Subject: [regext] regext - New Meeting Session Request for IETF 105

From: IETF Meeting Session Request Tool <[email-masked]>
Date: Fri, 07 Jun 2019 06:13:37 -0700

A new meeting session request has just been submitted by James Galvin, a Chair of the regext working group.

---------------------------------------------------------
Working Group Name: Registration Protocols Extensions
Area Name: Applications and Real-Time Area
Session Requester: James Galvin

Number of Sessions: 1
Length of Session(s):  2 Hours
Number of Attendees: 50
Conflicts to Avoid: 
 First Priority: dnssd dnsop dprive
 Second Priority: saag oauth doh

People who must be present:
  James Galvin
  Barry Leiba
  Antoin Verschuren

Resources Requested:

Special Requests:
  Please avoid any DNS related BOF&#39;s.

---------------------------------------------------------

---

From: Antoin Verschuren <[email-masked]>
Date: Fri, 14 Jun 2019 15:31:24 +0200

This is a request for agenda items for IETF 105 in Montreal.
If you have any agenda items please send them to the list.

As you may have seen, we have published a new milestone list.
The order of agenda items will follow that list.
The chairs want to remind the working group that we have a milestone date for one document in July.
If you need to focus, then focus on reviewing that document (https://datatracker.ietf.org/doc/draft-ietf-regext-login-security/)

We have a 2 hour slot, so we should have enough time for additional presentations, but let’s do the work first.

Regards,

Jim and Antoin

- -- 
Antoin Verschuren

Tweevoren 6, 5672 SB Nuenen, NL
M: +31 6 37682392

> Op 7 jun. 2019, om 15:13 heeft IETF Meeting Session Request Tool <[email-masked]> het volgende geschreven:
> 
> 
> 
> _______________________________________________
> regext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/regext

---

From: "Gould, James" <[email-masked]>
Date: Fri, 14 Jun 2019 14:05:19 +0000

Antoin,

There are no known open items remaining with draft-ietf-regext-login-security, so I encourage the WG to review it and provide feedback for discussion.

Thanks,

—

JG

James Gould
Distinguished Engineer
[email-masked]

703-948-3271
12061 Bluemont Way
Reston, VA 20190

Verisign.com<http://verisigninc.com/>

From: regext <[email-masked]> on behalf of Antoin Verschuren <[email-masked]>
Date: Friday, June 14, 2019 at 9:31 AM
To: regext <[email-masked]>
Subject: [EXTERNAL] [regext] Call for agenda items for IETF 105

Regards,

Jim and Antoin

- --
Antoin Verschuren

Op 7 jun. 2019, om 15:13 heeft IETF Meeting Session Request Tool <[email-masked]<mailto:[email-masked]>> het volgende geschreven:

Number of Sessions: 1

Resources Requested:

Special Requests:

_______________________________________________
regext mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/regext

---

From: Mario Loffredo <[email-masked]>
Date: Fri, 21 Jun 2019 09:56:26 +0200

Hi Jim And Antoin,

I need 5 minutes for each of my three drafts just to summarize the 
updates from the last meeting and to gather further feedbacks, if any.

Best,

mario

Il 14/06/2019 15:31, Antoin Verschuren ha scritto:
> If you need to focus, then focus on reviewing that document 
> (https://datatracker.ietf.org/doc/draft-ietf-regext-login-security/)
>
> We have a 2 hour slot, so we should have enough time for additional 
> presentations, but let’s do the work first.
>
> Regards,
>
> Jim and Antoin
>
> - -- 
> Antoin Verschuren
>
>> Op 7 jun. 2019, om 15:13 heeft IETF Meeting Session Request Tool 
>> <[email-masked] <mailto:[email-masked]>> het 
>> volgende geschreven:
>>
>>
>>
>> A new meeting session request has just been submitted by James 
>> Galvin, a Chair of the regext working group.
>>
>>
>> [email-masked] <mailto:[email-masked]>

-- 
Dr. Mario Loffredo
Servizi Internet e Sviluppo Tecnologico
CNR - Istituto di Informatica e Telematica
via G. Moruzzi 1, I-56124 PISA, Italy
E-Mail: [email-masked]
Phone: +39.0503153497
Web: http://www.iit.cnr.it/mario.loffredo

---

From: Antoin Verschuren <[email-masked]>
Date: Fri, 21 Jun 2019 15:22:36 +0200

Dear Working Group,

We believe the draft draft-ietf-regext-login-security still has an open issue from Patrick Meczek where James response should be confirmed, but other than that the authors indicate they did not receive any more feedback, both negative, but also not positive.
Since this draft is due for July, so before the IETF 105, we would like to stress that before we can issue a last call, we would very much like to know if this draft has had enough review. If it has, than we can issue a last call before IETF 105

So, Who reviewed the document and had no issues left?

