IETF Logo Mail Archive

Re: [Emu] [lamps] EAP/EMU recommendations for client cert validation logic

Alan DeKok <aland@deployingradius.com> Fri, 17 January 2020 18:40 UTC

Return-Path: <aland@deployingradius.com>
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C1A912007C; Fri, 17 Jan 2020 10:40:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S2afZbqzVza7; Fri, 17 Jan 2020 10:40:23 -0800 (PST)
Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 91A63120025; Fri, 17 Jan 2020 10:40:23 -0800 (PST)
Received: from [192.168.46.130] (24-52-251-6.cable.teksavvy.com [24.52.251.6]) by mail.networkradius.com (Postfix) with ESMTPSA id 7685138AE; Fri, 17 Jan 2020 18:40:20 +0000 (UTC)
Authentication-Results: NetworkRADIUS; dmarc=none header.from=deployingradius.com
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3608.40.2.2.4\))
From: Alan DeKok <aland@deployingradius.com>
In-Reply-To: <3821.1579285777@localhost>
Date: Fri, 17 Jan 2020 13:40:18 -0500
Cc: "spasm@ietf.org" <spasm@ietf.org>, EMU WG <emu@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <0C1CC4B9-9E38-4656-B2FB-5DE3C671015A@deployingradius.com>
References: <MN2PR11MB3901F9B86DAC83AF67FBA49DDB560@MN2PR11MB3901.namprd11.prod.outlook.com> <CAErg=HEzR4U9L2Bbj65hSKo4=GEHv=NVGkySFpdCaK2NoJBmFQ@mail.gmail.com> <MN2PR11MB39013D4C54FEACDC8228D136DB3F0@MN2PR11MB3901.namprd11.prod.outlook.com> <CAErg=HG=ZTbzfSr8oQMWgzFNqmdPkUNttLQDprGo5F6LXv9T5Q@mail.gmail.com> <B823CF84-4F78-4B91-BC68-E173FA78C28D@deployingradius.com> <CAErg=HEAtGiJKpLamdUaHicU2Psu7_0RrwsrwiQpb-uHOZ2p2Q@mail.gmail.com> <B2989B0E-8B6B-4B7A-B871-AF520310B3FC@deployingradius.com> <CAErg=HG06ZpiRUYogiVwoJPsZDsjzAVvO0B4=K=PE7aAHe44rA@mail.gmail.com> <6CEB4C89-B749-4A65-A25A-A12830ED8A62@deployingradius.com> <CAErg=HFPCYKgUEXHaOC0sQECYaVmt0TZXe-uDrKzFiNSAcdckg@mail.gmail.com> <00453E78-D991-4B4D-A138-5788FACC47C2@deployingradius.com> <CAErg=HFYQpfqTE9==TzGo795ZiuNBGVMqWuXS6GJ2DV0nGxPzA@mail.gmail.com> <316CC74D-667B-4A1E-AD48-A702DF705423@deployingradius.com> <CAErg=HF-so7nvNmYd04wJ-DCHYGarkHpt3XjTGOhFNT1h=69UA@mail.gmail.com> <10F5CCFB-7DBD-40DF-9C65-BCD0EB8CB838@deployin gradius.com> <CAErg=HH_VNooEKr2p7ebdDScRorQxEfxJ30YpY7sEu84pk+6eg@mail.gmail.com> <48C23DF2-C578-482B-BCC3-69AABDAF983F@cisco.com> <FC4AEADF-10B3-490C-8A32-3458AA86C497@deployingradius.com> <3821.1579285777@localhost>
To: Michael Richardson <mcr+ietf@sandelman.ca>
X-Mailer: Apple Mail (2.3608.40.2.2.4)
Archived-At: <https://mailarchive.ietf.org/arch/msg/emu/vUrP4ZbUe_vdg3N3T_kPyx6uuvA>
Subject: Re: [Emu] [lamps] EAP/EMU recommendations for client cert validation logic
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" <emu.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/emu>, <mailto:emu-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/emu/>
List-Post: <mailto:emu@ietf.org>
List-Help: <mailto:emu-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/emu>, <mailto:emu-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 17 Jan 2020 18:40:29 -0000

On Jan 17, 2020, at 1:29 PM, Michael Richardson <mcr+ietf@sandelman.ca> wrote:
> You omitted an important part of that output, which is the name of the CA,
> which I include below.

  Sure.

> It could be that the CSP permits SMTP, or SUBMISSION service.
> Ryan has suggested that CAs could put EAP-TLS (or EAP-TEAP) into their CSP,
> and that also seems like an out.

  I agree.

> Certainly, some of the excitement for ACME/Letsencrypt with DNS-01 challenge
> is that it makes it easy to get a certificate for a non-HTTP thing.
> 
> I think we need to fix the lawyers, not the protocol.

  That is likely the best approach.  At this point, use of id-kp-serverAuth is wide-spread *outside* of HTTP.  EAP / RADIUS is not unique in it's mis-use of that OID.

  As such, this discussion should more productively focussed on non-HTTP mis-uses of id-kp-serverAuth.  Which means pretty much everything using TLS.

  Alan DeKok.

v2.23.0 | Report a Bug | By Email