[OPSAWG] Mail regarding draft-ietf-opsawg-tacacs-tls13

[Anthony Somerset <[e-mail]>]

Hi There

Thanks for the work on this draft it would be great to get this done soon.

Apart from a few minor grammatical nits this looks pretty good, just one query from me.

Section 3.2.2 could do with some clarification regarding Mutual Auth, My understanding is that

Client will connect to Server, Server will present a certificate so that client can validate it is the correct server etc and otherwise close if not verified

Client will present its certificate to the server and the server will authenticate the client identity on the basis of this certificate - and this largely replaces the shared secret based obfuscation method of identification

However there is also mention of TLS PSK (5.1.3) in the draft but its not clear if this is something that is mutually exclusive of the mutual cert auth or its an alternative that could negate the requirement for client authentications and allow for a traditional 1 way verification common in a client/server connection.

So perhaps there could be some clarity or at least separation of server verification, vs client verification/identification.

I would also recommend that anywhere that suggests non default config to do things like disabling verification (3.2.2) that some wording to the effect that this is not recommended outside of lab environments

Thanks again

Anthony Somerset
This email disclaimer applies to the original email, all attachments and any subsequent emails sent by Liquid Telecom. This email contains valuable business information that is privileged, confidential and/or otherwise protected from disclosure, intended only for the named person or entity to which it is addressed. If you are not the intended recipient of this email and you received this e-mail in error, any review, use, dissemination, distribution, printing or copying of this e-mail is strictly prohibited and may be unlawful and/or an infringement of copyright. Please notify us immediately of the error and permanently delete the email from your system, retaining no copies in any media. No employee or agent is authorized to conclude any binding agreement on behalf of Liquid Telecom with another party or give any warranty by email without the express written confirmation by an authorized representative or a director of Liquid Telecom. Nothing in this email shall be construed as a legally binding agreement or warranty or an offer to contract. Liquid Telecom will not be responsible for any damages suffered by the recipient as a result of the recipient not taking cognizance of this principle. Liquid Telecom accepts no liability of whatever nature for any loss, liability, damage or expense resulting directly or indirectly from the access of any files which are attached to this message. Any email addressed to Liquid Telecom shall only be deemed to have been received once receipt is confirmed by Liquid Telecom orally or in writing. An automated acknowledgment of receipt will not suffice as proof of receipt by the Liquid Telecom. This email disclaimer shall be governed by the laws of South Africa.