- -- 
Antoin Verschuren

> Op 14 jun. 2019, om 16:05 heeft Gould, James <[email-masked]> het volgende geschreven:
> 
> Antoin,
>  
> [email-masked] <x-msg://1/[email-masked]>
> 
> 703-948-3271
> 12061 Bluemont Way
> Reston, VA 20190
> 
> Verisign.com <http://verisigninc.com/>
>  
> If you need to focus, then focus on reviewing that document (https://datatracker.ietf.org/doc/draft-ietf-regext-login-security/ <https://datatracker.ietf.org/doc/draft-ietf-regext-login-security/>)
>  
>> Op 7 jun. 2019, om 15:13 heeft IETF Meeting Session Request Tool <[email-masked] <mailto:[email-masked]>> het volgende geschreven:
>>  
>> 
>>

---

From: "Gould, James" <[email-masked]>
Date: Fri, 21 Jun 2019 13:50:19 +0000

Antoin,

What open issue from Patrick Mevzek where my response should be confirmed are you referring to?

Thanks,

—

JG

James Gould
Distinguished Engineer
[email-masked]

703-948-3271
12061 Bluemont Way
Reston, VA 20190

From: regext <[email-masked]> on behalf of Antoin Verschuren <[email-masked]>
Date: Friday, June 21, 2019 at 9:22 AM
To: "[email-masked]" <[email-masked]>
Subject: [EXTERNAL] [regext] draft-ietf-regext-login-security

Dear Working Group,

- --
Antoin Verschuren

Op 14 jun. 2019, om 16:05 heeft Gould, James <[email-masked]<mailto:[email-masked]>> het volgende geschreven:

Antoin,

Thanks,

—

JG

James Gould
Distinguished Engineer
[email-masked]<x-msg://1/[email-masked]>

703-948-3271
12061 Bluemont Way
Reston, VA 20190

From: regext <[email-masked]<mailto:[email-masked]>> on behalf of Antoin Verschuren <[email-masked]<mailto:[email-masked]>>
Date: Friday, June 14, 2019 at 9:31 AM
To: regext <[email-masked]<mailto:[email-masked]>>
Subject: [EXTERNAL] [regext] Call for agenda items for IETF 105

Regards,

Jim and Antoin

- --
Antoin Verschuren

Number of Sessions: 1

Resources Requested:

Special Requests:

---

From: Gustavo Lozano <[email-masked]>
Date: Fri, 21 Jun 2019 23:43:21 +0000

Antoin, Jim,

I think that 20 minutes should suffice to talk about the two data escrow drafts.

Regards,
Gustavo

From: regext <[email-masked]> on behalf of Antoin Verschuren <[email-masked]>
Date: Friday, June 14, 2019 at 06:32
To: regext <[email-masked]>
Subject: [Ext] [regext] Call for agenda items for IETF 105

As you may have seen, we have published a new milestone list.
The order of agenda items will follow that list.
The chairs want to remind the working group that we have a milestone date for one document in July.
If you need to focus, then focus on reviewing that document (https://datatracker.ietf.org/doc/draft-ietf-regext-login-security/ [datatracker.ietf.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dregext-2Dlogin-2Dsecurity_&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=VbweciUcwYQpIOZDSxl0ezGd1hGDtd-0BvgAgfmwfE0&m=cGixg8PBiZTjaagxsoLgSQTkI3oi3NC-6eCRE6rpUM4&s=bs1qo-9GvAHoyeBBS8oXpJ_8pAEFRDtxW0kABRq2QUA&e=>)

Regards,

Jim and Antoin

- --
Antoin Verschuren

Number of Sessions: 1

Resources Requested:

Special Requests:

---

From: George Michaelson <[email-masked]>
Date: Tue, 25 Jun 2019 10:43:18 +1000

Could we have 5 minutes to discuss how the "two track model" is
working? I certainly don't want to change horses mid-stream, I just
think its sensible to include time up-front to discuss how people feel
about the EPP/RDAP progression in this model.

-G

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Tue, 25 Jun 2019 13:06:05 +0000

From: regext <[email-masked]> On Behalf Of Antoin Verschuren
Sent: Friday, June 21, 2019 9:23 AM
To: [email-masked]
Subject: [EXTERNAL] [regext] draft-ietf-regext-login-security

Dear Working Group,

[SAH]: I’ve reviewed the document. I see only one minor issue: the TBD in Section 7 should be removed before starting a last call.

