Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf-nfsv4-rpc-tls-08: (with DISCUSS and COMMENT)
Chuck Lever <chuck.lever@oracle.com> Mon, 20 July 2020 12:32 UTC
Return-Path: <chuck.lever@oracle.com>
X-Original-To: nfsv4@ietfa.amsl.com
Delivered-To: nfsv4@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3EFD13A0933; Mon, 20 Jul 2020 05:32:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.101
X-Spam-Level:
X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aEqoHPO4EyiA; Mon, 20 Jul 2020 05:32:22 -0700 (PDT)
Received: from aserp2120.oracle.com (aserp2120.oracle.com [141.146.126.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ADA943A0976; Mon, 20 Jul 2020 05:32:18 -0700 (PDT)
Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 06KCIW9L138147; Mon, 20 Jul 2020 12:32:12 GMT
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=content-type : mime-version : subject : from : in-reply-to : date : cc : content-transfer-encoding : message-id : references : to; s=corp-2020-01-29; bh=PJd2pikNeMVXMr6huPjxUIwpsNwx9RLrodn65FoebU4=; b=TFKHkw8tWYYz7d3ENU6eUzK+rMK76UxcAfAg87QdaX1VC2NMGAJ80MquK/hmjPgQ+njG abDavcFeFsv6IrqwTBBB+Zy8y1IPgmVwm9WspAccK2G5KG1cGuB5LxGHhp7PHGdtD9XU BsNDJV0O9Tl99IMb53llQfeJQ4JFoVvW8iMctWP7TDDY5eb33icmRDHu/Y9WbiAYQH7+ IRgm2I/VzXnJ0PXJgcIAJbqfnd5aDFozyvQ1xbNhAszWDmiIxd+qXbFntRDbKJsLSfAk lapCH+Cs293TuCl4uDLUww7tOdJKw9kSo1VaSDMgGaVWdlgN6NRLfW2NiySyloKWK6ty aA==
Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by aserp2120.oracle.com with ESMTP id 32bs1m6m32-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Mon, 20 Jul 2020 12:32:12 +0000
Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 06KCDIXL043309; Mon, 20 Jul 2020 12:32:11 GMT
Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userp3030.oracle.com with ESMTP id 32da2cw1gu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 20 Jul 2020 12:32:11 +0000
Received: from abhmp0006.oracle.com (abhmp0006.oracle.com [141.146.116.12]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id 06KCW6Mh029999; Mon, 20 Jul 2020 12:32:06 GMT
Received: from anon-dhcp-152.1015granger.net (/68.61.232.219) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 20 Jul 2020 05:32:06 -0700
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\))
From: Chuck Lever <chuck.lever@oracle.com>
In-Reply-To: <18B68FBF-34A1-4F8F-A0E3-4A88ABAAF900@oracle.com>
Date: Mon, 20 Jul 2020 08:32:05 -0400
Cc: draft-ietf-nfsv4-rpc-tls@ietf.org, The IESG <iesg@ietf.org>, nfsv4@ietf.org, nfsv4-chairs <nfsv4-chairs@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <F9231574-4E6B-49F2-A752-085C5A58C561@oracle.com>
References: <159409225571.12966.1097397622994927028@ietfa.amsl.com> <18B68FBF-34A1-4F8F-A0E3-4A88ABAAF900@oracle.com>
To: Roman Danyliw <rdd@cert.org>
X-Mailer: Apple Mail (2.3608.80.23.2.2)
X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9687 signatures=668680
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 bulkscore=0 suspectscore=0 spamscore=0 phishscore=0 mlxscore=0 adultscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007200085
X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9687 signatures=668680
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 bulkscore=0 adultscore=0 lowpriorityscore=0 mlxlogscore=999 malwarescore=0 clxscore=1015 spamscore=0 mlxscore=0 impostorscore=0 phishscore=0 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007200085
Archived-At: <https://mailarchive.ietf.org/arch/msg/nfsv4/FS_mBOCu_HFxzDas5NJN2kUEVUA>
Subject: Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf-nfsv4-rpc-tls-08: (with DISCUSS and COMMENT)
X-BeenThere: nfsv4@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: NFSv4 Working Group <nfsv4.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/nfsv4>, <mailto:nfsv4-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/nfsv4/>
List-Post: <mailto:nfsv4@ietf.org>
List-Help: <mailto:nfsv4-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/nfsv4>, <mailto:nfsv4-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 20 Jul 2020 12:32:29 -0000
