IETF Logo Mail Archive

Re: [Emu] [lamps] EAP/EMU recommendations for client cert validation logic

Joseph Salowey <joe@salowey.net> Thu, 16 January 2020 03:20 UTC

Return-Path: <joe@salowey.net>
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E016A12002F for <emu@ietfa.amsl.com>; Wed, 15 Jan 2020 19:20:51 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Level:
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=salowey-net.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FVJOsEn5cKAq for <emu@ietfa.amsl.com>; Wed, 15 Jan 2020 19:20:49 -0800 (PST)
Received: from mail-qv1-xf35.google.com (mail-qv1-xf35.google.com [IPv6:2607:f8b0:4864:20::f35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 56136120803 for <emu@ietf.org>; Wed, 15 Jan 2020 19:20:49 -0800 (PST)
Received: by mail-qv1-xf35.google.com with SMTP id f16so8449981qvi.4 for <emu@ietf.org>; Wed, 15 Jan 2020 19:20:49 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=salowey-net.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=1MWfLDma2zJZHjkwuUX6wnlO3L5ZhwyWP4OombtJMy0=; b=SUhusf+oo2BBpGxG72hIqEC2u64EhMickN3l6OgE+s8OGLLm7zJ2lq/cCjWjVT5UKU 4AzQuMnr5uA5Pp1SPtyeRYNkBwvVDDs75rXwKTQ5/58uD0d3K5MP7LVFnvuXEI5ziYEy 1BdBXNdjWg9BpgooJP7wncuiSUFW09592vdzomOK8M9Rv+X5D02vp2lPTrsByIDCaxfa sQV0F09MmXbOgtvfvSYPxNpTF5b7Mpr7NQuA/86ta2Vn2xE8AaZz60hyFHN4Z7sPtGLb rDslkVfkKSOLhVrXZX6wgx9/XYwEFW4FpecZeOgd1IuAM3lulHG4bKur25x4PvP377gy gzrQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=1MWfLDma2zJZHjkwuUX6wnlO3L5ZhwyWP4OombtJMy0=; b=ZN2cjJ5VAuR+jY06lxAMrN/aTi+hQecEooCKU/MIKRaNHwXbtyl2Bt8f5O6pgPCXXJ ZVMzCE9QbVSS1PhOi4zOfuAX2C2tlm8AtGxe1z8SffbD8my+QScAegdSIMZEWyIVFF1E 265SBzdHDSzSoh29lq8IxHNDcI2WWvVwGCUiGXqYK4ksIpv4UKn2dasaW8Y3gSPYJrgX lUWFkHuVerZFtVgJRcIoYJIwwJQmoeyMSNlbzu4uwH9JtTikABtBDJKeiHWI/JOGdYQg YBQorDqy7OvDsl81pPLt2L/B4JJ76elIthAk160tp8twnYNWiYKLNV6KqxTjBNiCjuM7 85Fw==
X-Gm-Message-State: APjAAAW32d3C8dLPXL2oq17M6wjLzU3G3IoZB/C340j6TXvgZVnuxPKf XGVh5Nol1LFCI2gFqJSY4B6RNGSULWptwQ3cu9kee4A9
X-Google-Smtp-Source: APXvYqzmbSJenMBkad+bhIZBGPklDYGvsOFsC858BP6V/qmvhXi4rAQ+PUtAwQdwf7IJ2KKuPCsO7cPWUNFIfRmIXQY=
X-Received: by 2002:a0c:eed2:: with SMTP id h18mr603761qvs.184.1579144848386; Wed, 15 Jan 2020 19:20:48 -0800 (PST)
MIME-Version: 1.0
References: <MN2PR11MB3901F9B86DAC83AF67FBA49DDB560@MN2PR11MB3901.namprd11.prod.outlook.com> <CAErg=HEzR4U9L2Bbj65hSKo4=GEHv=NVGkySFpdCaK2NoJBmFQ@mail.gmail.com> <MN2PR11MB39013D4C54FEACDC8228D136DB3F0@MN2PR11MB3901.namprd11.prod.outlook.com> <CAErg=HG=ZTbzfSr8oQMWgzFNqmdPkUNttLQDprGo5F6LXv9T5Q@mail.gmail.com> <B823CF84-4F78-4B91-BC68-E173FA78C28D@deployingradius.com> <CAErg=HEAtGiJKpLamdUaHicU2Psu7_0RrwsrwiQpb-uHOZ2p2Q@mail.gmail.com> <B2989B0E-8B6B-4B7A-B871-AF520310B3FC@deployingradius.com> <CAErg=HG06ZpiRUYogiVwoJPsZDsjzAVvO0B4=K=PE7aAHe44rA@mail.gmail.com> <6CEB4C89-B749-4A65-A25A-A12830ED8A62@deployingradius.com> <CAErg=HFPCYKgUEXHaOC0sQECYaVmt0TZXe-uDrKzFiNSAcdckg@mail.gmail.com> <00453E78-D991-4B4D-A138-5788FACC47C2@deployingradius.com> <CAErg=HFYQpfqTE9==TzGo795ZiuNBGVMqWuXS6GJ2DV0nGxPzA@mail.gmail.com> <316CC74D-667B-4A1E-AD48-A702DF705423@deployingradius.com> <6191.1578513600@localhost> <CB67C090-4D6A-4586-AD7C-99A29EF5D92D@deployingradius.com>
In-Reply-To: <CB67C090-4D6A-4586-AD7C-99A29EF5D92D@deployingradius.com>
From: Joseph Salowey <joe@salowey.net>
Date: Wed, 15 Jan 2020 19:20:37 -0800
Message-ID: <CAOgPGoDADPY125Bf7mbPCpEVkwVF=YmbG9wAN0S-WyCWg27BCw@mail.gmail.com>
To: Alan DeKok <aland@deployingradius.com>
Cc: Michael Richardson <mcr+ietf@sandelman.ca>, "spasm@ietf.org" <spasm@ietf.org>, EMU WG <emu@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000bcbff5059c394fbb"
Archived-At: <https://mailarchive.ietf.org/arch/msg/emu/iPLC6SK-zPTDMSH6vf0oVnwNDsg>
Subject: Re: [Emu] [lamps] EAP/EMU recommendations for client cert validation logic
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" <emu.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/emu>, <mailto:emu-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/emu/>
List-Post: <mailto:emu@ietf.org>
List-Help: <mailto:emu-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/emu>, <mailto:emu-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 16 Jan 2020 03:20:52 -0000

