Re: [Hipsec] Stephen Farrell's Discuss on draft-ietf-hip-rfc5203-bis-10: (with DISCUSS and COMMENT)

Robert Moskowitz <rgm@htt-consult.com> Wed, 27 July 2016 13:12 UTC

Return-Path: <rgm@htt-consult.com>
X-Original-To: hipsec@ietfa.amsl.com
Delivered-To: hipsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 267F012D0FA; Wed, 27 Jul 2016 06:12:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.488
X-Spam-Level:
X-Spam-Status: No, score=-5.488 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id alfAaWkMhKS7; Wed, 27 Jul 2016 06:12:07 -0700 (PDT)
Received: from z9m9z.htt-consult.com (z9m9z.htt-consult.com [50.253.254.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2DE8612D791; Wed, 27 Jul 2016 06:12:07 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by z9m9z.htt-consult.com (Postfix) with ESMTP id CB2EA621A8; Wed, 27 Jul 2016 09:12:04 -0400 (EDT)
X-Virus-Scanned: amavisd-new at htt-consult.com
Received: from z9m9z.htt-consult.com ([127.0.0.1]) by localhost (z9m9z.htt-consult.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id roxzxdzH0vCj; Wed, 27 Jul 2016 09:11:48 -0400 (EDT)
Received: from lx120e.htt-consult.com (unknown [209.65.105.133]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by z9m9z.htt-consult.com (Postfix) with ESMTPSA id 2E4FD621A7; Wed, 27 Jul 2016 09:11:39 -0400 (EDT)
To: Julien Laganier <julien.ietf@gmail.com>, HIP <hipsec@ietf.org>
References: <20160705140143.22339.24069.idtracker@ietfa.amsl.com> <CAE_dhjtc7VHZaMEu_rHZwbGKPvh1cxpsbV-BvFBYF_vp4zvehQ@mail.gmail.com> <102eb607-f1c5-9dc8-e7bb-fa5fd1daf838@cs.tcd.ie> <CAE_dhjsBGhnRT1ypTkLnGLrP8y3vFCMbj7Zb6iDTBQgbdOJY6g@mail.gmail.com> <CAE_dhjucd_p9jokVqdSOWB8bMXKp1ut4hGv47z4TvwH-1ha5dw@mail.gmail.com>
From: Robert Moskowitz <rgm@htt-consult.com>
Message-ID: <b1c6ba23-b51f-5c97-9deb-edc2e8095fae@htt-consult.com>
Date: Wed, 27 Jul 2016 06:11:31 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.0
MIME-Version: 1.0
In-Reply-To: <CAE_dhjucd_p9jokVqdSOWB8bMXKp1ut4hGv47z4TvwH-1ha5dw@mail.gmail.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/hipsec/FdT5gfYcqk5Z4W2E1raSDF7SsaE>
Cc: draft-ietf-hip-rfc5203-bis@ietf.org, hip-chairs@ietf.org, Stephen Farrell <stephen.farrell@cs.tcd.ie>
Subject: Re: [Hipsec] Stephen Farrell's Discuss on draft-ietf-hip-rfc5203-bis-10: (with DISCUSS and COMMENT)
X-BeenThere: hipsec@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the official IETF Mailing List for the HIP Working Group." <hipsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/hipsec>, <mailto:hipsec-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/hipsec/>
List-Post: <mailto:hipsec@ietf.org>
List-Help: <mailto:hipsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hipsec>, <mailto:hipsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 27 Jul 2016 13:12:10 -0000

Sorry for being late to the show.  Email and health problems then catch 
up times...


I agree.


