Re: [drinks] Stephen Farrell's Discuss on draft-ietf-drinks-spp-protocol-over-soap-07: (with DISCUSS and COMMENT)
Richard Barnes <rlb@ipv.sx> Thu, 19 March 2015 16:21 UTC
Return-Path: <rlb@ipv.sx>
X-Original-To: drinks@ietfa.amsl.com
Delivered-To: drinks@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B7FA1ACE2B for <drinks@ietfa.amsl.com>; Thu, 19 Mar 2015 09:21:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.977
X-Spam-Level:
X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=unavailable
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IHHIKhoEFZUG for <drinks@ietfa.amsl.com>; Thu, 19 Mar 2015 09:21:34 -0700 (PDT)
Received: from mail-lb0-f173.google.com (mail-lb0-f173.google.com [209.85.217.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CEE351ACE2C for <drinks@ietf.org>; Thu, 19 Mar 2015 09:21:33 -0700 (PDT)
Received: by lbcgn8 with SMTP id gn8so56576062lbc.2 for <drinks@ietf.org>; Thu, 19 Mar 2015 09:21:32 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=yibhOS+aGVCNb0W6K4hqPMCndoio7UWozhD1ofJjDUc=; b=aw9inOmYe0mS3oG8dwqqpkK8CO28tNI4MBwne07jRELpRKMjX/5yndoc1089EYoIy8 IJrpG+UTbzNcT7IJegfRgQruv568BxTto1mUAeu4ZTFZvY2Jnvhlx9fe/ytv4Y/27pWY 8EHV9SC/zphiC3sfOO95rd9BbjtR5irdVyJ4qlCfucXYVNWOCivYcd0a8L8RlZpM9jDI jJfGGtaf9qlth/+x+cUF4qvbIgrLxaetXw94Hzec5k3kyqHJDcIWGcvFCSg1ZPiGevdT mbLv3tqhevb1FAWLykRxDSr/a32Awus4ieI8fS1itw9O+TMfRYvi+Idb20LizioyoJH3 Lnng==
X-Gm-Message-State: ALoCoQnPoSJlvh953932pg7NnHzXcV0LBPqt13rFvIceQIAjwmLBu2WcMVX0tT8RerOfr0jYUgzZ
MIME-Version: 1.0
X-Received: by 10.152.87.46 with SMTP id u14mr48956217laz.82.1426782092157; Thu, 19 Mar 2015 09:21:32 -0700 (PDT)
Received: by 10.25.135.4 with HTTP; Thu, 19 Mar 2015 09:21:32 -0700 (PDT)
In-Reply-To: <20150205143342.20868.94024.idtracker@ietfa.amsl.com>
References: <20150205143342.20868.94024.idtracker@ietfa.amsl.com>
Date: Thu, 19 Mar 2015 12:21:32 -0400
Message-ID: <CAL02cgRQ3UJT0o3vBzgjcKo0ALOcD75wNRxBxrKs7NTcpc7wyA@mail.gmail.com>
From: Richard Barnes <rlb@ipv.sx>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>, draft-ietf-drinks-spp-protocol-over-soap.all@ietf.org
Content-Type: multipart/alternative; boundary="001a11c2afd0c6805b0511a69793"
Archived-At: <http://mailarchive.ietf.org/arch/msg/drinks/qjbX6saGSM1IZwxnmViJHzM19q8>
Cc: "drinks@ietf.org" <drinks@ietf.org>, drinks-chairs@ietf.org, The IESG <iesg@ietf.org>
Subject: Re: [drinks] Stephen Farrell's Discuss on draft-ietf-drinks-spp-protocol-over-soap-07: (with DISCUSS and COMMENT)
X-BeenThere: drinks@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF DRINKS WG <drinks.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/drinks>, <mailto:drinks-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/drinks/>
List-Post: <mailto:drinks@ietf.org>
List-Help: <mailto:drinks-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/drinks>, <mailto:drinks-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 19 Mar 2015 16:21:37 -0000
Authors: Any response to Stephen on this? For my part: Stephen, are you seeing some risk associated with a MUST for Digest? It doesn't preclude implementations from *also* using TLS client authentication, and it seems to agree with the general direction of having a required minimum level of security. --Richard On Thu, Feb 5, 2015 at 9:33 AM, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote: > Stephen Farrell has entered the following ballot position for > draft-ietf-drinks-spp-protocol-over-soap-07: Discuss > > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut this > introductory paragraph, however.) > > > Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html > for more information about IESG DISCUSS and COMMENT positions. > > > The document, along with other ballot positions, can be found here: > http://datatracker.ietf.org/doc/draft-ietf-drinks-spp-protocol-over-soap/ > > > > ---------------------------------------------------------------------- > DISCUSS: > ---------------------------------------------------------------------- > > > I just want to check one thing... > > Section 5: why is there a MUST for Digest auth? What'd be > wrong with TLS client auth here? I do wish the WG had > considered some alternative to passwords, which don't make so > much sense in this use-case. (BTW: You could chose HOBA here > I guess, but that's still in the RFC editor queue and not > supported by libraries so perhaps doesn't suit. But it'd work. > I'm an author of the HOBA spec though, so I'm biased:-) Anyway > - can you tell me if the WG considered dropping passwords > entirely and mandating TLS client auth be implemented? If the > WG seriously considered TLS client auth already, I'll just > clear. > > > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- > > > - General: why would one want to ever run this protocol > without TLS? Did the WG consider saying that TLS MUST be used? > Again, if you tell me you thought about it, I'll just clear. > > - 7.1.2: The framework uses "Identifier" but here you use > "Identity" - it'd be better to be consistent I think and > "Identifier" is a lot better. > > - section 11 is weaker than the corresponding section in the > framework draft. Two things: 1) why not point back to the > framework here? 2) shouldn't you say which of the > vulns/mitigations called out in the framework are relevant or > mitigated here? > > >
- Re: [drinks] Stephen Farrell's Discuss on draft-i… Stephen Farrell
- Re: [drinks] Stephen Farrell's Discuss on draft-i… Richard Barnes
- [drinks] Stephen Farrell's Discuss on draft-ietf-… Stephen Farrell