There has been a lot of discussion on this thread, but I do not see
anything actionable for the EAP-TLS 1.3 specification.

Joe

On Wed, Jan 8, 2020 at 12:48 PM Alan DeKok <aland@deployingradius.com>
wrote:

> On Jan 8, 2020, at 3:00 PM, Michael Richardson <mcr+ietf@sandelman.ca>
> wrote:
> >
> >
> > Alan DeKok <aland@deployingradius.com> wrote:
> >    alan> Many people use private CAs.  Many use public CAs.  *All* of
> them
> >    alan> use id-kp-serverAuth.  Common EAP supplicants (MS / Apple /
> etc.)
> >    alan> ship with known root CAs.  These root CAs are trusted by default
> >    alan> for web browsing.  None are trusted by default for EAP.
> >
> > How can anyone be using public CAs for EAP, if none are trusted for EAP,
> and no
> > public CAs issue certificates with id-kp-serverAuth?
>
>   Every CA is manually enabled.
>
>   Either by an end user, or by / on behalf of, an administrator.
>
>   The goal I'd like to reach is some method to allow supplicants to
> automatically trust and enable certificates for EAP.
>
>   Alan DeKok.
>
> _______________________________________________
> Emu mailing list
> Emu@ietf.org
> https://www.ietf.org/mailman/listinfo/emu
>

v2.23.0 | Report a Bug | By Email