[Gen-art] QRE: Gen-ART Review of draft-ietf-kitten-pkinit-freshness-07

Michiko Short <michikos@microsoft.com> Thu, 01 December 2016 17:45 UTC

Return-Path: <michikos@microsoft.com>
X-Original-To: gen-art@ietfa.amsl.com
Delivered-To: gen-art@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2F2F12940E; Thu, 1 Dec 2016 09:45:39 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.003
X-Spam-Level:
X-Spam-Status: No, score=-2.003 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id le5cmzVKc3ZU; Thu, 1 Dec 2016 09:45:37 -0800 (PST)
Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0097.outbound.protection.outlook.com [104.47.38.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0617E129456; Thu, 1 Dec 2016 09:45:31 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Xp0dMdP9MkNqf/x1M1Xet9zodocu/ndNrwvrgdKTGfs=; b=lE1HqS+eYFbrayfxQ3KvZDZVu+5R6w4zF5AHCqC/C1CXdlTSdOhALt8q21bcXkazCxK5PGmWT04/BqIxYdOHQ4Zq8QNzDfvp49Fwi5v4zLtSBCgdkeOs0HLBWGptquDf2IE2S96tm0W7FMeZEbSfShfmxjYKM5HjDY4pSXDXxFE=
Received: from CY1PR03MB2315.namprd03.prod.outlook.com (10.166.207.138) by CY1PR03MB1470.namprd03.prod.outlook.com (10.163.17.155) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.747.13; Thu, 1 Dec 2016 17:45:28 +0000
Received: from CY1PR03MB2315.namprd03.prod.outlook.com ([10.166.207.138]) by CY1PR03MB2315.namprd03.prod.outlook.com ([10.166.207.138]) with mapi id 15.01.0734.020; Thu, 1 Dec 2016 17:45:28 +0000
From: Michiko Short <michikos@microsoft.com>
To: Michiko Short <michikos@microsoft.com>, Jari Arkko <jari.arkko@piuha.net>, Benjamin Kaduk <kaduk@MIT.EDU>
Thread-Topic: [Gen-art] Gen-ART Review of draft-ietf-kitten-pkinit-freshness-07
Thread-Index: AdJL+rGJm69tVN+pU06lGGXZjXK2bA==
Date: Thu, 01 Dec 2016 17:45:28 +0000
Message-ID: <CY1PR03MB2315564FBF3C1C9FCD4928BBD08F0@CY1PR03MB2315.namprd03.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=michikos@microsoft.com;
x-originating-ip: [2001:4898:80e8:d::3a6]
x-ms-office365-filtering-correlation-id: 5ef50b09-ccd4-4ab5-e11c-08d41a11d6e0
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:CY1PR03MB1470;
x-microsoft-exchange-diagnostics: 1; CY1PR03MB1470; 7:/Xxo+gaoUoYdUvHhvBoimp40OXNkVFI1guQp1RHRHbVu269NZh0Pyxsimpqt15xxzPkxObVjFzta/Mjk905bNlLWgqfN7+GiL7eTJjik49sQgbxUL4P58pPDc7BQS1q7ZUaRZ4vFic/FQlXZ9p5qrv+ubclS32t+EVcbLuGySv/eyLT/EC22gE7Le1ts7Z06o7/qEiw5C77k0AQvNj0D7RcatcAQsO+9L/en7HXlNsnWv27RTBmOW3/qjP+3G1/tgBsErO7KOIHqVbNGKiO3/VNjowEbK3RwysoQmKJrO8ycJ7Vx9G9IPtIv9Y2CF/RcEzBc68l5NeLodQpGR6mi5SfuMhYI7v5UHo1a8Yij4EFG8f3z73bBqZZ2bkPDq0L1CiFBQjGf/p4Up5xxSALeUgcgkMB3oPxUF6+/aRlS0uyXFLEKxdHd4IDwet6J3/Jc5HUmw7/BCrwBIANr5MydsOejJolX9lN0Inel1FuK6wQ=
x-microsoft-antispam-prvs: <CY1PR03MB147066BCCEF20A4F9318177AD08F0@CY1PR03MB1470.namprd03.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(192374486261705);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123562025)(20161123564025)(20161123555025)(20161123560025)(6047074)(6072148); SRVR:CY1PR03MB1470; BCL:0; PCL:0; RULEID:; SRVR:CY1PR03MB1470;
x-forefront-prvs: 014304E855
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(377454003)(199003)(13464003)(189002)(66654002)(99286002)(7846002)(7736002)(1511001)(189998001)(77096006)(2171001)(33656002)(7696004)(305945005)(8990500004)(230783001)(10290500002)(97736004)(122556002)(5005710100001)(68736007)(2900100001)(5001770100001)(5660300001)(86362001)(2561002)(6116002)(2906002)(8676002)(102836003)(81166006)(74316002)(81156014)(9686002)(92566002)(106356001)(105586002)(10090500001)(86612001)(8936002)(6506003)(38730400001)(3280700002)(54356999)(50986999)(39410400001)(101416001)(3660700001)(2421001)(39450400002)(76576001)(4326007); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR03MB1470; H:CY1PR03MB2315.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en;
received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Dec 2016 17:45:28.6579 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR03MB1470
Archived-At: <https://mailarchive.ietf.org/arch/msg/gen-art/2R-tr-nUTJ7SXawfQo8-jkBhooI>
Cc: "Paul Miller (NT)" <paumil@microsoft.com>, IETF Gen-ART <gen-art@ietf.org>, "draft-ietf-kitten-pkinit-freshness.all@ietf.org" <draft-ietf-kitten-pkinit-freshness.all@ietf.org>
Subject: [Gen-art] QRE: Gen-ART Review of draft-ietf-kitten-pkinit-freshness-07
X-BeenThere: gen-art@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "GEN-ART: General Area Review Team" <gen-art.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/gen-art>, <mailto:gen-art-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/gen-art/>
List-Post: <mailto:gen-art@ietf.org>
List-Help: <mailto:gen-art-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/gen-art>, <mailto:gen-art-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 01 Dec 2016 17:45:40 -0000

