Re: [Emu] WG last call for draft-ietf-emu-tls-eap-types ?

Alan DeKok <aland@deployingradius.com> Fri, 23 September 2022 12:11 UTC

Return-Path: <aland@deployingradius.com>
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E5E3C14CF0A for <emu@ietfa.amsl.com>; Fri, 23 Sep 2022 05:11:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.91
X-Spam-Level:
X-Spam-Status: No, score=-6.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Edp2C1fXez8h for <emu@ietfa.amsl.com>; Fri, 23 Sep 2022 05:11:32 -0700 (PDT)
Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C7E1CC14F718 for <emu@ietf.org>; Fri, 23 Sep 2022 05:11:32 -0700 (PDT)
Received: from smtpclient.apple (135-23-95-173.cpe.pppoe.ca [135.23.95.173]) by mail.networkradius.com (Postfix) with ESMTPSA id 97FC5109; Fri, 23 Sep 2022 12:11:29 +0000 (UTC)
Authentication-Results: NetworkRADIUS; dmarc=none (p=none dis=none) header.from=deployingradius.com
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.1\))
From: Alan DeKok <aland@deployingradius.com>
In-Reply-To: <2fe78705-a113-4f65-9c6c-95a2f99dbf98@www.fastmail.com>
Date: Fri, 23 Sep 2022 08:11:28 -0400
Cc: EMU WG <emu@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <A40440EF-0711-481F-939C-6C29EABF1484@deployingradius.com>
References: <325659CB-E36E-4D18-A59C-B5EA54324201@deployingradius.com> <CAOgPGoAYTe0qtFbJhq7S71FpX+k+1=0Gqqq+pwa+1QnBnQ3wrw@mail.gmail.com> <94154D9C-F880-42DB-B881-38B04F76E196@deployingradius.com> <CAOgPGoBF_8y40oynqQd9rr9PKEy1qNoNae3zMwA+7f7rKN+SUg@mail.gmail.com> <20220910075838.57qeco3egljt7pwp@aineko.digriz.org.uk> <6F86A929-F41A-4C76-8568-8C1DABB0CDEF@deployingradius.com> <2fe78705-a113-4f65-9c6c-95a2f99dbf98@www.fastmail.com>
To: Alexander Clouter <alex+ietf@coremem.com>
X-Mailer: Apple Mail (2.3696.120.41.1.1)
Archived-At: <https://mailarchive.ietf.org/arch/msg/emu/xLh_j_TxGY0_eSqUJnXl2GrGLwk>
Subject: Re: [Emu] WG last call for draft-ietf-emu-tls-eap-types ?
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" <emu.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/emu>, <mailto:emu-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/emu/>
List-Post: <mailto:emu@ietf.org>
List-Help: <mailto:emu-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/emu>, <mailto:emu-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 23 Sep 2022 12:11:35 -0000

On Sep 22, 2022, at 4:33 AM, Alexander Clouter <alex+ietf@coremem.com> wrote:
> I got (probably needlessly) hung up on the wording "The TEAP Compound MAC defined in RFC7170 Section 5.3 is updated..." when nothing has changed there other than MAC.
> 
> Maybe: "The TEAP Compound MAC defined in [RFC7170] Section 5.3 remains but the message authentication code (MAC) for TLS 1.3 is computed with the HMAC algorithm negotiated for HKDF in the key schedule, as per section 7.1 of RFC 8446.  That is, the MAC used is the MAC derived from the TLS handshake."

  OK.  I'll update the doc.

> I don't think CMK/Compound-MAC needs to be included here, though maybe arguably as most of the definitions at this point have been included, you may as well include the rest for completeness.

  Sure.

>>> If any wording changes need to be made, maybe to be more explicit in stating "the MAC from the handshake" or "cipher_suite from RFC8446 section 4.1.3"? I find the existing "section 7.1 of RFC 8446" wording unusable to someone trying to answer "what am I actually meant to do here?"
>> 
>>  Do you have explicit text to suggest?
> 
> I think your "That is, the MAC used is the MAC derived from the TLS handshake." covers this, thanks.

  OK.

  Alan DeKok.