the\r
+ signed-data content type, as described by Section 5 in\r
+ RFC 5652.";\r
+ reference\r
+ "RFC 5652: Cryptographic Message Syntax (CMS)";\r
+ }\r
+\r
+ typedef enveloped-data-cms {\r
+ type cms;\r
+ description\r
+ "A CMS structure whose top-most content type MUST be the\r
+ enveloped-data content type, as described by Section 6\r
+ in RFC 5652.";\r
+ reference\r
+ "RFC 5652: Cryptographic Message Syntax (CMS)";\r
+ }\r
+\r
+ typedef digested-data-cms {\r
+ type cms;\r
+ description\r
+ "A CMS structure whose top-most content type MUST be the\r
+ digested-data content type, as described by Section 7\r
+ in RFC 5652.";\r
+ reference\r
+ "RFC 5652: Cryptographic Message Syntax (CMS)";\r
+ }\r
+\r
+ typedef encrypted-data-cms {\r
+ type cms;\r
+ description\r
+ "A CMS structure whose top-most content type MUST be the\r
+ encrypted-data content type, as described by Section 8\r
+ in RFC 5652.";\r
+ reference\r
+ "RFC 5652: Cryptographic Message Syntax (CMS)";\r
+ }\r
+\r
+ typedef authenticated-data-cms {\r
+ type cms;\r
+ description\r
+ "A CMS structure whose top-most content type MUST be the\r
+ authenticated-data content type, as described by Section 9\r
+ in RFC 5652.";\r
+ reference\r
+ "RFC 5652: Cryptographic Message Syntax (CMS)";\r
+ }\r
+\r
+ /***************************************************/\r
+ /* Typedefs for structures related to RFC 4253 */\r
+ /***************************************************/\r
+\r
+ typedef ssh-host-key {\r
+ type binary;\r
+ description\r
+ "The binary public key data for this SSH key, as\r
+ specified by RFC 4253, Section 6.6, i.e.:\r
+\r
+ string certificate or public key format\r
+ identifier\r
+ byte[n] key/certificate data.";\r
+ reference\r
+ "RFC 4253: The Secure Shell (SSH) Transport Layer\r
+ Protocol";\r
+ }\r
+\r
+ /*********************************************************/\r
+ /* Typedefs for ASN.1 structures related to RFC 5280 */\r
+ /*********************************************************/\r
+\r
+ typedef trust-anchor-cert-x509 {\r
+ type x509;\r
+ description\r
+ "A Certificate structure that MUST encode a self-signed\r
+ root certificate.";\r
+ }\r
+\r
+ typedef end-entity-cert-x509 {\r
+ type x509;\r
+ description\r
+ "A Certificate structure that MUST encode a certificate\r
+ that is neither self-signed nor having Basic constraint\r
+ CA true.";\r
+ }\r
+\r
+ /*********************************************************/\r
+ /* Typedefs for ASN.1 structures related to RFC 5652 */\r
+ /*********************************************************/\r
+\r
+ typedef trust-anchor-cert-cms {\r
+ type signed-data-cms;\r
+ description\r
+ "A CMS SignedData structure that MUST contain the chain of\r
+ X.509 certificates needed to authenticate the certificate\r
+ presented by a client or end-entity.\r
+\r
+ The CMS MUST contain only a single chain of certificates.\r
+ The client or end-entity certificate MUST only authenticate\r
+ to last intermediate CA certificate listed in the chain.\r
+\r
+ In all cases, the chain MUST include a self-signed root\r
+ certificate. In the case where the root certificate is\r
+ itself the issuer of the client or end-entity certificate,\r
+ only one certificate is present.\r
+\r
+ This CMS structure MAY (as applicable where this type is\r
+ used) also contain suitably fresh (as defined by local\r
+ policy) revocation objects with which the device can\r
