Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf-nfsv4-rpc-tls-08: (with DISCUSS and COMMENT)

Chuck Lever <chuck.lever@oracle.com> Tue, 04 August 2020 12:59 UTC

Return-Path: <chuck.lever@oracle.com>
X-Original-To: nfsv4@ietfa.amsl.com
Delivered-To: nfsv4@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A9CB3A0849; Tue, 4 Aug 2020 05:59:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.101
X-Spam-Level:
X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l6vi6laNWn1m; Tue, 4 Aug 2020 05:59:00 -0700 (PDT)
Received: from aserp2120.oracle.com (aserp2120.oracle.com [141.146.126.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 548283A0846; Tue, 4 Aug 2020 05:59:00 -0700 (PDT)
Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 074Cw8SU107988; Tue, 4 Aug 2020 12:58:54 GMT
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=content-type : mime-version : subject : from : in-reply-to : date : cc : content-transfer-encoding : message-id : references : to; s=corp-2020-01-29; bh=XPcrDI+OtvB6vitJH1v7rySEc7JtrtlqTB0GQzY4ayQ=; b=cQwoFuYLcKsEVylwYH3wiMnGC1IjIqy61+jsZQApT4aGMxkGLcxqnQqEBEKUJMK+R2A8 QHjfWQbq2U0Bb6MpoUeEeYLRw51tANGkpP7sKKx7MJuThWpimurJf6FzuteV0eRg83QI gU09rHhCcGskUeSK46du5Axfc4ecpuvo5iFrXGGRrVA+gRAju+wxA9IHs3cUaXzV9oFW g20MqutFTd0t6LQ2nkwn1vCi2qUAZqm0RnZzrmjJoO2ECWNfR2tNV7XWqEtlJ3kC3W2v 9BGWbYCXu4P8j2emzfnVVVPKAt5mynWiKR104QNSlNCej0lUPvbHiBmjav/TlfTYo+Ux WA==
Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by aserp2120.oracle.com with ESMTP id 32nc9yjqg4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Tue, 04 Aug 2020 12:58:54 +0000
Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 074CviHS091113; Tue, 4 Aug 2020 12:58:53 GMT
Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userp3030.oracle.com with ESMTP id 32njawhwrd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 04 Aug 2020 12:58:53 +0000
Received: from abhmp0014.oracle.com (abhmp0014.oracle.com [141.146.116.20]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id 074CwqdR031846; Tue, 4 Aug 2020 12:58:52 GMT
Received: from anon-dhcp-152.1015granger.net (/68.61.232.219) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 04 Aug 2020 05:58:52 -0700
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\))
From: Chuck Lever <chuck.lever@oracle.com>
In-Reply-To: <F9231574-4E6B-49F2-A752-085C5A58C561@oracle.com>
Date: Tue, 4 Aug 2020 08:58:50 -0400
Cc: draft-ietf-nfsv4-rpc-tls@ietf.org, The IESG <iesg@ietf.org>, NFSv4 <nfsv4@ietf.org>, nfsv4-chairs <nfsv4-chairs@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <93A02493-3212-4474-994F-7345409D6499@oracle.com>
References: <159409225571.12966.1097397622994927028@ietfa.amsl.com> <18B68FBF-34A1-4F8F-A0E3-4A88ABAAF900@oracle.com> <F9231574-4E6B-49F2-A752-085C5A58C561@oracle.com>
To: Roman Danyliw <rdd@cert.org>
X-Mailer: Apple Mail (2.3608.80.23.2.2)
X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9702 signatures=668679
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 phishscore=0 mlxlogscore=999 mlxscore=0 spamscore=0 malwarescore=0 adultscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2008040096
X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9702 signatures=668679
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 mlxscore=0 suspectscore=0 phishscore=0 lowpriorityscore=0 spamscore=0 impostorscore=0 adultscore=0 clxscore=1015 malwarescore=0 bulkscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2008040096
Archived-At: <https://mailarchive.ietf.org/arch/msg/nfsv4/3YE1uOvDyspzh7pjcealhCYH9B0>
Subject: Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf-nfsv4-rpc-tls-08: (with DISCUSS and COMMENT)
X-BeenThere: nfsv4@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: NFSv4 Working Group <nfsv4.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/nfsv4>, <mailto:nfsv4-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/nfsv4/>
List-Post: <mailto:nfsv4@ietf.org>
List-Help: <mailto:nfsv4-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/nfsv4>, <mailto:nfsv4-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 04 Aug 2020 12:59:02 -0000

Hi Roman-

This review process has been waiting on your response for a month.


