Re: [drinks] Stephen Farrell's Discuss on draft-ietf-drinks-spp-protocol-over-soap-07: (with DISCUSS and COMMENT)
Stephen Farrell <stephen.farrell@cs.tcd.ie> Thu, 19 March 2015 18:55 UTC
Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: drinks@ietfa.amsl.com
Delivered-To: drinks@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1ED711A6EFE; Thu, 19 Mar 2015 11:55:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.21
X-Spam-Level:
X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8bqCNErkhx7H; Thu, 19 Mar 2015 11:55:05 -0700 (PDT)
Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2B1C71A005C; Thu, 19 Mar 2015 11:55:05 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 3F97DBEC4; Thu, 19 Mar 2015 18:55:03 +0000 (GMT)
X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie
Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3NhDEwYtW4dK; Thu, 19 Mar 2015 18:55:01 +0000 (GMT)
Received: from [10.87.48.73] (unknown [86.46.20.71]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 94813BEB5; Thu, 19 Mar 2015 18:55:01 +0000 (GMT)
Message-ID: <550B1B85.1040501@cs.tcd.ie>
Date: Thu, 19 Mar 2015 18:55:01 +0000
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0
MIME-Version: 1.0
To: Richard Barnes <rlb@ipv.sx>, draft-ietf-drinks-spp-protocol-over-soap.all@ietf.org
References: <20150205143342.20868.94024.idtracker@ietfa.amsl.com> <CAL02cgRQ3UJT0o3vBzgjcKo0ALOcD75wNRxBxrKs7NTcpc7wyA@mail.gmail.com>
In-Reply-To: <CAL02cgRQ3UJT0o3vBzgjcKo0ALOcD75wNRxBxrKs7NTcpc7wyA@mail.gmail.com>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/drinks/OV6zfyyPPoVEps9SFvXQartsyyw>
Cc: "drinks@ietf.org" <drinks@ietf.org>, drinks-chairs@ietf.org, The IESG <iesg@ietf.org>
Subject: Re: [drinks] Stephen Farrell's Discuss on draft-ietf-drinks-spp-protocol-over-soap-07: (with DISCUSS and COMMENT)
X-BeenThere: drinks@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF DRINKS WG <drinks.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/drinks>, <mailto:drinks-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/drinks/>
List-Post: <mailto:drinks@ietf.org>
List-Help: <mailto:drinks-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/drinks>, <mailto:drinks-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 19 Mar 2015 18:55:08 -0000
Hiya, On 19/03/15 16:21, Richard Barnes wrote: > Authors: Any response to Stephen on this? > > For my part: Stephen, are you seeing some risk associated with a MUST for > Digest? I'd have to go re-read, but no I think I just wanted to check in case that triggered a light bulb moment I think. (And of course because digest is a POS;-) S. > It doesn't preclude implementations from *also* using TLS client > authentication, and it seems to agree with the general direction of having > a required minimum level of security. > > --Richard > > > > On Thu, Feb 5, 2015 at 9:33 AM, Stephen Farrell <stephen.farrell@cs.tcd.ie> > wrote: > >> Stephen Farrell has entered the following ballot position for >> draft-ietf-drinks-spp-protocol-over-soap-07: Discuss >> >> When responding, please keep the subject line intact and reply to all >> email addresses included in the To and CC lines. (Feel free to cut this >> introductory paragraph, however.) >> >> >> Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html >> for more information about IESG DISCUSS and COMMENT positions. >> >> >> The document, along with other ballot positions, can be found here: >> http://datatracker.ietf.org/doc/draft-ietf-drinks-spp-protocol-over-soap/ >> >> >> >> ---------------------------------------------------------------------- >> DISCUSS: >> ---------------------------------------------------------------------- >> >> >> I just want to check one thing... >> >> Section 5: why is there a MUST for Digest auth? What'd be >> wrong with TLS client auth here? I do wish the WG had >> considered some alternative to passwords, which don't make so >> much sense in this use-case. (BTW: You could chose HOBA here >> I guess, but that's still in the RFC editor queue and not >> supported by libraries so perhaps doesn't suit. But it'd work. >> I'm an author of the HOBA spec though, so I'm biased:-) Anyway >> - can you tell me if the WG considered dropping passwords >> entirely and mandating TLS client auth be implemented? If the >> WG seriously considered TLS client auth already, I'll just >> clear. >> >> >> ---------------------------------------------------------------------- >> COMMENT: >> ---------------------------------------------------------------------- >> >> >> - General: why would one want to ever run this protocol >> without TLS? Did the WG consider saying that TLS MUST be used? >> Again, if you tell me you thought about it, I'll just clear. >> >> - 7.1.2: The framework uses "Identifier" but here you use >> "Identity" - it'd be better to be consistent I think and >> "Identifier" is a lot better. >> >> - section 11 is weaker than the corresponding section in the >> framework draft. Two things: 1) why not point back to the >> framework here? 2) shouldn't you say which of the >> vulns/mitigations called out in the framework are relevant or >> mitigated here? >> >> >> >
- Re: [drinks] Stephen Farrell's Discuss on draft-i… Stephen Farrell
- Re: [drinks] Stephen Farrell's Discuss on draft-i… Richard Barnes
- [drinks] Stephen Farrell's Discuss on draft-ietf-… Stephen Farrell