Scott

---

From: "Gould, James" <[email-masked]>
Date: Tue, 25 Jun 2019 18:58:37 +0000

The TBD in Section 7 has been removed in draft-ietf-regext-login-security-02.

—

JG

James Gould
Distinguished Engineer
[email-masked]

703-948-3271
12061 Bluemont Way
Reston, VA 20190

From: regext <[email-masked]> on behalf of "Hollenbeck, Scott" <shollenbeck=[email-masked]>
Date: Tuesday, June 25, 2019 at 9:06 AM
To: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: [EXTERNAL] Re: [regext] draft-ietf-regext-login-security

Dear Working Group,

Scott

---

From: Martin Casanova <[email-masked]>
Date: Wed, 26 Jun 2019 15:00:23 +0200

Hello

I've also reviewed the document again and it looks fine to me except for
some doubts about the right interpretation of the attribute "duration".
Sorry it did not occur to me earlier but maybe its just unclear to me..

Definition

   "duration":  Defines the duration that a statistical event is
       associated with.

In the examples of events that have a duration

eg.

   <loginSec:event
     type="stat"
     name="failedLogins"
     level="warning"
     value="100"
     duration="P1D">
     Excessive invalid daily logins
   </loginSec:event>

How is P1D defined ? This must be from ISO 8601 isn't it? A reference to
it may helpful for people like me that didn't know it - or is it already
implicitly referred somewhere?

Java knows now a difference between the concept of duration and period
(https://docs.oracle.com/javase/tutorial/datetime/iso/period.html)
So mixing the the terms in name and value is a bit confusing to me as
Java programmer but ISO-8601 was here first I guess -  so all good.. :)

What is still unclear to me is the common understanding of what P1D
refers to.

Does duration relate to the value="100" so a max of 100 failed logins
must occur in one day for the event to be triggered.
In that case is the event is sent only one time with the next successful
login but its cause may has occurred any time in the past.

An alternative interpretation is that duration refers to the last 24
hours since the successful login response (including the event) is
sent.  (or the last day according to UTC.?)
Would the event still be sent when a series of more than 100 failed
logins occurred, flowed by a successful login only a week later ? I
guess not since more than a day has passed already right ?

Thanks for clarifying.

Martin

--- 
SWITCH 
Martin Casanova, Domain Applications
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland 
phone +41 44 268 15 55, direct +41 44 268 16 25
[email-masked], www.switch.ch 
 
Working for a better digital world

On 25.06.19 20:58, Gould, James wrote:
> *James Gould
> *Distinguished Engineer
> *From: *regext <[email-masked]> on behalf of "Hollenbeck,
> Scott" <shollenbeck=[email-masked]>
> *Date: *Tuesday, June 25, 2019 at 9:06 AM
> *To: *"[email-masked]" <[email-masked]>, "[email-masked]"
> <[email-masked]>
> *Subject: *[EXTERNAL] Re: [regext] draft-ietf-regext-login-security
>
>  
>
> *From:* regext <[email-masked]> *On Behalf Of *Antoin Verschuren
> *Sent:* Friday, June 21, 2019 9:23 AM
> *To:* [email-masked]
> *Subject:* [EXTERNAL] [regext] draft-ietf-regext-login-security
>
>  
>
> Dear Working Group,
>
>  
>
> We believe the draft draft-ietf-regext-login-security still has an
> open issue from Patrick Meczek where James response should be
> confirmed, but other than that the authors indicate they did
> not receive any more feedback, both negative, but also not positive.
>
> Since this draft is due for July, so before the IETF 105, we would
> like to stress that before we can issue a last call, we would very
> much like to know if this draft has had enough review. If it has, than
> we can issue a last call before IETF 105
>
>
>
>
> */ /*
> [SAH]: I’ve reviewed the document. I see only one minor issue: the TBD
> in Section 7 should be removed before starting a last call.
>
>  
>
> Scott
>
>

--

---

From: "Gould, James" <[email-masked]>
Date: Wed, 26 Jun 2019 15:30:03 +0000

Martin,

Thank you for re-reviewing the draft.  I provide responses to your feedback below.

—

JG

James Gould
Distinguished Engineer
[email-masked]

703-948-3271
12061 Bluemont Way
Reston, VA 20190

From: regext <[email-masked]> on behalf of Martin Casanova <[email-masked]>
Date: Wednesday, June 26, 2019 at 9:01 AM
To: "[email-masked]" <[email-masked]>
Subject: [EXTERNAL] Re: [regext] draft-ietf-regext-login-security

Hello

I've also reviewed the document again and it looks fine to me except for some doubts about the right interpretation of the attribute "duration".
Sorry it did not occur to me earlier but maybe its just unclear to me..

