[secdir] Secdir telechat review of draft-ietf-tls-exported-authenticator-14
Yaron Sheffer via Datatracker <noreply@ietf.org> Fri, 02 April 2021 16:05 UTC
Return-Path: <noreply@ietf.org>
X-Original-To: secdir@ietf.org
Delivered-To: secdir@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E0773A1B89; Fri, 2 Apr 2021 09:05:38 -0700 (PDT)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: Yaron Sheffer via Datatracker <noreply@ietf.org>
To: secdir@ietf.org
Cc: draft-ietf-tls-exported-authenticator.all@ietf.org, last-call@ietf.org, tls@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 7.27.0
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <161737953853.16107.13360840429966992303@ietfa.amsl.com>
Reply-To: Yaron Sheffer <yaronf.ietf@gmail.com>
Date: Fri, 02 Apr 2021 09:05:38 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/8SW62r6jdFCj6HbmWrYnufmnbUM>
Subject: [secdir] Secdir telechat review of draft-ietf-tls-exported-authenticator-14
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.29
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 02 Apr 2021 16:05:39 -0000
Reviewer: Yaron Sheffer Review result: Has Issues After a bit of back and forth over my *two* previous SecDir requests, I'm afraid that my original comment has not yet been fully addressed. The IANA considerations section (Sec. 8.1) adds server_name as a possible extension for CertificateRequest. This would be a non-backward compatible change to TLS. IMO what we needed to do is both to clarify the allowed extensions for what Nick called "the CR-like structure" (almost done in Sec. 4, though the last sentence should by changed to include CertificateRequest) and undo the change to the TLS ExtensionType registry (not done, would require to remove Sec. 8.1). * Nit: this sentence is repeated almost verbatim in Sec. 4 and Sec. 5, and in both cases is mangled. Old: The application layer protocol used to send the authenticator request SHOULD use a secure with equivalent security to TLS, such as QUIC [QUIC-TLS], as its as its underlying transport to keep the request confidential. New: The application layer protocol used to send the authenticator request SHOULD use a secure *channel* with equivalent security to TLS, such as QUIC [QUIC-TLS], as its ~~as its~~ underlying transport to keep the request confidential.
- [secdir] Secdir telechat review of draft-ietf-tls… Yaron Sheffer via Datatracker
- Re: [secdir] Secdir telechat review of draft-ietf… Benjamin Kaduk
- Re: [secdir] Secdir telechat review of draft-ietf… Yaron Sheffer