IETF Logo Mail Archive

Re: [Emu] I-D Action: draft-ietf-emu-tls-eap-types-09.txt

Alan DeKok <aland@deployingradius.com> Fri, 28 October 2022 15:35 UTC

Return-Path: <aland@deployingradius.com>
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DAAF4C14F745 for <emu@ietfa.amsl.com>; Fri, 28 Oct 2022 08:35:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.909
X-Spam-Level:
X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o8L2Tp-HlEeh for <emu@ietfa.amsl.com>; Fri, 28 Oct 2022 08:35:45 -0700 (PDT)
Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B57FAC14F6EC for <emu@ietf.org>; Fri, 28 Oct 2022 08:35:44 -0700 (PDT)
Received: from smtpclient.apple (135-23-95-173.cpe.pppoe.ca [135.23.95.173]) by mail.networkradius.com (Postfix) with ESMTPSA id 531B41A2; Fri, 28 Oct 2022 15:35:42 +0000 (UTC)
Authentication-Results: NetworkRADIUS; dmarc=none (p=none dis=none) header.from=deployingradius.com
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.1\))
From: Alan DeKok <aland@deployingradius.com>
In-Reply-To: <HE1PR0701MB3050362A7979C272F7E285E989329@HE1PR0701MB3050.eurprd07.prod.outlook.com>
Date: Fri, 28 Oct 2022 11:35:40 -0400
Cc: "emu@ietf.org" <emu@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <794E0C93-3068-4C2C-98B8-AE551D48AC00@deployingradius.com>
References: <166428153120.54333.17278955597896126770@ietfa.amsl.com> <HE1PR0701MB3050362A7979C272F7E285E989329@HE1PR0701MB3050.eurprd07.prod.outlook.com>
To: John Mattsson <john.mattsson=40ericsson.com@dmarc.ietf.org>
X-Mailer: Apple Mail (2.3696.120.41.1.1)
Archived-At: <https://mailarchive.ietf.org/arch/msg/emu/qYV8HP4IIRhI6BchYRch12CPk3g>
Subject: Re: [Emu] I-D Action: draft-ietf-emu-tls-eap-types-09.txt
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" <emu.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/emu>, <mailto:emu-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/emu/>
List-Post: <mailto:emu@ietf.org>
List-Help: <mailto:emu-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/emu>, <mailto:emu-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 28 Oct 2022 15:35:46 -0000

On Oct 28, 2022, at 10:49 AM, John Mattsson <john.mattsson=40ericsson.com@dmarc.ietf.org> wrote:
> A small nit:
> OLD and tje
> NEW and the

  I'll fix that, thanks.

> PEAP and SHA-1:
> Looks like Microsoft is planning to stick with SHA-1 for PEAP 1.3 [PEAP-PRF]. I think that is the wrong choice. NIST recently stated that they plan to deprecate and eventually disallow _all_ uses of SHA-1. In the end, this is Microsoft’s choice, but I think the fact that PEAP 1.3 still uses SHA-1 should be mentioned in draft-ietf-emu-tls-eap-types. This is important information for people and industries following requirements to disallow all uses of SHA-1.

  It's not so much "Microsoft planning" as this was discussed in EMU years ago, and the WG consensus was to stick with SHA-1.

  The current code is shipping in multiple servers and supplicants.  It cannot realistically be changed at this time.

  If NIST deprecates SHA-1, then we can define PEAP (version n+1), and rely on PEAP version negotiation to fix the issue.

  Alan DeKok.

v2.23.0 | Report a Bug | By Email