+ verify the revocation status of the certificates.\r
+\r
+ This CMS encodes the degenerate form of the SignedData\r
+ structure that is commonly used to disseminate X.509\r
+ certificates and revocation objects (RFC 5280).";\r
+ reference\r
+ "RFC 5280:\r
+ Internet X.509 Public Key Infrastructure Certificate\r
+ and Certificate Revocation List (CRL) Profile.";\r
+ }\r
+\r
+ typedef end-entity-cert-cms {\r
+ type signed-data-cms;\r
+ description\r
+ "A CMS SignedData structure that MUST contain the end\r
+ entity certificate itself, and MAY contain any number\r
+ of intermediate certificates leading up to a trust\r
+ anchor certificate. The trust anchor certificate\r
+ MAY be included as well.\r
+\r
+ The CMS MUST contain a single end entity certificate.\r
+ The CMS MUST NOT contain any spurious certificates.\r
+\r
+ This CMS structure MAY (as applicable where this type is\r
+ used) also contain suitably fresh (as defined by local\r
+ policy) revocation objects with which the device can\r
+ verify the revocation status of the certificates.\r
+\r
+ This CMS encodes the degenerate form of the SignedData\r
+ structure that is commonly used to disseminate X.509\r
+ certificates and revocation objects (RFC 5280).";\r
+ reference\r
+ "RFC 5280:\r
+ Internet X.509 Public Key Infrastructure Certificate\r
+ and Certificate Revocation List (CRL) Profile.";\r
+ }\r
+\r
+ /**********************************************/\r
+ /* Groupings for keys and/or certificates */\r
+ /**********************************************/\r
+\r
+ grouping public-key-grouping {\r
+ description\r
+ "A public key.\r
+\r
+ The 'algorithm' and 'public-key' nodes are not\r
+ mandatory because they MAY be defined in <operational>.\r
+ Implementations SHOULD assert that these values are\r
+ either configured or that they exist in <operational>.";\r
+ leaf algorithm {\r
+ nacm:default-deny-write;\r
+ type asymmetric-key-algorithm-ref;\r
+ must '../public-key';\r
+ description\r
+ "Identifies the key's algorithm. More specifically,\r
+ this leaf specifies how the 'public-key' binary leaf\r
+ is encoded.";\r
+ reference\r
+ "RFC CCCC: Common YANG Data Types for Cryptography";\r
+ }\r
+ leaf public-key {\r
+ nacm:default-deny-write;\r
+ type binary;\r
+ must '../algorithm';\r
+ description\r
+ "A binary that contains the value of the public key. The\r
+ interpretation of the content is defined by the key\r
+ algorithm. For example, a DSA key is an integer, an RSA\r
+ key is represented as RSAPublicKey as defined in\r
+ RFC 8017, and an Elliptic Curve Cryptography (ECC) key\r
+ is represented using the 'publicKey' described in\r
+ RFC 5915.";\r
+ reference\r
+ "RFC 8017: Public-Key Cryptography Standards (PKCS) #1:\r
+ RSA Cryptography Specifications Version 2.2.\r
+ RFC 5915: Elliptic Curve Private Key Structure.";\r
+ }\r
+ }\r
+\r
+ grouping asymmetric-key-pair-grouping {\r
+ description\r
+ "A private/public key pair.\r
+ The 'algorithm', 'public-key', and 'private-key' nodes are\r
+ not mandatory because they MAY be defined in <operational>.\r
+ Implementations SHOULD assert that these values are either\r
+ configured or that they exist in <operational>.";\r
+ uses public-key-grouping;\r
+ leaf private-key {\r
+ nacm:default-deny-all;\r
+ type union {\r
+ type binary;\r
+ type enumeration {\r
+ enum permanently-hidden {\r
+ description\r
+ "The private key is inaccessible due to being\r
+ protected by the system (e.g., a cryptographic\r