On 07/21/2016 07:39 AM, Julien Laganier wrote:
> (trimming the whole IESG from the thread for now)
>
> HIP WG folks:
>
> Unless someone objects or has a better proposal, I intend to implement
> the following proposal to resolve Stephen's DISCUSS.
>
> OLD:
>
>     If the certificate in the parameter is not accepted, the registrar
>     MUST reject the corresponding registrations with Failure Type [IANA
>     TBD] (Invalid certificate).
>
> NEW:
>
>     If the certificate in the parameter is not accepted, the registrar
>     MUST reject the corresponding registrations with the appropriate
>     Failure Type:
>     [IANA TBD] (Bad certificate): The certificate is corrupt, contains
> invalid signatures, etc.
>     [IANA TBD] (Unsupported certificate): The certificate is of an
> unsupported type.
>     [IANA TBD] (Certificate expired): The certificate is no longer valid.
>     [IANA TBD] (Certificate other): The certificate could not be
> validated for some unspecified reason.
>     [IANA TBD] (Unknown CA): The issuing CA certificate could not be
> located or is not trusted.
>
> Thanks,
>
> --julien
>
>
> On Thu, Jul 21, 2016 at 7:35 AM, Julien Laganier <julien.ietf@gmail.com>; wrote:
>> Thanks, Stephen.
>>
>> The HIP WG was CC'd on these emails so participants have seen the
>> proposal, I will seek their feedback in a separate note.
>>
>> Best,
>>
>> --julien
>>
>> On Thu, Jul 21, 2016 at 4:22 AM, Stephen Farrell
>> <stephen.farrell@cs.tcd.ie>; wrote:
>>> Hiya,
>>>
>>> That'd be fine for clearing my discuss.
>>>
>>> I'd encourage you to also get feedback from the WG though as I
>>> don't think I've ever seen a list of cert handling errors that
>>> was correct first time around:-)
>>>
>>> Cheers,
>>> S.
>>>
>>>
>>>
>>> On 20/07/16 16:11, Julien Laganier wrote:
>>>> Hi Stephen,
>>>>
>>>> Thanks for reviewing the document.
>>>>
>>>> I think there would be value in making the cause of certificate error
>>>> explicit. Would the following change be acceptable?
>>>>
>>>> OLD:
>>>>
>>>>     If the certificate in the parameter is not accepted, the registrar
>>>>     MUST reject the corresponding registrations with Failure Type [IANA
>>>>     TBD] (Invalid certificate).
>>>>
>>>> NEW:
>>>>
>>>>     If the certificate in the parameter is not accepted, the registrar
>>>>     MUST reject the corresponding registrations with the appropriate
>>>>     Failure Type:
>>>>     [IANA TBD] (Bad certificate): The certificate is corrupt, contains
>>>> invalid signatures, etc.
>>>>     [IANA TBD] (Unsupported certificate): The certificate is of an
>>>> unsupported type.
>>>>     [IANA TBD] (Certificate expired): The certificate is no longer valid.
>>>>     [IANA TBD] (Certificate other): The certificate could not be
>>>> validated for some unspecified reason.
>>>>     [IANA TBD] (Unknown CA): The issuing CA certificate could not be
>>>> located or is not trusted.
>>>>
>>>> Please let us know.
>>>>
>>>> Best,
>>>>
>>>> --julien
>>>>
>>>>
>>>>
>>>>
>>>> On Tue, Jul 5, 2016 at 7:01 AM, Stephen Farrell
>>>> <stephen.farrell@cs.tcd.ie>; wrote:
>>>>> Stephen Farrell has entered the following ballot position for
>>>>> draft-ietf-hip-rfc5203-bis-10: Discuss
>>>>>
>>>>> When responding, please keep the subject line intact and reply to all
>>>>> email addresses included in the To and CC lines. (Feel free to cut this
>>>>> introductory paragraph, however.)
>>>>>
>>>>>
>>>>> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
>>>>> for more information about IESG DISCUSS and COMMENT positions.
>>>>>
>>>>>
>>>>> The document, along with other ballot positions, can be found here:
>>>>> https://datatracker.ietf.org/doc/draft-ietf-hip-rfc5203-bis/
>>>>>
>>>>>
>>>>>
>>>>> ----------------------------------------------------------------------
>>>>> DISCUSS:
>>>>> ----------------------------------------------------------------------
>>>>>
>>>>>
>>>>> 3.3 - This fails to distinguish between an invalid
>>>>> certificate (e.g. bad signature, unknown signer) and one
>>>>> that is valid, but is not acceptable for this purpose.  I
>>>>> don't get why that is ok for HIP, can you explain?  If it
>>>>> is ok, I think you need to say so. If it is not ok (as I'd
>>>>> suspect) then you appear to need to change text or one more
>>>>> new error code.
>>>>>
>>>>>
>>>>> ----------------------------------------------------------------------
>>>>> COMMENT:
>>>>> ----------------------------------------------------------------------
>>>>>
>>>>>
>>>>> Section 7 - I'm fine that this doesn't repeat stuff
>>>>> from 5203, but a sentence saying to go look there too
>>>>> would maybe be good. (I'm not sure if that would fix
>>>>> Alexey's discuss or not. If not, then ignore me and
>>>>> just talk to him about his discuss.)
>>>>>
>>>>>
> _______________________________________________
> Hipsec mailing list
> Hipsec@ietf.org
> https://www.ietf.org/mailman/listinfo/hipsec
>