Subject: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-tls-02.txt

From: [email-masked]
Date: Wed, 21 Oct 2020 02:23:37 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Operations and Management Area Working Group WG of the IETF.

        Title           : Manufacturer Usage Description (MUD) (D)TLS Profiles for IoT Devices
        Authors         : Tirumaleswar Reddy
                          Dan Wing
                          Blake Anderson
	Filename        : draft-ietf-opsawg-mud-tls-02.txt
	Pages           : 32
	Date            : 2020-10-21

Abstract:
   This memo extends the Manufacturer Usage Description (MUD)
   specification to incorporate (D)TLS profile parameters.  This allows
   a network security service to identify unexpected (D)TLS usage, which
   can indicate the presence of unauthorized software or malware on an
   endpoint.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud-tls/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-opsawg-mud-tls-02
https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-mud-tls-02

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-opsawg-mud-tls-02

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: tirumal reddy <[email-masked]>
Date: Wed, 21 Oct 2020 15:13:10 +0530

Hi all,

Revised draft https://tools.ietf.org/html/draft-ietf-opsawg-mud-tls-02
addresses comments from Mohamed Boucadair.

Main changes are listed below:

a) Added two new YANG modules iana-tls-profile ((D)TLS parameters and
(D)TLS versions) and ietf-mud-tls (MUD (D)TLS Profile Extension).
b) updated to YANG module ietf-acl-tls to use iana-tls-profile
c) Added rules to update iana-tls-profile, and created registries for
(D)TLS versions and (D)TLS parameters.

Further comments and suggestions are welcome.

Cheers,
-Tiru

On Wed, 21 Oct 2020 at 14:54, <[email-masked]> wrote:

> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg
>

---

From: Michael Richardson <[email-masked]>
Date: Wed, 21 Oct 2020 12:54:12 -0400

> (D)TLS versions) and ietf-mud-tls (MUD (D)TLS Profile Extension).

I browsed through the differences.

Do I understand that iana-tls-profile would be updated by IANA as they handed
out TLS protocol numbers?

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: tirumal reddy <[email-masked]>
Date: Thu, 22 Oct 2020 12:12:37 +0530

On Wed, 21 Oct 2020 at 22:24, Michael Richardson <[email-masked]>
wrote:

> out TLS protocol numbers ?
>

Yes, iana-tls-profile will be updated by IANA. The procedure to update
(D)TLS versions/parameters registries and iana-tls-profile is explained in
https://tools.ietf.org/html/draft-ietf-opsawg-mud-tls-02#section-10.1

Cheers,
-Tiru

---

From: <[email-masked]>
Date: Thu, 22 Oct 2020 09:09:35 +0000

Hi Tiru, all,

Ideally, the version registry should be maintained and updated by the relevant (D)TLS specs. This can be part of draft-ietf-tls-dtls13 or draft-ietf-tls-rfc8446bis-00<https://tools.ietf.org/html/draft-ietf-tls-rfc8446bis-00#section-11>.

Cheers,
Med

De : OPSAWG [mailto:[email-masked]] De la part de tirumal reddy
Envoyé : jeudi 22 octobre 2020 08:43
À : Michael Richardson <[email-masked]>
Cc : opsawg <[email-masked]>
Objet : Re: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-tls-02.txt

On Wed, 21 Oct 2020 at 22:24, Michael Richardson <[email-masked]<mailto:[email-masked]>> wrote:

Yes, iana-tls-profile will be updated by IANA. The procedure to update (D)TLS versions/parameters registries and iana-tls-profile is explained in https://tools.ietf.org/html/draft-ietf-opsawg-mud-tls-02#section-10.1

Cheers,
-Tiru

--
Michael Richardson <[email-masked]<mailto:[email-masked]>>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: tirumal reddy <[email-masked]>
Date: Thu, 22 Oct 2020 17:03:56 +0530

On Thu, 22 Oct 2020 at 14:39, <[email-masked]> wrote:

> Hi Tiru, all,
>
>
>
> Ideally, the version registry should be maintained and updated by the
> relevant (D)TLS specs. This can be part of draft-ietf-tls-dtls13 or
> draft-ietf-tls-rfc8446bis-00
> <https://tools.ietf.org/html/draft-ietf-tls-rfc8446bis-00#section-11>.
>

TLS does not define any version specific registry maintained by IANA. In
TLS 1.3, version support is determined by the presence of
supported_versions extension and the version field should have the
value 0x0304.
In prior versions, legacy_version field is used to indicate older TLS
version (e.g., 0x0304 is used to indicate TLS 1.2).

