Subject: Re: [Nea] Two More PT-TLS Issues

From: Paul Sangster <[email-masked]>
Date: Mon, 12 Dec 2011 16:59:15 -0800

Steve,

Comments and proposals are in-lined...

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of 
> Stephen Hanna
> Sent: Tuesday, November 15, 2011 7:34 AM
> To: [email-masked]
> Subject: [Nea] Two More PT-TLS Issues
> 
> In preparing the slides for this week's NEA meeting, the chairs and 
> editors have uncovered two more PT-TLS issues that should be resolved. 
> I'm sorry that these weren't raised during WGLC but it's good that 
> they have been smoked out by the process and it's best to get them 
> resolved ASAP so here they are.
> Let's discuss these on email and also during the NEA WG meeting.
> 
> First, PT-TLS supports a mode where the NEA Client is the TLS Server 
> and the NEA Server is the TLS Client. In this mode, PT-TLS requires 
> that the NEA Client use an X.509 certificate to authenticate itself 
> during the TNC handshake (TLS server auth).
> No requirements are placed on how the NEA Server authenticates itself 
> in this mode, although such authentication is clearly highly 
> desirable. Since the NEA Server generally has an X.509 certificate for 
> the more common situation where the NEA Client is the TNC Client, the 
> simplest way to resolve this seems to be to require the NEA Server to 
> use its
> X.509 certificate to authenticate itself during the TLS handshake, 
> performing TLS mutual auth.
> This avoids the need for the NEA Client to support authenticating the 
> NEA Server with SASL, simplifying implementation and testing.

[PS:] Agreed.  I believe it was discussed that the NEA Server could still use the SASL authentication messages to further authentication the NEA Client.

> 
> In the NEA meeting at IETF 81, Trevor Freeman asked why PT-TLS doesn't 
> include a way to bind the inner SASL authentication to the TLS tunnel. 
> Without that, an attacker could forward a SASL authentication through 
> multiple PT-TLS tunnels. We agreed to figure out how to do channel 
> binding and put that in PT-TLS.
> However, that isn't present in the current draft.
> It should be added.

[PS:] Correct, section 3.8.1 was updated based upon the IETF 81 discussion to call out SASL GS2 mechanisms that can support channel bindings.  We will add more detail as to how this is integrated with PT-TLS to bind the channels for common GS2 mechanisms. 

> 
> Thanks,
> 
> Steve
> 
> _______________________________________________
> Nea mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nea

---

From: Stephen Hanna <[email-masked]>
Date: Mon, 19 Dec 2011 13:36:54 -0500

Paul,

I'm happy with the changes that you suggested below to
address these comments. And this is consistent with
what was discussed at the NEA meeting in Taipei.

If anyone has any concerns about these resolutions,
please raise them now. And if no concerns are raised,
let's consider this to be the WG consensus and have
Paul or the other PT-TLS editors make these changes.

Thanks,

Steve

> Paul Sangster
> Sent: Monday, December 12, 2011 7:59 PM
> To: Stephen Hanna; [email-masked]
> Subject: Re: [Nea] Two More PT-TLS Issues
> 
> Steve,
> 
> [PS:] Agreed.  I believe it was discussed that the NEA Server could
> still use the SASL authentication messages to further authentication
> the NEA Client.
> 
> >
> [PS:] Correct, section 3.8.1 was updated based upon the IETF 81
> discussion to call out SASL GS2 mechanisms that can support channel
> bindings.  We will add more detail as to how this is integrated with
> PT-TLS to bind the channels for common GS2 mechanisms.
> 
> >
> > Thanks,
> >
> > Steve
> >

---

From: Ira McDonald <[email-masked]>
Date: Mon, 19 Dec 2011 14:11:17 -0500

Hi,

I have no issues with Paul's suggested resolutions - thanks for
the thoughtful responses Paul.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG IPP WG
Co-Chair - TCG Trusted Mobility Solutions WG
Chair - TCG Embedded Systems Hardcopy SG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music/High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto:[email-masked]
Winter  579 Park Place  Saline, MI  48176  734-944-0094
Summer  PO Box 221  Grand Marais, MI 49839  906-494-2434