Re: [abfab] WGLC for draft-ietf-abfab-eapapplicability-02

Leif Johansson <leifj@sunet.se> Tue, 09 April 2013 13:00 UTC

Return-Path: <leifj@sunet.se>
X-Original-To: abfab@ietfa.amsl.com
Delivered-To: abfab@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F03E21F9034 for <abfab@ietfa.amsl.com>; Tue, 9 Apr 2013 06:00:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bMV1QREl778o for <abfab@ietfa.amsl.com>; Tue, 9 Apr 2013 06:00:17 -0700 (PDT)
Received: from e-mailfilter02.sunet.se (e-mailfilter02.sunet.se [IPv6:2001:6b0:8:2::202]) by ietfa.amsl.com (Postfix) with ESMTP id DAF6B21F8F21 for <abfab@ietf.org>; Tue, 9 Apr 2013 06:00:16 -0700 (PDT)
Received: from smtp1.nordu.net (smtp1.nordu.net [IPv6:2001:948:4:6::32]) by e-mailfilter02.sunet.se (8.14.3/8.14.3/Debian-9.4) with ESMTP id r39D0Ele025154 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for <abfab@ietf.org>; Tue, 9 Apr 2013 15:00:14 +0200
Received: from kerio.nordu.net (kerio.nordu.net [109.105.110.42]) by smtp1.nordu.net (8.14.6/8.14.6) with ESMTP id r39D0713003100 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for <abfab@ietf.org>; Tue, 9 Apr 2013 13:00:14 GMT
Received: from [109.105.104.210] ([109.105.104.210]) (authenticated user leifj@nordu.net) by kerio.nordu.net (using TLSv1/SSLv3 with cipher AES256-SHA (256 bits)) for abfab@ietf.org; Tue, 9 Apr 2013 15:00:06 +0200
Message-ID: <516410D5.2020908@sunet.se>
Date: Tue, 09 Apr 2013 15:00:05 +0200
From: Leif Johansson <leifj@sunet.se>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130308 Thunderbird/17.0.4
MIME-Version: 1.0
To: abfab@ietf.org
References: <3F295BEE-3638-49E9-9225-EBC3E9DFD777@cisco.com> <DB4AF9A7-D1D5-4638-9ED0-CE5A37F17FEA@cardiff.ac.uk> <tsl4nfgc6ik.fsf@mit.edu>
In-Reply-To: <tsl4nfgc6ik.fsf@mit.edu>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
X-p0f-Info: os=unknown unknown, link=Ethernet or modem
X-CanIt-Geo: ip=109.105.110.42; country=SE; latitude=62.0000; longitude=15.0000; http://maps.google.com/maps?q=62.0000,15.0000&z=6
X-CanItPRO-Stream: outbound-nordu-net:outbound (inherits from outbound-nordu-net:default, nordu-net:default, base:default)
X-Canit-Stats-ID: 0aJlN0eUg - 2d7bd661ae56 - 20130409
X-Antispam-Training-Forget: https://mailfilter.nordu.net/canit/b.php?i=0aJlN0eUg&m=2d7bd661ae56&t=20130409&c=f
X-Antispam-Training-Nonspam: https://mailfilter.nordu.net/canit/b.php?i=0aJlN0eUg&m=2d7bd661ae56&t=20130409&c=n
X-Antispam-Training-Spam: https://mailfilter.nordu.net/canit/b.php?i=0aJlN0eUg&m=2d7bd661ae56&t=20130409&c=s
X-Scanned-By: CanIt (www . roaringpenguin . com)
Subject: Re: [abfab] WGLC for draft-ietf-abfab-eapapplicability-02
X-BeenThere: abfab@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "Application Bridging, Federated Authentication Beyond \(the web\)" <abfab.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/abfab>, <mailto:abfab-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/abfab>
List-Post: <mailto:abfab@ietf.org>
List-Help: <mailto:abfab-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/abfab>, <mailto:abfab-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 09 Apr 2013 13:00:17 -0000

On 04/09/2013 01:01 PM, Sam Hartman wrote:
> I support publication.
> Section 4:
>
> One minor error:
>
>    fully mitigate the risk of NAS impersonation when these mechanisms
>       are used, it is RECOMMENDED that mutual channel bindings be used to
>          bind the authentications together as described in
> 	    [I-D.ietf-emu-crypto-bind].  When doing channel binding it is
> 	       REQUIRED that the authenticator is not able to modify the channel
> 	          binding data passed between the peer to the authenticator as part of
> 		     the authentication process.
> 		     
>
> Don't you mean cryptographic binding there?  
>
> I also believe that a reference to RFC 6919 section 1 MAY WISH TO be
> considered for section 1.1.  There are a lot of MUSTs is section 2. I
> don't support any text changes to section 2.
> _______________________________________________
> abfab mailing list
> abfab@ietf.org
> https://www.ietf.org/mailman/listinfo/abfab
These sound like minor last-call comments that Joe can incorporate
before IETF LC.

        Cheers Leif