One thing to note, since the client will never know what the KDC is using size will not impact the error or AS-REQ processing unless we can declare a universal min and max. It can be used by the KDC since it will know if nonce, sym crypto or asym crypto. So the example that Russ provided was client behavior which would not be impacted. However, the KDCs can use this information to fail the Freshness token validation before cracking open the token.

-----Original Message-----
From: Michiko Short [mailto:michikos@microsoft.com] 
Sent: Thursday, December 1, 2016 9:33 AM
To: Jari Arkko <jari.arkko@piuha.net>; Benjamin Kaduk <kaduk@MIT.EDU>
Cc: Paul Miller (NT) <paumil@microsoft.com>; IETF Gen-ART <gen-art@ietf.org>; draft-ietf-kitten-pkinit-freshness.all@ietf.org
Subject: RE: [Gen-art] Gen-ART Review of draft-ietf-kitten-pkinit-freshness-07

Ok, since answer not obvious starting thread on Kitten. 

-----Original Message-----
From: Jari Arkko [mailto:jari.arkko@piuha.net] 
Sent: Thursday, December 1, 2016 1:30 AM
To: Benjamin Kaduk <kaduk@MIT.EDU>
Cc: Paul Miller (NT) <paumil@microsoft.com>; Michiko Short <michikos@microsoft.com>; IETF Gen-ART <gen-art@ietf.org>; draft-ietf-kitten-pkinit-freshness.all@ietf.org
Subject: Re: [Gen-art] Gen-ART Review of draft-ietf-kitten-pkinit-freshness-07

Many thanks for your review, Russ, and for thinking about this space and what issues there might be.

I too am concerned about the issue that Russ Housley raised: bad practices in creating the freshness tokens creates a security issue. If this cannot be handled in the way that Russ initially suggested (setting a minimum number of bits) then a proper discussion of the issue and recommendations to avoid the problems need to be included in the security considerations section.

I fully recognise the point from the authors that different styles of creating the tokens result in different implications, and that setting a mere minimum number of bits may not be appropriate.

Jari