IETF Logo Mail Archive

Re: [Gen-art] Gen-ART LC review of draft-ietf-tram-auth-problems-02

"Tirumaleswar Reddy (tireddy)" <tireddy@cisco.com> Mon, 28 July 2014 08:58 UTC

Return-Path: <tireddy@cisco.com>
X-Original-To: gen-art@ietfa.amsl.com
Delivered-To: gen-art@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 595791A0313 for <gen-art@ietfa.amsl.com>; Mon, 28 Jul 2014 01:58:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.502
X-Spam-Level:
X-Spam-Status: No, score=-14.502 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vLy1sBpLoIrT for <gen-art@ietfa.amsl.com>; Mon, 28 Jul 2014 01:58:26 -0700 (PDT)
Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E94861A0311 for <gen-art@ietf.org>; Mon, 28 Jul 2014 01:58:25 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2202; q=dns/txt; s=iport; t=1406537906; x=1407747506; h=from:to:subject:date:message-id: content-transfer-encoding:mime-version; bh=7DXtINqp0SQuVA+d0aorQEqkFWDgfiht1uIJq+lFTfg=; b=aaKTwfAD4lV35NsmWlvYW4DLcZyh6H/RCIyn5c+mfawjuMppkNFxovSa 53/XUyKT9IjBqpZGoEUzECRT8medxMxHDY62TdBy/5ayNu35zfuwG6NGm TZy9DVfQ/zeTc4bVNEe6G0AZOhpHtTZ9bftt7gXc8v9RprrUXZ5NRr61E Q=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: ApMfAJgP1lOtJV2d/2dsb2JhbABZgw5SVwSCdK4WmleHRQEZexZ3hAMBAQEDASMRUQYBCBEDAQEBAwIGDg8DAgQfERQBCAkBBAESCIgmAwkIDaYij1ENhxEXgSyLcyeBVT4SgmE2gRsFjleKcINXjFeGI4NJbAGBRA
X-IronPort-AV: E=Sophos;i="5.01,747,1400025600"; d="scan'208";a="343286236"
Received: from rcdn-core-6.cisco.com ([173.37.93.157]) by rcdn-iport-8.cisco.com with ESMTP; 28 Jul 2014 08:58:25 +0000
Received: from xhc-rcd-x06.cisco.com (xhc-rcd-x06.cisco.com [173.37.183.80]) by rcdn-core-6.cisco.com (8.14.5/8.14.5) with ESMTP id s6S8wOMr004789 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Mon, 28 Jul 2014 08:58:24 GMT
Received: from xmb-rcd-x10.cisco.com ([169.254.15.102]) by xhc-rcd-x06.cisco.com ([173.37.183.80]) with mapi id 14.03.0123.003; Mon, 28 Jul 2014 03:58:24 -0500
From: "Tirumaleswar Reddy (tireddy)" <tireddy@cisco.com>
To: Brian E Carpenter <brian.e.carpenter@gmail.com>, "draft-ietf-tram-auth-problems.all@tools.ietf.org" <draft-ietf-tram-auth-problems.all@tools.ietf.org>, General Area Review Team <gen-art@ietf.org>
Thread-Topic: Gen-ART LC review of draft-ietf-tram-auth-problems-02
Thread-Index: Ac+qQgpFgHN8xolxQ6espg1p4ulVbg==
Date: Mon, 28 Jul 2014 08:58:23 +0000
Message-ID: <913383AAA69FF945B8F946018B75898A282FB7A6@xmb-rcd-x10.cisco.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [173.39.64.35]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/gen-art/BSL-U4asC9RHE74KuA2_tLTNCNk
X-Mailman-Approved-At: Mon, 28 Jul 2014 06:14:37 -0700
Subject: Re: [Gen-art] Gen-ART LC review of draft-ietf-tram-auth-problems-02
X-BeenThere: gen-art@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "GEN-ART: General Area Review Team" <gen-art.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/gen-art>, <mailto:gen-art-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/gen-art/>
List-Post: <mailto:gen-art@ietf.org>
List-Help: <mailto:gen-art-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/gen-art>, <mailto:gen-art-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Jul 2014 08:58:27 -0000

Hi Brian,

Thanks for the review.

> -----Original Message-----
> From: Brian E Carpenter [mailto:brian.e.carpenter@gmail.com]
> Sent: Saturday, July 26, 2014 8:30 PM
> To: draft-ietf-tram-auth-problems.all@tools.ietf.org; General Area Review
> Team
> Subject: Gen-ART LC review of draft-ietf-tram-auth-problems-02
> 
> I am the assigned Gen-ART reviewer for this draft. For background on Gen-ART,
> please see the FAQ at
> <http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>.
> 
> Please resolve these comments along with any other Last Call comments you
> may receive.
> 
> Document: draft-ietf-tram-auth-problems-02.txt
> Reviewer: Brian Carpenter
> Review Date: 2014-07-26
> IETF LC End Date: 2014-08-08
> IESG Telechat date:
> 
> Summary:  Almost ready
> --------
> 
> Minor issues:
> -------------
> 
> In Problem 2, would it be useful to reference RFC 6151, which indicates why
> MD5 is problematic?

Yes. 
NEW:
Long-term credentials  (username, realm, and password) need to be stored on the server- side using MD5 hash over the credentials,  which is not considered best current practice.  RFC 6151 discusses security vulnerabilities of MD5 and encourages not to it.

> 
> Problem 6 (Hosting multiple realms on a single IP address is challenging...)
> doesn't really seem to be a problem with authentication as such, so while it's
> clearly a problem, is it in scope? It isn't quite clear to me that there's a security
> threat there.

Yes, it's within the scope of TRAM. I will update Abstract as per your suggestion.

Thanks and Regards,
-Tiru

v2.46.0 | Report a Bug | By Email | System Status