Definition

       associated with.

eg.

   <loginSec:event

     type="stat"

     name="failedLogins"

     level="warning"

     value="100"

     duration="P1D">

   </loginSec:event>

How is P1D defined ? This must be from ISO 8601 isn't it? A reference to it may helpful for people like me that didn't know it - or is it already implicitly referred somewhere?

JG - The “duration” is defined using the XML schema “duration” type (https://www.w3.org/TR/2004/REC-xmlschema-2-20041028/#duration).  I could update the description of the “duration” attribute to be explicit about the use of the XML schema duration primitive datatype, such as the following.  Does this help?

       associated with.  The format of the duration is defined by the
       duration primitive datatype in [W3C.REC-xmlschema-2-20041028<https://tools.ietf.org/html/draft-ietf-regext-login-security-02#ref-W3C.REC-xmlschema-2-20041028>].

Java knows now a difference between the concept of duration and period (https://docs.oracle.com/javase/tutorial/datetime/iso/period.html)
So mixing the the terms in name and value is a bit confusing to me as Java programmer but ISO-8601 was here first I guess -  so all good.. :)

What is still unclear to me is the common understanding of what P1D refers to.

Does duration relate to the value="100" so a max of 100 failed logins must occur in one day for the event to be triggered.
In that case is the event is sent only one time with the next successful login but its cause may has occurred any time in the past.
An alternative interpretation is that duration refers to the last 24 hours since the successful login response (including the event) is sent.  (or the last day according to UTC.?)
Would the event still be sent when a series of more than 100 failed logins occurred, flowed by a successful login only a week later ? I guess not since more than a day has passed already right ?
JG – The “value” attribute for statistical events identifies the actual number that occurred over the defined duration ending when the login command was received.  The threshold when to include the statistical security event is up to server policy.  I would include all relevant statistical security events in each login response; otherwise the server and the client would need to maintain login command state.

Thanks for clarifying.

Martin

---

SWITCH

[email-masked]<mailto:[email-masked]>, www.switch.ch<http://www.switch.ch>

—

JG

James Gould
Distinguished Engineer
[email-masked]

703-948-3271
12061 Bluemont Way
Reston, VA 20190

From: regext <[email-masked]><mailto:[email-masked]> on behalf of "Hollenbeck, Scott" <shollenbeck=[email-masked]><mailto:shollenbeck=[email-masked]>
Date: Tuesday, June 25, 2019 at 9:06 AM
To: "[email-masked]"<mailto:[email-masked]> <[email-masked]><mailto:[email-masked]>, "[email-masked]"<mailto:[email-masked]> <[email-masked]><mailto:[email-masked]>
Subject: [EXTERNAL] Re: [regext] draft-ietf-regext-login-security

From: regext <[email-masked]><mailto:[email-masked]> On Behalf Of Antoin Verschuren
Sent: Friday, June 21, 2019 9:23 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [EXTERNAL] [regext] draft-ietf-regext-login-security

Dear Working Group,

Scott

regext mailing list

--

---

From: Martin Casanova <[email-masked]>
Date: Thu, 27 Jun 2019 09:08:03 +0200

James

About duration -  I could have actually known how it is defined by
looking at the XML Schema so maybe nothing needs to be added there.

If at all maybe a hint that the duration is "ending when the login
command was received"  would be helpful so the misinterpretation can be
avoided, for the next version in case there is more feedback...

Thanks.

