IETF Logo Mail Archive

Re: [Emu] [lamps] EAP/EMU recommendations for client cert validation logic

Alan DeKok <aland@deployingradius.com> Thu, 16 January 2020 22:52 UTC

Return-Path: <aland@deployingradius.com>
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3BB541200B1; Thu, 16 Jan 2020 14:52:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p6FM1Xzg7VEC; Thu, 16 Jan 2020 14:52:34 -0800 (PST)
Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EF677120099; Thu, 16 Jan 2020 14:52:33 -0800 (PST)
Received: from [192.168.46.130] (24-52-251-6.cable.teksavvy.com [24.52.251.6]) by mail.networkradius.com (Postfix) with ESMTPSA id 752F9962; Thu, 16 Jan 2020 22:52:31 +0000 (UTC)
Authentication-Results: NetworkRADIUS; dmarc=none header.from=deployingradius.com
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3608.40.2.2.4\))
From: Alan DeKok <aland@deployingradius.com>
In-Reply-To: <48C23DF2-C578-482B-BCC3-69AABDAF983F@cisco.com>
Date: Thu, 16 Jan 2020 17:52:29 -0500
Cc: Ryan Sleevi <ryan-ietf@sleevi.com>, "spasm@ietf.org" <spasm@ietf.org>, EMU WG <emu@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <FC4AEADF-10B3-490C-8A32-3458AA86C497@deployingradius.com>
References: <MN2PR11MB3901F9B86DAC83AF67FBA49DDB560@MN2PR11MB3901.namprd11.prod.outlook.com> <CAErg=HEzR4U9L2Bbj65hSKo4=GEHv=NVGkySFpdCaK2NoJBmFQ@mail.gmail.com> <MN2PR11MB39013D4C54FEACDC8228D136DB3F0@MN2PR11MB3901.namprd11.prod.outlook.com> <CAErg=HG=ZTbzfSr8oQMWgzFNqmdPkUNttLQDprGo5F6LXv9T5Q@mail.gmail.com> <B823CF84-4F78-4B91-BC68-E173FA78C28D@deployingradius.com> <CAErg=HEAtGiJKpLamdUaHicU2Psu7_0RrwsrwiQpb-uHOZ2p2Q@mail.gmail.com> <B2989B0E-8B6B-4B7A-B871-AF520310B3FC@deployingradius.com> <CAErg=HG06ZpiRUYogiVwoJPsZDsjzAVvO0B4=K=PE7aAHe44rA@mail.gmail.com> <6CEB4C89-B749-4A65-A25A-A12830ED8A62@deployingradius.com> <CAErg=HFPCYKgUEXHaOC0sQECYaVmt0TZXe-uDrKzFiNSAcdckg@mail.gmail.com> <00453E78-D991-4B4D-A138-5788FACC47C2@deployingradius.com> <CAErg=HFYQpfqTE9==TzGo795ZiuNBGVMqWuXS6GJ2DV0nGxPzA@mail.gmail.com> <316CC74D-667B-4A1E-AD48-A702DF705423@deployingradius.com> <CAErg=HF-so7nvNmYd04wJ-DCHYGarkHpt3XjTGOhFNT1h=69UA@mail.gmail.com> <10F5CCFB-7DBD-40DF-9C65-BCD0EB8CB838@deployingradius.com> <CAErg=HH_VNooEKr2p7ebdDScRorQxEfxJ30YpY7sEu84pk+6eg@mail.gmail.com> <48C23DF2-C578-482B-BCC3-69AABDAF983F@cisco.com>
To: "Eliot Lear (elear)" <elear@cisco.com>
X-Mailer: Apple Mail (2.3608.40.2.2.4)
Archived-At: <https://mailarchive.ietf.org/arch/msg/emu/iuQ4Ndbnn4m-YcUY9fl3cPg1Qtk>
Subject: Re: [Emu] [lamps] EAP/EMU recommendations for client cert validation logic
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" <emu.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/emu>, <mailto:emu-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/emu/>
List-Post: <mailto:emu@ietf.org>
List-Help: <mailto:emu-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/emu>, <mailto:emu-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 16 Jan 2020 22:52:36 -0000

On Jan 16, 2020, at 4:02 PM, Eliot Lear (elear) <elear@cisco.com> wrote:
> 
> Ok not for nothing but this is getting silly.

  Yes.

>  If a CA actually revoked a cert for someone using it for EAP, would they also have to revoke for someone using it for SMTP, XMPP, and IMAP?

  That is apparently the claim.

>  Has that ever happened?

  I have no idea.

  Perhaps we should try?

$ openssl s_client -connect smtp.mozilla.org:587 -starttls smtp > mozilla.crt
$ openssl x509 -text -in mozilla.crt

...
            X509v3 Subject Alternative Name:
                DNS:smtp1.mdc1.mozilla.com, DNS:smtp1.private.mdc1.mozilla.com, DNS:smtp1.private.mdc2.mozilla.com, DNS:smtp.mozilla.com, DNS:smtp.mozilla.org, DNS:smtp1.mdc2.mozilla.com
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
...

  Yup.  *Everyone* uses id-kp-serverAuth.  For *everything*.

  Should we report this mis-use?  If so, why?  If not, why not?

  At this point, it might be simplest to just update 2459:

...
    id-kp-serverAuth              OBJECT IDENTIFIER ::=   {id-kp 1}
   -- TLS Web server authentication
...

  new ID: delete the word "Web".

  Alan DeKok.

v2.23.0 | Report a Bug | By Email