Re: draft-williams-on-channel-binding-00.txt is in the I-D repository

[Simon Josefsson <[e-mail]>]

Nicolas Williams <[e-mail]> writes:

> Folks, the replacement for draft-ietf-nfsv4-channel-bindings,
> draft-williams-on-channel-binding-00.txt, is now in the I-D repository.
>
> It has also been significantly expanded.  Please review.  I'd like to
> ask the security ADs for an IETF Last Call on this I-D soon.

Looks good in general.  A general design question:

What about SASL/GS2 over TLS over SSH over IPSEC?  What is the channel
bindings for that, is it only the TLS binding?  Consider if the
application regards the TLS layer as weak (export ciphers) but the SSH
layer as strong, would it be permitted to use the SSH channel binding?
This sounds to me like it may require negotiation in GS2.

Some specific comments:

Section 2.1:

  o  The channel bindings for a given type of secure channel MUST be
      constructed in such a way that an MITM could not easily force the
      channel bindings of a given channel to match those of another.

I'd change this to:

  o  The channel bindings for a given type of secure channel MUST be
      constructed in such a way that an MITM cannot influence the
      channel bindings.

This drops "easily", and makes the requirement a bit stronger; the
MITM should not have any influence over the channel bindings.

This:

   o  Unique channel bindings MUST bind not only the key exchange for
      the secure channel, but also any negotiations and authentication
      that may have taken place to establish the channel.

Sometimes negotiations/authentications are done by other protocols, or
even out-of-band over the phone, and the intention was not to cover
those things, right?  I'm not sure how to phrase it better, though.

/Simon