+ hardware module).\r
+\r
+ How such keys are backed-up and restored, if\r
+ at all, is implementation specific.\r
+\r
+ Servers MUST fail any attempt by a client to\r
+ configure this value directly. This value is\r
+ not set by clients, but rather is set by the\r
+ 'generate-hidden-key' and 'install-hidden-key'\r
+ actions.";\r
+ }\r
+ }\r
+ }\r
+ must '../public-key';\r
+ description\r
+ "A binary that contains the value of the private key. The\r
+ interpretation of the content is defined by the key\r
+ algorithm. For example, a DSA key is an integer, an RSA\r
+ key is represented as RSAPrivateKey as defined in\r
+ RFC 8017, and an Elliptic Curve Cryptography (ECC) key\r
+ is represented as ECPrivateKey as defined in RFC 5915.";\r
+ reference\r
+ "RFC 8017: Public-Key Cryptography Standards (PKCS) #1:\r
+ RSA Cryptography Specifications Version 2.2.\r
+ RFC 5915: Elliptic Curve Private Key Structure.";\r
+ } // private-key\r
+\r
+ action generate-hidden-key {\r
+ nacm:default-deny-all;\r
+ description\r
+ "Requests the device to generate a hidden key using the\r
+ specified asymmetric key algorithm. This action is\r
+ used to request the system to generate a key that is\r
+ 'permanently-hidden', perhaps protected by a cryptographic\r
+ hardware module. The resulting asymmetric key values are\r
+ considered operational state and hence present only in\r
+ <operational> and bound to the lifetime of the parent\r
+ 'config true' node. Subsequent invocations of this or\r
+ the 'install-hidden-key' action are denied with error-tag\r
+ 'data-exists'.";\r
+ input {\r
+ leaf algorithm {\r
+ type asymmetric-key-algorithm-ref;\r
+ mandatory true;\r
+ description\r
+ "The algorithm to be used when generating the\r
+ asymmetric key.";\r
+ reference\r
+ "RFC CCCC: Common YANG Data Types for Cryptography";\r
+ }\r
+ }\r
+ } // generate-hidden-key\r
+\r
+ action install-hidden-key {\r
+ nacm:default-deny-all;\r
+ description\r
+ "Requests the device to load the specified values into\r
+ a hidden key. The resulting asymmetric key values are\r
+ considered operational state and hence present only in\r
+ <operational> and bound to the lifetime of the parent\r
+ 'config true' node. Subsequent invocations of this\r
+ or the 'generate-hidden-key' action are denied with\r
+ error-tag 'data-exists'.";\r
+ input {\r
+ leaf algorithm {\r
+ type asymmetric-key-algorithm-ref;\r
+ mandatory true;\r
+ description\r
+ "The algorithm to be used when generating the\r
+ asymmetric key.";\r
+ reference\r
+ "RFC CCCC: Common YANG Data Types for Cryptography";\r
+ }\r
+ leaf public-key {\r
+ type binary;\r
+ description\r
+ "A binary that contains the value of the public key.\r
+ The interpretation of the content is defined by the key\r
+ algorithm. For example, a DSA key is an integer, an\r
+ RSA key is represented as RSAPublicKey as defined in\r
+ RFC 8017, and an Elliptic Curve Cryptography (ECC) key\r
+ is represented using the 'publicKey' described in\r
+ RFC 5915.";\r
+ reference\r
+ "RFC 8017: Public-Key Cryptography Standards (PKCS) #1:\r
+ RSA Cryptography Specifications Version 2.2.\r
+ RFC 5915: Elliptic Curve Private Key Structure.";\r
+ }\r
+ leaf private-key {\r
+ type binary;\r
+ description\r
+ "A binary that contains the value of the private key.\r
+ The interpretation of the content is defined by the key\r
+ algorithm. For example, a DSA key is an integer, an RSA\r
