Subject: Re: [Tzdist] Ticket #25

From: Tim Parenti <[email-masked]>
Date: Tue, 2 Sep 2014 01:35:02 -0400

Seems reasonable to me.

--
Tim Parenti

On 31 August 2014 11:51, Cyrus Daboo <[email-masked]> wrote:

> Hi,
> For <http://trac.tools.ietf.org/wg/tzdist/trac/ticket/25> I propose
> adding the following text to the last paragraph of the Security
> Considerations (Section 9):
>
>    Servers MAY require some form of authentication or authorization of
>    clients (including secondary servers) to restrict which clients are
>    allowed to access their service, or provide better identification of
>    errant clients. As such, servers MAY require HTTP-based authentication
>    as per [RFC 7235].
>
> --
> Cyrus Daboo
>
> _______________________________________________
> Tzdist mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tzdist
>

---

From: Daniel Migault <[email-masked]>
Date: Tue, 2 Sep 2014 09:51:11 +0200

Is that possible to add:

As such, servers MAY require HTTP-based authentication
   as per [RFC 7235] or MAY require the use of TLS.

In that sense, we do not ban TLS, but on the other hand we leave all
adaptation that TLS would require for future work. ?

-- 
Daniel Migault
Orange Labs -- Security
+33 6 70 72 69 58

---

From: Cyrus Daboo <[email-masked]>
Date: Tue, 02 Sep 2014 09:43:23 -0400

Hi Daniel,

> adaptation that TLS would require for future work. ?

TLS for authentication (client certs) or TLS for transport layer security 
(data integrity)? I think the former is certainly a MAY, but I still argue 
the later is very important and needs a stronger recommendation.

-- 
Cyrus Daboo

---

From: Daniel Migault <[email-masked]>
Date: Tue, 2 Sep 2014 22:43:54 +0200

It looks I misunderstood your text. If I understand correctly, HTTP
authentication is not intended to replace TLS authentication. You are still
"recommending" using tzdist over TLS.

When you say needs stronger recommendation. Do you mean MAY is to weak or
do have any issue that needs to be clarified before recommending TLS?

My opinion is that we should be able to use tzdist over TLS, and I do not
see any issue related to using TLS with tzdist. To me the current text is
fine. Maybe we could add a sentence that explains that given the foreseen
traffic, at the time the tzdist specs are elaborated, we did not see
evidence that tzdist encounters a POSH issue.

On Tue, Sep 2, 2014 at 3:43 PM, Cyrus Daboo <[email-masked]> wrote:

> Hi Daniel,
>
>
> --On September 2, 2014 at 9:51:11 AM +0200 Daniel Migault <
> [email-masked]> wrote:
>
>  Is that possible to add:
>>

-- 
Daniel Migault
Orange Labs -- Security
+33 6 70 72 69 58

---

From: Cyrus Daboo <[email-masked]>
Date: Wed, 03 Sep 2014 13:18:59 -0400

Hi Daniel,

--On September 2, 2014 at 10:43:54 PM +0200 Daniel Migault 
<[email-masked]> wrote:

> authentication is not intended to replace TLS authentication. You are
> still "recommending" using tzdist over TLS.

Yes.

> do have any issue that needs to be clarified before recommending TLS?

I think the current text is fine: "servers MUST support TLS", "clients 
SHOULD use TLS".

> evidence that tzdist encounters a POSH issue.

That would probably require elaboration of POSH and an associated 
reference. Since there isn't an issue I don't think we need to state that 
in the spec.

-- 
Cyrus Daboo