1. NETCONF over TLS Mohamad Badra draft-ietf-netconf-tls-03 www.ietf.org/internet-drafts/draft-ietf-netconf-tls-03.txt 72nd IETF - Dublin, Ireland

2. 2 Changes since version 02 Enabling Third Party Authentication using Passwords  WG consensus: do nothing concerning passwords modifying the order of parameters of the inner hash  hashes can be the same even though both the password and psk_identity differs Old: PSK = SHA-1(SHA-1(password + psk_identity + "Key Pad for Netconf") + psk_identity_hint) New: PSK = SHA-1(SHA-1(password + "Key Pad for Netconf" + psk_identity) + psk_identity_hint) Some editorial issues 24/10/2015 72nd IETF - Dublin

3. 3 Implementations Two independant implementations  OpenSSL The patch is available at:  http://ineovation.fr/netconfovertls/tls_netconf.patch To test it, follow the instructions available at:  http://ineovation.fr/netconfovertls/readme.txt  GNUTLS The compressed sources:  http://alpha.gnu.org/gnu/gnutls/gnutls-2.3.12.tar.bz2  ftp://alpha.gnu.org/gnu/gnutls/gnutls-2.3.12.tar.bz2 The Windows binaries:  http://josefsson.org/gnutls4win/gnutls-2.3.12.exe  http://josefsson.org/gnutls4win/gnutls-2.3.12.zip  Documentation is available online at:  http://www.gnu.org/software/gnutls/manual/html_node/Example-server-PSK- connection.html  http://www.gnu.org/software/gnutls/manual/html_node/Example-client-PSK- connection.html  http://www.gnu.org/software/gnutls/manual/html_node/Authentication-using-PSK.html 24/10/201572nd IETF - Dublin

4. 4 Implementations Test Vectors for the PSK Derivation Function password = password psk_identity = psk_identity psk_identity_hint = psk_identity_hint The inner SHA-1 value (in hex): inner := SHA-1(psk_identity + "Key Pad for Netconf" + password) == SHA-1("psk_identityKey Pad for Netconfpassword") => 6d6eeb6a b8d0466b 45245d07 47d86726 b41b868c The outer SHA-1 value (in hex): outer := SHA-1(inner + psk_identity_hint) => 88f3824b 3e5659f5 2d00e959 bacab954 b6540344 24/10/201572nd IETF - Dublin

5. 5 24/10/2015 Ongoing works WGLC.. 72nd IETF - Dublin

6. Thank you!