+ key is represented as RSAPrivateKey as defined in\r
+ RFC 8017, and an Elliptic Curve Cryptography (ECC) key\r
+ is represented as ECPrivateKey as defined in RFC 5915.";\r
+ reference\r
+ "RFC 8017: Public-Key Cryptography Standards (PKCS) #1:\r
+ RSA Cryptography Specifications Version 2.2.\r
+ RFC 5915: Elliptic Curve Private Key Structure.";\r
+ }\r
+ }\r
+ } // install-hidden-key\r
+ } // asymmetric-key-pair-grouping\r
+\r
+\r
+ grouping trust-anchor-cert-grouping {\r
+ description\r
+ "A trust anchor certificate, and a notification for when\r
+ it is about to (or already has) expire.";\r
+ leaf cert {\r
+ nacm:default-deny-write;\r
+ type trust-anchor-cert-cms;\r
+ description\r
+ "The binary certificate data for this certificate.";\r
+ reference\r
+ "RFC YYYY: Common YANG Data Types for Cryptography";\r
+ }\r
+ notification certificate-expiration {\r
+ description\r
+ "A notification indicating that the configured certificate\r
+ is either about to expire or has already expired. When to\r
+ send notifications is an implementation specific decision,\r
+ but it is RECOMMENDED that a notification be sent once a\r
+ month for 3 months, then once a week for four weeks, and\r
+ then once a day thereafter until the issue is resolved.";\r
+ leaf expiration-date {\r
+ type yang:date-and-time;\r
+ mandatory true;\r
+ description\r
+ "Identifies the expiration date on the certificate.";\r
+ }\r
+ }\r
+ }\r
+\r
+ grouping trust-anchor-certs-grouping {\r
+ description\r
+ "A list of trust anchor certificates, and a notification\r
+ for when one is about to (or already has) expire.";\r
+ leaf-list cert {\r
+ nacm:default-deny-write;\r
+ type trust-anchor-cert-cms;\r
+ description\r
+ "The binary certificate data for this certificate.";\r
+ reference\r
+ "RFC YYYY: Common YANG Data Types for Cryptography";\r
+ }\r
+ notification certificate-expiration {\r
+ description\r
+ "A notification indicating that the configured certificate\r
+ is either about to expire or has already expired. When to\r
+ send notifications is an implementation specific decision,\r
+ but it is RECOMMENDED that a notification be sent once a\r
+ month for 3 months, then once a week for four weeks, and\r
+ then once a day thereafter until the issue is resolved.";\r
+ leaf expiration-date {\r
+ type yang:date-and-time;\r
+ mandatory true;\r
+ description\r
+ "Identifies the expiration date on the certificate.";\r
+ }\r
+ }\r
+ }\r
+\r
+ grouping end-entity-cert-grouping {\r
+ description\r
+ "An end entity certificate, and a notification for when\r
+ it is about to (or already has) expire.";\r
+ leaf cert {\r
+ nacm:default-deny-write;\r
+ type end-entity-cert-cms;\r
+ description\r
+ "The binary certificate data for this certificate.";\r
+ reference\r
+ "RFC YYYY: Common YANG Data Types for Cryptography";\r
+ }\r
+ notification certificate-expiration {\r
+ description\r
+ "A notification indicating that the configured certificate\r
+ is either about to expire or has already expired. When to\r
+ send notifications is an implementation specific decision,\r
+ but it is RECOMMENDED that a notification be sent once a\r
+ month for 3 months, then once a week for four weeks, and\r
+ then once a day thereafter until the issue is resolved.";\r
+ leaf expiration-date {\r
+ type yang:date-and-time;\r
+ mandatory true;\r
+ description\r
+ "Identifies the expiration date on the certificate.";\r
