Re: [Anima] MichaelR/Rob/*: RFC8995 errata concerns
Toerless Eckert <tte@cs.fau.de> Wed, 31 January 2024 06:22 UTC
Return-Path: <eckert@i4.informatik.uni-erlangen.de>
X-Original-To: anima@ietfa.amsl.com
Delivered-To: anima@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0DE0FC151996; Tue, 30 Jan 2024 22:22:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.66
X-Spam-Level:
X-Spam-Status: No, score=-1.66 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.249, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i2J4B51zELjo; Tue, 30 Jan 2024 22:22:26 -0800 (PST)
Received: from faui40.informatik.uni-erlangen.de (faui40.informatik.uni-erlangen.de [IPv6:2001:638:a000:4134::ffff:40]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC9BEC14CE44; Tue, 30 Jan 2024 22:22:25 -0800 (PST)
Received: from faui48e.informatik.uni-erlangen.de (faui48e.informatik.uni-erlangen.de [IPv6:2001:638:a000:4134::ffff:51]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by faui40.informatik.uni-erlangen.de (Postfix) with ESMTPS id 4TPsQP5g3Tznkbn; Wed, 31 Jan 2024 07:22:21 +0100 (CET)
Received: by faui48e.informatik.uni-erlangen.de (Postfix, from userid 10463) id 4TPsQP4bs6zkmhn; Wed, 31 Jan 2024 07:22:21 +0100 (CET)
Date: Wed, 31 Jan 2024 07:22:21 +0100
From: Toerless Eckert <tte@cs.fau.de>
To: Michael Richardson <mcr+ietf@sandelman.ca>
Cc: "Rob Wilton (rwilton)" <rwilton=40cisco.com@dmarc.ietf.org>, "anima@ietf.org" <anima@ietf.org>, draft-ietf-anima-brski-cloud@ietf.org
Message-ID: <ZbnnHT9Dj_bdslTc@faui48e.informatik.uni-erlangen.de>
References: <20210805211714.GC57091@faui48e.informatik.uni-erlangen.de> <9465.1628200645@localhost> <20210806003134.GA47840@faui48e.informatik.uni-erlangen.de> <7466.1628378147@localhost> <LV8PR11MB853636871E286AA42FDAE178B56C2@LV8PR11MB8536.namprd11.prod.outlook.com> <29353.1705509924@obiwan.sandelman.ca> <ZbmxALT76BcRakxO@faui48e.informatik.uni-erlangen.de> <7127.1706675970@obiwan.sandelman.ca>
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <7127.1706675970@obiwan.sandelman.ca>
Archived-At: <https://mailarchive.ietf.org/arch/msg/anima/wB4k_VrkwGkFLeq9NmYIOyz17NY>
Subject: Re: [Anima] MichaelR/Rob/*: RFC8995 errata concerns
X-BeenThere: anima@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Autonomic Networking Integrated Model and Approach <anima.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/anima>, <mailto:anima-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/anima/>
List-Post: <mailto:anima@ietf.org>
List-Help: <mailto:anima-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/anima>, <mailto:anima-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 31 Jan 2024 06:22:28 -0000
Maybe we are perceiving different issues.
The issue i am talking about is that Registrars (Cloud or Owner) and MASA may be
installed in cloud environment where the SNI "server_name" extension in the ClientHello
is necessary for the Registrar/MASA to be addressed. This happens when multiple
virtual servers, with different domain names and for each domain name potentially
a different certificate share a single IP address. The SNI is then used by the cloud
infrastructure to demux the incoming ClientHello to the right application.
Cheers
Toerless
On Tue, Jan 30, 2024 at 11:39:30PM -0500, Michael Richardson wrote:
>
> Toerless Eckert <tte@cs.fau.de> wrote:
> > I am not sure what to do about this in general, but i think the really
> > important issue is that we ask for support of SNI in BRSKI cloud to
> > support actual cloud deployment (with shared IP address) of registrars,
> > when pledges only have TLS 1.2 - because RFC8995 did not require it.
>
> > So, i did open: https://github.com/anima-wg/brski-cloud/issues/134
>
> I replied. There is no SNI issue.
> We actually thought it all through, and that errata was the result.
>
> There is a potential issue in 3.3.1 that reading the issue made me think
> about. But, it's not an SNI issue. It's a Implicit Trust Anchor or not issue.
>
> --
> Michael Richardson <mcr+IETF@sandelman.ca> . o O ( IPv6 IøT consulting )
> Sandelman Software Works Inc, Ottawa and Worldwide
- [Anima] MichaelR/Rob/*: RFC8995 errata concerns Toerless Eckert
- Re: [Anima] MichaelR/Rob/*: RFC8995 errata concer… Michael Richardson
- Re: [Anima] MichaelR/Rob/*: RFC8995 errata concer… Toerless Eckert
- Re: [Anima] MichaelR/Rob/*: RFC8995 errata concer… Michael Richardson
- Re: [Anima] MichaelR/Rob/*: RFC8995 errata concer… Rob Wilton (rwilton)
- Re: [Anima] MichaelR/Rob/*: RFC8995 errata concer… Michael Richardson
- Re: [Anima] MichaelR/Rob/*: RFC8995 errata concer… Toerless Eckert
- Re: [Anima] MichaelR/Rob/*: RFC8995 errata concer… Michael Richardson
- Re: [Anima] MichaelR/Rob/*: RFC8995 errata concer… Toerless Eckert
- Re: [Anima] MichaelR/Rob/*: RFC8995 errata concer… Michael Richardson