IETF Logo Mail Archive

[Captive-portals] Re: seeking review comments on revised CAPPORT considerations in brski-cloud

Michael Richardson <mcr+ietf@sandelman.ca> Wed, 02 July 2025 20:13 UTC

Return-Path: <mcr+ietf@sandelman.ca>
X-Original-To: captive-portals@mail2.ietf.org
Delivered-To: captive-portals@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 3C3533D158CE for <captive-portals@mail2.ietf.org>; Wed, 2 Jul 2025 13:13:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.867
X-Spam-Level:
X-Spam-Status: No, score=-1.867 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.232, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=sandelman.ca
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tg4tCpNrUpl0 for <captive-portals@mail2.ietf.org>; Wed, 2 Jul 2025 13:13:05 -0700 (PDT)
Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256)) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id DAAAD3D158BE for <captive-portals@ietf.org>; Wed, 2 Jul 2025 13:13:05 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 2E0E738993; Wed, 2 Jul 2025 16:13:05 -0400 (EDT)
Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavis, port 10024) with LMTP id mLaAcsurddra; Wed, 2 Jul 2025 16:13:03 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sandelman.ca; s=mail; t=1751487182; bh=V51ll4NUPOIDkFy+u5i/uAUcdfiZjUMlbh4nzG83JJM=; h=From:To:cc:Subject:In-Reply-To:References:Date:From; b=hZ2aXdE1y7vRTHIDUxGS8UfyWTZAWn+wzQa3ZfQeEHdNB1pR0JlWDBCL5FCfktxGx zmLFGJ4tuiFS83MhtEQDDvMh/I7wth2uasidebQwYrRCgLffyPFW0BdlNwPMr8rIQw U91TQ8U+N03VfWa2zvV8EjCA+sBMwkwVtNgPHwUhhdNIF5YbfI2IEyfEGNmq0pFBcT 6+CFPuuVBOge6EFlLnuq90rjRLy/pJEWRnfvIiU2vJB9OdALtzuiMA8IjO+u+9eFsF knNZSddtgaLSQ4QxLY61NkeUO7ekAk3vKo80S6BVSkaRYuY8X2oHUj5bzQyH6wcNSp B/PpCGYyTLz2w==
Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id DB91838992; Wed, 2 Jul 2025 16:13:02 -0400 (EDT)
Received: from obiwan.sandelman.ca (obiwan.sandelman.ca [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id D6AFB19A; Wed, 2 Jul 2025 16:13:02 -0400 (EDT)
From: Michael Richardson <mcr+ietf@sandelman.ca>
To: Erik Kline <ek.ietf@gmail.com>
In-Reply-To: <CAMGpriVjrRX7dA8g-NuPtF46=56=ehEPEgOqbvofZAK_LQAebQ@mail.gmail.com>
References: <11335.1751223139@obiwan.sandelman.ca> <C651FAFC-8884-46FA-B0B4-0D0E2330863D@apple.com> <27508.1751321240@obiwan.sandelman.ca> <CAMGpriVjrRX7dA8g-NuPtF46=56=ehEPEgOqbvofZAK_LQAebQ@mail.gmail.com>
X-Mailer: MH-E 8.6+git; nmh 1.8+dev; GNU Emacs 28.2
X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0;<'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m<nPbLgmtKK-5dC@#:k
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha512"; protocol="application/pgp-signature"
Date: Wed, 02 Jul 2025 16:13:02 -0400
Message-ID: <22006.1751487182@obiwan.sandelman.ca>
Message-ID-Hash: UUF5FRHAAPG5NCWOLMLJGDFCAFEYKXKH
X-Message-ID-Hash: UUF5FRHAAPG5NCWOLMLJGDFCAFEYKXKH
X-MailFrom: mcr+ietf@sandelman.ca
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-captive-portals.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Tommy Pauly <tpauly@apple.com>, captive-portals@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Captive-portals] Re: seeking review comments on revised CAPPORT considerations in brski-cloud
List-Id: Discussion of issues related to captive portals <captive-portals.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/captive-portals/s4O9XFoekNBPQWwXgJdeSmQdZhE>
List-Archive: <https://mailarchive.ietf.org/arch/browse/captive-portals>
List-Help: <mailto:captive-portals-request@ietf.org?subject=help>
List-Owner: <mailto:captive-portals-owner@ietf.org>
List-Post: <mailto:captive-portals@ietf.org>
List-Subscribe: <mailto:captive-portals-join@ietf.org>
List-Unsubscribe: <mailto:captive-portals-leave@ietf.org>

Erik Kline <ek.ietf@gmail.com> wrote:
    >> I saw that too when editing, and I thought I changed it already.
    >> Nope. Fixed now.
    >>
    >> Any other thoughts?  Forced redirect of TLS by portals usually is
    >> detected by a certificate validation failure.  But, in 8995, we defer
    >> the verification until later on.  What I want to know is whether this
    >> explanation is reasonably communicated.
    >>

    > What are the security implications of any information leaked via the
    > voucher request?  Is it just "oooh look, here's a node that's doing
    > BRSKI" or is there some more traceable client information in there?

The voucher request is signed by the IDevID, which is included.
Both the VR and the IDevID will have device identifying information.
(They have to).  Whether that's *PII* or "just" device identity depends upon
the device.
However, at the point when this occurs, it hasn't really been personalized yet.

So the negative situation of disclosing the voucher request to the on-path
activev attacker (aka captive portal admin) is probably relative severe from
a privacy point of view.   Thus, getting this concern clearly articulated is
important.

    > (Clearly I haven't gone looking to refresh any ANIMA/BRSKI
    > semantics/mechanics).

The 4m screen cast got good reviews from other ADs.
Hoping Disney will pick it up for the Skeleton Crew 2nd season/Donald-Duck
cross-over.

--
Michael Richardson <mcr+IETF@sandelman.ca>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

v2.46.0 | Report a Bug | By Email | System Status