Martin

On 26.06.19 17:30, Gould, James wrote:
> *From: *regext <[email-masked]> on behalf of Martin Casanova
> <[email-masked]>
> *Date: *Wednesday, June 26, 2019 at 9:01 AM
> *To: *"[email-masked]" <[email-masked]>
> I've also reviewed the document again and it looks fine to me except
> for some doubts about the right interpretation of the attribute
> "duration".
> How is P1D defined ? This must be from ISO 8601 isn't it? A reference
> to it may helpful for people like me that didn't know it - or is it
> already implicitly referred somewhere?
>
> JG - The “duration” is defined using the XML schema “duration” type
> (https://www.w3.org/TR/2004/REC-xmlschema-2-20041028/#duration).  I
> could update the description of the “duration” attribute to be
> explicit about the use of the XML schema duration primitive datatype,
> such as the following.  Does this help?
>
>        duration primitive datatype in [W3C.REC-xmlschema-2-20041028
> <https://tools.ietf.org/html/draft-ietf-regext-login-security-02#ref-W3C.REC-xmlschema-2-20041028>]. 
>
>  
>
> In that case is the event is sent only one time with the next
> successful login but its cause may has occurred any time in the past.
>
> JG – The “value” attribute for statistical events identifies the
> actual number that occurred over the defined duration ending when the
> login command was received.  The threshold when to include the
> statistical security event is up to server policy.  I would include
> all relevant statistical security events in each login response;
> otherwise the server and the client would need to maintain login
> command state.      
>
> Thanks for clarifying.
>
> Martin
>
> --- 
> SWITCH 
> [email-masked] <mailto:[email-masked]>, www.switch.ch <http://www.switch.ch> 
>  
>     *From: *regext <[email-masked]>
>     <mailto:[email-masked]> on behalf of "Hollenbeck, Scott"
>     <shollenbeck=[email-masked]>
>     <mailto:shollenbeck=[email-masked]>
>     *To: *"[email-masked]" <mailto:[email-masked]> <[email-masked]>
>     <mailto:[email-masked]>, "[email-masked]"
>     <mailto:[email-masked]> <[email-masked]> <mailto:[email-masked]>
>     *From:* regext <[email-masked]>
>     <mailto:[email-masked]> *On Behalf Of *Antoin Verschuren
>     *To:* [email-masked] <mailto:[email-masked]>
>     much like to know if this draft has had enough review. If it has,
>     than we can issue a last call before IETF 105
>
>
>
>
>
>     [SAH]: I’ve reviewed the document. I see only one minor issue: the
>     TBD in Section 7 should be removed before starting a last call.
>
>      
>
>     Scott
>
>
>

---

From: "Gould, James" <[email-masked]>
Date: Thu, 27 Jun 2019 14:14:57 +0000

Martin,

I’ll revise the description of the duration to include the “ending when the login command was received” and to clarify the format as in the following:

"duration":
Defines the duration that a statistical event is associated with, ending when the login command was received. The format of the duration is defined by the duration primitive datatype in [W3C.REC-xmlschema-2-20041028]<file:///Users/jgould/projects/github/login-security-extension/draft-ietf-regext-login-security.html#W3C.REC-xmlschema-2-20041028>.

I will post draft-ietf-regext-login-security-03 once I resolve the question raised by Antoin with “We believe the draft draft-ietf-regext-login-security still has an open issue from Patrick Meczek where James response should be confirmed”.  Antoin,  are you referring to the thread on representing the password format policy via a regular expression, which ended with the message https://mailarchive.ietf.org/arch/msg/regext/jnkj4pCqrz5aFbwYoyFp8puegYM?  If so, this was associated with draft-gould-regext-login-security-policy and not draft-ietf-regext-login-security.  The draft-gould-regext-login-security-policy defines the password format policy using a Perl-compatible Regular Expression (PCRE), which was at the heart of the issue.  Antoin is the open issue associated with a different topic?

Thanks,

—

JG

James Gould
Distinguished Engineer
[email-masked]

703-948-3271
12061 Bluemont Way
Reston, VA 20190

From: Martin Casanova <[email-masked]>
Date: Thursday, June 27, 2019 at 3:09 AM
To: James Gould <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: [EXTERNAL] Re: [regext] draft-ietf-regext-login-security

James

About duration -  I could have actually known how it is defined by looking at the XML Schema so maybe nothing needs to be added there.

If at all maybe a hint that the duration is "ending when the login command was received"  would be helpful so the misinterpretation can be avoided, for the next version in case there is more feedback...

Thanks.

Martin

—

JG

James Gould
Distinguished Engineer
[email-masked]

703-948-3271
12061 Bluemont Way
Reston, VA 20190

From: regext <[email-masked]><mailto:[email-masked]> on behalf of Martin Casanova <[email-masked]><mailto:[email-masked]>
Date: Wednesday, June 26, 2019 at 9:01 AM
To: "[email-masked]"<mailto:[email-masked]> <[email-masked]><mailto:[email-masked]>
Subject: [EXTERNAL] Re: [regext] draft-ietf-regext-login-security

Hello

Definition

       associated with.

eg.

   <loginSec:event

     type="stat"

     name="failedLogins"

     level="warning"

     value="100"

     duration="P1D">

   </loginSec:event>

Thanks for clarifying.

Martin

---

SWITCH

—

JG

James Gould
Distinguished Engineer
[email-masked]

703-948-3271
12061 Bluemont Way
Reston, VA 20190

Dear Working Group,

Scott

regext mailing list

--

--

---

SWITCH