+ }\r
+ }\r
+ }\r
+\r
+ grouping end-entity-certs-grouping {\r
+ description\r
+ "A list of end entity certificates, and a notification for\r
+ when one is about to (or already has) expire.";\r
+ leaf-list cert {\r
+ nacm:default-deny-write;\r
+ type end-entity-cert-cms;\r
+ description\r
+ "The binary certificate data for this certificate.";\r
+ reference\r
+ "RFC YYYY: Common YANG Data Types for Cryptography";\r
+ }\r
+ notification certificate-expiration {\r
+ description\r
+ "A notification indicating that the configured certificate\r
+ is either about to expire or has already expired. When to\r
+ send notifications is an implementation specific decision,\r
+ but it is RECOMMENDED that a notification be sent once a\r
+ month for 3 months, then once a week for four weeks, and\r
+ then once a day thereafter until the issue is resolved.";\r
+ leaf expiration-date {\r
+ type yang:date-and-time;\r
+ mandatory true;\r
+ description\r
+ "Identifies the expiration date on the certificate.";\r
+ }\r
+ }\r
+ }\r
+\r
+ grouping asymmetric-key-pair-with-cert-grouping {\r
+ description\r
+ "A private/public key pair and an associated certificate.";\r
+ uses asymmetric-key-pair-grouping;\r
+ uses end-entity-cert-grouping;\r
+\r
+ action generate-certificate-signing-request {\r
+ nacm:default-deny-all;\r
+ description\r
+ "Generates a certificate signing request structure for\r
+ the associated asymmetric key using the passed subject\r
+ and attribute values. The specified assertions need\r
+ to be appropriate for the certificate's use. For\r
+ example, an entity certificate for a TLS server\r
+ SHOULD have values that enable clients to satisfy\r
+ RFC 6125 processing.";\r
+ input {\r
+ leaf subject {\r
+ type binary;\r
+ mandatory true;\r
+ description\r
+ "The 'subject' field per the CertificationRequestInfo\r
+ structure as specified by RFC 2986, Section 4.1\r
+ encoded using the ASN.1 distinguished encoding\r
+ rules (DER), as specified in ITU-T X.690.";\r
+ reference\r
+ "RFC 2986:\r
+ PKCS #10: Certification Request Syntax\r
+ Specification Version 1.7.\r
+ ITU-T X.690:\r
+ Information technology - ASN.1 encoding rules:\r
+ Specification of Basic Encoding Rules (BER),\r
+ Canonical Encoding Rules (CER) and Distinguished\r
+ Encoding Rules (DER).";\r
+ }\r
+ leaf attributes {\r
+ type binary;\r
+ description\r
+ "The 'attributes' field from the structure\r
+ CertificationRequestInfo as specified by RFC 2986,\r
+ Section 4.1 encoded using the ASN.1 distinguished\r
+ encoding rules (DER), as specified in ITU-T X.690.";\r
+ reference\r
+ "RFC 2986:\r
+ PKCS #10: Certification Request Syntax\r
+ Specification Version 1.7.\r
+ ITU-T X.690:\r
+ Information technology - ASN.1 encoding rules:\r
+ Specification of Basic Encoding Rules (BER),\r
+ Canonical Encoding Rules (CER) and Distinguished\r
+ Encoding Rules (DER).";\r
+ }\r
+ }\r
+ output {\r
+ leaf certificate-signing-request {\r
+ type binary;\r
+ mandatory true;\r
+ description\r
+ "A CertificationRequest structure as specified by\r
+ RFC 2986, Section 4.2 encoded using the ASN.1\r
+ distinguished encoding rules (DER), as specified\r
+ in ITU-T X.690.";\r
+ reference\r
+ "RFC 2986:\r
+ PKCS #10: Certification Request Syntax\r
+ Specification Version 1.7.\r
+ ITU-T X.690:\r
+ Information technology - ASN.1 encoding rules:\r
+ Specification of Basic Encoding Rules (BER),\r
+ Canonical Encoding Rules (CER) and Distinguished\r