Hi Roman- I haven't heard any response on these items. Is there something more you need from me? > On Jul 7, 2020, at 11:15 AM, Chuck Lever <chuck.lever@oracle.com> wrote: > > Hi Roman- > > Thanks for your review and comments. If I may, I'd like to handle > the DISCUSS first, and then respond to the COMMENTs in a separate > reply. > > >> On Jul 6, 2020, at 11:24 PM, Roman Danyliw via Datatracker <noreply@ietf.org> wrote: >> >> Roman Danyliw has entered the following ballot position for >> draft-ietf-nfsv4-rpc-tls-08: Discuss >> >> ---------------------------------------------------------------------- >> DISCUSS: >> ---------------------------------------------------------------------- >> >> ** Despite Section 5.0 stating that only TLS v1.3+ can be used, there are two >> references to TLS v1.2 mechanisms: > > Good catch! > > >> -- Section 5.0. Per “Implementations MUST support certificate-based mutual >> authentication. Support for TLS-PSK mutual authentication [RFC4279] is >> OPTIONAL”. Shouldn’t Section 2.2.2 or 4.2.11 of RFC8446 be used instead? > > In fact Section 5.2.3 already cites RFC8446 Section 2.2. I propose changing > Section 5.0 as follows: > > OLD: > > * Implementations MUST support certificate-based mutual > authentication. Support for TLS-PSK mutual authentication > [RFC4279] is OPTIONAL. See Section 4.2 for further details. > > NEW: > > * Implementations MUST support certificate-based mutual > authentication. Support for PSK mutual authentication is > OPTIONAL; see Section 5.2.3 for further details. > > >> -- Section 5.2.4. The token binding mechanism suggested here, RFC8471, only >> applies to TLS v1.2. The expired draft-ietf-tokbind-tls13 provides the TLS >> v1.3 mechanism. > > Potential replacement: > > OLD: > > 5.2.4. Token Binding > > This mechanism is OPTIONAL to implement. In this mode, a token > uniquely identifies the RPC peer. > > Versions of TLS after TLS 1.2 contain a token binding mechanism that > is more secure than using certificates. This mechanism is detailed > in [RFC8471]. > > NEW: > > 5.2.4. Token Binding > > This mechanism is OPTIONAL to implement. In this mode, a token > uniquely identifies the RPC peer. The TLSv1.3 token binding > mechanism is detailed in [I-D.ietf-tokbind-tls13]. > > > Another option would be to remove this section. > > >> ** Section 7.4. Per “When using AUTH_NULL or AUTH_SYS, both peers are required >> to have DNS TLSA records and certificate material …”, what is “certificate >> materials”? Can this guidance please be clarified (and perhaps related to the >> options specified in Section 5.2). > > Potential replacement: > > OLD: > > * When using AUTH_NULL or AUTH_SYS, both peers are required to have > DNS TLSA records and certificate material, and a policy that > requires mutual peer authentication and rejection of a connection > when host authentication fails. > > NEW: > > * When using AUTH_NULL or AUTH_SYS, both peers are required to have > DNS TLSA records, keys with which to perform mutual peer > authentication using one of the methods described in Section 5.2, > and a security policy that requires mutual peer authentication and > rejection of a connection when host authentication fails. -- Chuck Lever
- [nfsv4] Roman Danyliw's Discuss on draft-ietf-nfs… Roman Danyliw via Datatracker
- Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf… Chuck Lever
- Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf… Chuck Lever
- Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf… Chuck Lever
- Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf… Chuck Lever
- Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf… Mkrtchyan, Tigran
- Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf… Chuck Lever
- Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf… Chuck Lever
- Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf… David Noveck
- Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf… Roman Danyliw
- Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf… Chuck Lever
- Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf… David Noveck
- Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf… Chuck Lever
- Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf… David Noveck
- Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf… Chuck Lever
- Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf… David Noveck
- Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf… Chuck Lever