> On Jul 20, 2020, at 8:32 AM, Chuck Lever <chuck.lever@oracle.com> wrote:
> 
> Hi Roman-
> 
> I haven't heard any response on these items. Is there something more
> you need from me?
> 
> 
>> On Jul 7, 2020, at 11:15 AM, Chuck Lever <chuck.lever@oracle.com> wrote:
>> 
>> Hi Roman-
>> 
>> Thanks for your review and comments. If I may, I'd like to handle
>> the DISCUSS first, and then respond to the COMMENTs in a separate
>> reply.
>> 
>> 
>>> On Jul 6, 2020, at 11:24 PM, Roman Danyliw via Datatracker <noreply@ietf.org> wrote:
>>> 
>>> Roman Danyliw has entered the following ballot position for
>>> draft-ietf-nfsv4-rpc-tls-08: Discuss
>>> 
>>> ----------------------------------------------------------------------
>>> DISCUSS:
>>> ----------------------------------------------------------------------
>>> 
>>> ** Despite Section 5.0 stating that only TLS v1.3+ can be used, there are two
>>> references to TLS v1.2 mechanisms:
>> 
>> Good catch!
>> 
>> 
>>> -- Section 5.0. Per “Implementations MUST support certificate-based mutual
>>> authentication.  Support for TLS-PSK mutual authentication [RFC4279] is
>>> OPTIONAL”.  Shouldn’t Section 2.2.2 or 4.2.11 of RFC8446 be used instead?
>> 
>> In fact Section 5.2.3 already cites RFC8446 Section 2.2. I propose changing
>> Section 5.0 as follows:
>> 
>> OLD:
>> 
>>  *  Implementations MUST support certificate-based mutual
>>     authentication.  Support for TLS-PSK mutual authentication
>>     [RFC4279] is OPTIONAL.  See Section 4.2 for further details.
>> 
>> NEW:
>> 
>>  *  Implementations MUST support certificate-based mutual
>>     authentication.  Support for PSK mutual authentication is
>>     OPTIONAL; see Section 5.2.3 for further details.
>> 
>> 
>>> -- Section 5.2.4.  The token binding mechanism suggested here, RFC8471, only
>>> applies to TLS v1.2.  The expired draft-ietf-tokbind-tls13 provides the TLS
>>> v1.3 mechanism.
>> 
>> Potential replacement:
>> 
>> OLD:
>> 
>> 5.2.4.  Token Binding
>> 
>>  This mechanism is OPTIONAL to implement.  In this mode, a token
>>  uniquely identifies the RPC peer.
>> 
>>  Versions of TLS after TLS 1.2 contain a token binding mechanism that
>>  is more secure than using certificates.  This mechanism is detailed
>>  in [RFC8471].
>> 
>> NEW:
>> 
>> 5.2.4.  Token Binding
>> 
>>  This mechanism is OPTIONAL to implement.  In this mode, a token
>>  uniquely identifies the RPC peer.  The TLSv1.3 token binding
>>  mechanism is detailed in [I-D.ietf-tokbind-tls13].
>> 
>> 
>> Another option would be to remove this section.
>> 
>> 
>>> ** Section 7.4.  Per “When using AUTH_NULL or AUTH_SYS, both peers are required
>>> to have DNS TLSA records and certificate material …”, what is “certificate
>>> materials”?  Can this guidance please be clarified (and perhaps related to the
>>> options specified in Section 5.2).
>> 
>> Potential replacement:
>> 
>> OLD:
>> 
>>  *  When using AUTH_NULL or AUTH_SYS, both peers are required to have
>>     DNS TLSA records and certificate material, and a policy that
>>     requires mutual peer authentication and rejection of a connection
>>     when host authentication fails.
>> 
>> NEW:
>> 
>>  *  When using AUTH_NULL or AUTH_SYS, both peers are required to have
>>     DNS TLSA records, keys with which to perform mutual peer
>>     authentication using one of the methods described in Section 5.2,
>>     and a security policy that requires mutual peer authentication and
>>     rejection of a connection when host authentication fails.
> 
> --
> Chuck Lever
> 
> 
> 

--
Chuck Lever