+ Encoding Rules (DER).";\r
+ }\r
+ }\r
+ } // generate-certificate-signing-request\r
+ } // asymmetric-key-pair-with-cert-grouping\r
+\r
+\r
+ grouping asymmetric-key-pair-with-certs-grouping {\r
+ description\r
+ "A private/public key pair and associated certificates.";\r
+ uses asymmetric-key-pair-grouping;\r
+ container certificates {\r
+ nacm:default-deny-write;\r
+ description\r
+ "Certificates associated with this asymmetric key.\r
+ More than one certificate supports, for instance,\r
+ a TPM-protected asymmetric key that has both IDevID\r
+ and LDevID certificates associated.";\r
+ list certificate {\r
+ key "name";\r
+ description\r
+ "A certificate for this asymmetric key.";\r
+ leaf name {\r
+ type string;\r
+ description\r
+ "An arbitrary name for the certificate. If the name\r
+ matches the name of a certificate that exists\r
+ independently in <operational> (i.e., an IDevID),\r
+ then the 'cert' node MUST NOT be configured.";\r
+ }\r
+ uses end-entity-cert-grouping;\r
+ }\r
+ } // certificates\r
+\r
+ action generate-certificate-signing-request {\r
+ nacm:default-deny-all;\r
+ description\r
+ "Generates a certificate signing request structure for\r
+ the associated asymmetric key using the passed subject\r
+ and attribute values. The specified assertions need\r
+ to be appropriate for the certificate's use. For\r
+ example, an entity certificate for a TLS server\r
+ SHOULD have values that enable clients to satisfy\r
+ RFC 6125 processing.";\r
+ input {\r
+ leaf subject {\r
+ type binary;\r
+ mandatory true;\r
+ description\r
+ "The 'subject' field per the CertificationRequestInfo\r
+ structure as specified by RFC 2986, Section 4.1\r
+ encoded using the ASN.1 distinguished encoding\r
+ rules (DER), as specified in ITU-T X.690.";\r
+ reference\r
+ "RFC 2986:\r
+ PKCS #10: Certification Request Syntax\r
+ Specification Version 1.7.\r
+ ITU-T X.690:\r
+ Information technology - ASN.1 encoding rules:\r
+ Specification of Basic Encoding Rules (BER),\r
+ Canonical Encoding Rules (CER) and Distinguished\r
+ Encoding Rules (DER).";\r
+ }\r
+ leaf attributes {\r
+ type binary;\r
+ description\r
+ "The 'attributes' field from the structure\r
+ CertificationRequestInfo as specified by RFC 2986,\r
+ Section 4.1 encoded using the ASN.1 distinguished\r
+ encoding rules (DER), as specified in ITU-T X.690.";\r
+ reference\r
+ "RFC 2986:\r
+ PKCS #10: Certification Request Syntax\r
+ Specification Version 1.7.\r
+ ITU-T X.690:\r
+ Information technology - ASN.1 encoding rules:\r
+ Specification of Basic Encoding Rules (BER),\r
+ Canonical Encoding Rules (CER) and Distinguished\r
+ Encoding Rules (DER).";\r
+ }\r
+ }\r
+ output {\r
+ leaf certificate-signing-request {\r
+ type binary;\r
+ mandatory true;\r
+ description\r
+ "A CertificationRequest structure as specified by\r
+ RFC 2986, Section 4.2 encoded using the ASN.1\r
+ distinguished encoding rules (DER), as specified\r
+ in ITU-T X.690.";\r
+ reference\r
+ "RFC 2986:\r
+ PKCS #10: Certification Request Syntax\r
+ Specification Version 1.7.\r
+ ITU-T X.690:\r
+ Information technology - ASN.1 encoding rules:\r
+ Specification of Basic Encoding Rules (BER),\r
+ Canonical Encoding Rules (CER) and Distinguished\r
+ Encoding Rules (DER).";\r
+ }\r
+ }\r
+ } // generate-certificate-signing-request\r
+ } // asymmetric-key-pair-with-certs-grouping\r
+}\r
Code Review / oam / tr069-adapter.git / blobdiff