Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf-nfsv4-rpc-tls-08: (with DISCUSS and COMMENT)

Chuck Lever <chuck.lever@oracle.com> Tue, 07 July 2020 15:16 UTC

Return-Path: <chuck.lever@oracle.com>
X-Original-To: nfsv4@ietfa.amsl.com
Delivered-To: nfsv4@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C64C3A0DE6; Tue, 7 Jul 2020 08:16:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.101
X-Spam-Level:
X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wRpO6W3xvbjj; Tue, 7 Jul 2020 08:16:18 -0700 (PDT)
Received: from userp2130.oracle.com (userp2130.oracle.com [156.151.31.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A74A3A0DF0; Tue, 7 Jul 2020 08:16:07 -0700 (PDT)
Received: from pps.filterd (userp2130.oracle.com [127.0.0.1]) by userp2130.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 067FBcHR011473; Tue, 7 Jul 2020 15:16:03 GMT
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=content-type : mime-version : subject : from : in-reply-to : date : cc : content-transfer-encoding : message-id : references : to; s=corp-2020-01-29; bh=6eliw2m2/Qa+rfZxM4puvKhZ/FYogAfy2VO/tHkna3U=; b=VDqJ4LnVOAIo/r21BBmtQTfQPrzuok+sPknRIniasDhyI318xij17Bryivxb934x0xWJ Hlab3ihKCE4GPADGt62DRENvXGVGi2Vv+eDkfOu1PFl0kKz2ePWjv532IIhcscZ+d4Vy RVV4NQ+ZuIfYM8H3F0STt3Wlh3GOjPeUhB0JFfgKJ/TVc8BcAYZ/MFJzG3C7bGmhNvXF 8bCxn54y7/wIhqSGRMrJxAy3Cd2Ef1F9eZ6VnwmNTODJRQKH012uJjCAmyiVIdeEImo1 /9tOE43g8wvTjvJ5j5K1V+/64VIqnjPAXdk4hswrL9usujthkNj+nFixGZDz8KKM5s7V 5Q==
Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by userp2130.oracle.com with ESMTP id 323wacgy36-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Tue, 07 Jul 2020 15:16:03 +0000
Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 067F95IO085680; Tue, 7 Jul 2020 15:16:03 GMT
Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userp3020.oracle.com with ESMTP id 324n4rb9u0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 07 Jul 2020 15:16:02 +0000
Received: from abhmp0015.oracle.com (abhmp0015.oracle.com [141.146.116.21]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id 067FFwxn026079; Tue, 7 Jul 2020 15:15:58 GMT
Received: from anon-dhcp-153.1015granger.net (/68.61.232.219) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 07 Jul 2020 08:15:57 -0700
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.14\))
From: Chuck Lever <chuck.lever@oracle.com>
In-Reply-To: <159409225571.12966.1097397622994927028@ietfa.amsl.com>
Date: Tue, 7 Jul 2020 11:15:56 -0400
Cc: The IESG <iesg@ietf.org>, draft-ietf-nfsv4-rpc-tls@ietf.org, nfsv4-chairs <nfsv4-chairs@ietf.org>, nfsv4@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <18B68FBF-34A1-4F8F-A0E3-4A88ABAAF900@oracle.com>
References: <159409225571.12966.1097397622994927028@ietfa.amsl.com>
To: Roman Danyliw <rdd@cert.org>
X-Mailer: Apple Mail (2.3445.104.14)
X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9675 signatures=668680
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 phishscore=0 mlxlogscore=999 spamscore=0 adultscore=0 malwarescore=0 suspectscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2007070113
X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9675 signatures=668680
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 lowpriorityscore=0 priorityscore=1501 phishscore=0 spamscore=0 mlxlogscore=999 adultscore=0 cotscore=-2147483648 suspectscore=0 impostorscore=0 bulkscore=0 mlxscore=0 clxscore=1011 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2007070113
Archived-At: <https://mailarchive.ietf.org/arch/msg/nfsv4/LdKZuBXupexmDZwAns5e3T9P4RA>
Subject: Re: [nfsv4] Roman Danyliw's Discuss on draft-ietf-nfsv4-rpc-tls-08: (with DISCUSS and COMMENT)
X-BeenThere: nfsv4@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: NFSv4 Working Group <nfsv4.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/nfsv4>, <mailto:nfsv4-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/nfsv4/>
List-Post: <mailto:nfsv4@ietf.org>
List-Help: <mailto:nfsv4-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/nfsv4>, <mailto:nfsv4-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 07 Jul 2020 15:16:20 -0000

Hi Roman-

Thanks for your review and comments. If I may, I'd like to handle
the DISCUSS first, and then respond to the COMMENTs in a separate
reply.


> On Jul 6, 2020, at 11:24 PM, Roman Danyliw via Datatracker <noreply@ietf.org> wrote:
> 
> Roman Danyliw has entered the following ballot position for
> draft-ietf-nfsv4-rpc-tls-08: Discuss
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> ** Despite Section 5.0 stating that only TLS v1.3+ can be used, there are two
> references to TLS v1.2 mechanisms:

Good catch!


> -- Section 5.0. Per “Implementations MUST support certificate-based mutual
> authentication.  Support for TLS-PSK mutual authentication [RFC4279] is
> OPTIONAL”.  Shouldn’t Section 2.2.2 or 4.2.11 of RFC8446 be used instead?

In fact Section 5.2.3 already cites RFC8446 Section 2.2. I propose changing
Section 5.0 as follows:

OLD:

   *  Implementations MUST support certificate-based mutual
      authentication.  Support for TLS-PSK mutual authentication
      [RFC4279] is OPTIONAL.  See Section 4.2 for further details.

NEW:

   *  Implementations MUST support certificate-based mutual
      authentication.  Support for PSK mutual authentication is
      OPTIONAL; see Section 5.2.3 for further details.


> -- Section 5.2.4.  The token binding mechanism suggested here, RFC8471, only
> applies to TLS v1.2.  The expired draft-ietf-tokbind-tls13 provides the TLS
> v1.3 mechanism.

Potential replacement:

OLD:

5.2.4.  Token Binding

   This mechanism is OPTIONAL to implement.  In this mode, a token
   uniquely identifies the RPC peer.

   Versions of TLS after TLS 1.2 contain a token binding mechanism that
   is more secure than using certificates.  This mechanism is detailed
   in [RFC8471].

NEW:

5.2.4.  Token Binding

   This mechanism is OPTIONAL to implement.  In this mode, a token
   uniquely identifies the RPC peer.  The TLSv1.3 token binding
   mechanism is detailed in [I-D.ietf-tokbind-tls13].


Another option would be to remove this section.


> ** Section 7.4.  Per “When using AUTH_NULL or AUTH_SYS, both peers are required
> to have DNS TLSA records and certificate material …”, what is “certificate
> materials”?  Can this guidance please be clarified (and perhaps related to the
> options specified in Section 5.2).

Potential replacement:

OLD:

   *  When using AUTH_NULL or AUTH_SYS, both peers are required to have
      DNS TLSA records and certificate material, and a policy that
      requires mutual peer authentication and rejection of a connection
      when host authentication fails.

NEW:

   *  When using AUTH_NULL or AUTH_SYS, both peers are required to have
      DNS TLSA records, keys with which to perform mutual peer
      authentication using one of the methods described in Section 5.2,
      and a security policy that requires mutual peer authentication and
      rejection of a connection when host authentication fails.


--
Chuck Lever