Cheers,
-Tiru

>
>
> Cheers,
>
> Med
>
>
>
> *De :* OPSAWG [mailto:[email-masked]] *De la part de* tirumal
> reddy
> *Envoyé :* jeudi 22 octobre 2020 08:43
> *À :* Michael Richardson <[email-masked]>
> *Cc :* opsawg <[email-masked]>
> *Objet :* Re: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-tls-02.txt
>
>
>

---

From: <[email-masked]>
Date: Thu, 22 Oct 2020 11:47:42 +0000

Re-,

Yes, I know.

This is why I suggested it to be added on TLS-related specs. That’s superior to the current approach in the draft.

Cheers,
Med

De : tirumal reddy [mailto:[email-masked]]
Envoyé : jeudi 22 octobre 2020 13:34
À : BOUCADAIR Mohamed TGI/OLN <[email-masked]>
Cc : Michael Richardson <[email-masked]>; opsawg <[email-masked]>
Objet : Re: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-tls-02.txt

On Thu, 22 Oct 2020 at 14:39, <[email-masked]<mailto:[email-masked]>> wrote:
Hi Tiru, all,

TLS does not define any version specific registry maintained by IANA. In TLS 1.3, version support is determined by the presence of supported_versions extension and the version field should have the value 0x0304. In prior versions, legacy_version field is used to indicate older TLS version (e.g., 0x0304 is used to indicate TLS 1.2).

Cheers,
-Tiru

Cheers,
Med

De : OPSAWG [mailto:[email-masked]<mailto:[email-masked]>] De la part de tirumal reddy
Envoyé : jeudi 22 octobre 2020 08:43
À : Michael Richardson <[email-masked]<mailto:[email-masked]>>
Cc : opsawg <[email-masked]<mailto:[email-masked]>>
Objet : Re: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-tls-02.txt

Cheers,
-Tiru

Thank you.

---

From: tirumal reddy <[email-masked]>
Date: Fri, 23 Oct 2020 17:55:53 +0530

On Thu, 22 Oct 2020 at 17:17, <[email-masked]> wrote:

> Re-,
>
>
>
> Yes, I know.
>
>
>
> This is why I suggested it to be added on TLS-related specs. That’s
> superior to the current approach in the draft.
>

I have updated the draft to discuss the rationale for adding a new
registry, please see Section 5.3 in
https://github.com/tireddy2/MUD-TLS-profile/blob/master/draft-ietf-opsawg-mud-tls-03.txt

-Tiru

>
>
> Cheers,
>
> Med
>
>
>
> *De :* tirumal reddy [mailto:[email-masked]]
> *Envoyé :* jeudi 22 octobre 2020 13:34
> *À :* BOUCADAIR Mohamed TGI/OLN <[email-masked]>
> *Cc :* Michael Richardson <[email-masked]>; opsawg <[email-masked]
> >
> supported_versions extension and the version field should have the value 0x0304.

---

From: <[email-masked]>
Date: Fri, 23 Oct 2020 12:31:42 +0000

Hi Tiru,

Thanks.

I sent you a PR (https://github.com/tireddy2/MUD-TLS-profile/pull/5/files)

Cheers,
Med

Envoyé : vendredi 23 octobre 2020 14:26

On Thu, 22 Oct 2020 at 17:17, <[email-masked]<mailto:[email-masked]>> wrote:
Re-,

Yes, I know.

I have updated the draft to discuss the rationale for adding a new registry, please see Section 5.3 in https://github.com/tireddy2/MUD-TLS-profile/blob/master/draft-ietf-opsawg-mud-tls-03.txt

-Tiru

Cheers,
Med

De : tirumal reddy [mailto:[email-masked]<mailto:[email-masked]>]
Envoyé : jeudi 22 octobre 2020 13:34
À : BOUCADAIR Mohamed TGI/OLN <[email-masked]<mailto:[email-masked]>>
Cc : Michael Richardson <[email-masked]<mailto:[email-masked]>>; opsawg <[email-masked]<mailto:[email-masked]>>
Objet : Re: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-tls-02.txt

Cheers,
-Tiru

Cheers,
Med

Cheers,
-Tiru

Thank you.

Thank you.

---

From: tirumal reddy <[email-masked]>
Date: Tue, 27 Oct 2020 12:49:44 +0530

> I sent you a PR (https://github.com/tireddy2/MUD-TLS-profile/pull/5/files)

Thanks, merged PR.

Cheers,
-Tiru

> *Envoyé :* vendredi 23 octobre 2020 14:26