IETF Logo Mail Archive

Re: [secdir] [Dots] Secdir telechat review of draft-ietf-dots-signal-channel-31

"Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com> Mon, 15 April 2019 15:19 UTC

Return-Path: <TirumaleswarReddy_Konda@mcafee.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9E311203D1; Mon, 15 Apr 2019 08:19:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.302
X-Spam-Level:
X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mBqc45JSgSWS; Mon, 15 Apr 2019 08:19:27 -0700 (PDT)
Received: from DNVWSMAILOUT1.mcafee.com (dnvwsmailout1.mcafee.com [161.69.31.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F3381203A1; Mon, 15 Apr 2019 08:19:26 -0700 (PDT)
X-NAI-Header: Modified by McAfee Email Gateway (5500)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=s_mcafee; t=1555341238; h=From: To:CC:Subject:Thread-Topic:Thread-Index:Date: Message-ID:References:In-Reply-To:Accept-Language: Content-Language:X-MS-Has-Attach:X-MS-TNEF-Correlator: dlp-product:dlp-version:dlp-reaction:authentication-results: x-originating-ip:x-ms-publictraffictype:x-ms-office365-filtering-correlation-id: x-microsoft-antispam:x-ms-traffictypediagnostic: x-microsoft-antispam-prvs:x-forefront-prvs: x-forefront-antispam-report:received-spf:x-ms-exchange-senderadcheck: x-microsoft-antispam-message-info:Content-Type: Content-Transfer-Encoding:MIME-Version:X-MS-Exchange-CrossTenant-Network-Message-Id: X-MS-Exchange-CrossTenant-originalarrivaltime: X-MS-Exchange-CrossTenant-fromentityheader: X-MS-Exchange-CrossTenant-id:X-MS-Exchange-CrossTenant-mailboxtype: X-MS-Exchange-Transport-CrossTenantHeadersStamped: X-OriginatorOrg:X-NAI-Spam-Flag:X-NAI-Spam-Level: X-NAI-Spam-Threshold:X-NAI-Spam-Score:X-NAI-Spam-Version; bh=AJoee3Us06mbUXKdxUHjxlc9B8jNKw+Ur618pJ BSW3M=; b=ivEaxfazxO7lPV9GVsCCzSemfrSE8mSWNGZ2FCLr +qcojkzXNctHF4S2/e+//lcfZdsYfWfE/4p5J8SUt1fa8PNfDY IiZvwqflbBNL81Td3VX6Gbar4oqjzQXJLWcmfSXXXzg5XbeJyY f2EO1HEFLDDq/hXR3Vr3lIOyDb/8j58=
Received: from DNVEXAPP1N04.corpzone.internalzone.com (DNVEXAPP1N04.corpzone.internalzone.com [10.44.48.88]) by DNVWSMAILOUT1.mcafee.com with smtp (TLS: TLSv1/SSLv3,256bits,ECDHE-RSA-AES256-SHA384) id 5712_623f_b161d121_ff93_4de0_aa03_09b8a8bceb9f; Mon, 15 Apr 2019 09:13:58 -0600
Received: from DNVEXAPP1N06.corpzone.internalzone.com (10.44.48.90) by DNVEXAPP1N04.corpzone.internalzone.com (10.44.48.88) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 15 Apr 2019 09:18:51 -0600
Received: from DNVO365EDGE2.corpzone.internalzone.com (10.44.176.74) by DNVEXAPP1N06.corpzone.internalzone.com (10.44.48.90) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Mon, 15 Apr 2019 09:18:52 -0600
Received: from NAM01-BN3-obe.outbound.protection.outlook.com (10.44.176.243) by edge.mcafee.com (10.44.176.74) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 15 Apr 2019 09:18:41 -0600
Received: from BYAPR16MB2790.namprd16.prod.outlook.com (20.178.233.91) by BYAPR16MB2581.namprd16.prod.outlook.com (20.177.226.142) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1792.14; Mon, 15 Apr 2019 15:18:40 +0000
Received: from BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::4873:7200:9e57:9e62]) by BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::4873:7200:9e57:9e62%5]) with mapi id 15.20.1792.018; Mon, 15 Apr 2019 15:18:40 +0000
From: "Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>, "mohamed.boucadair@orange.com" <mohamed.boucadair@orange.com>, "secdir@ietf.org" <secdir@ietf.org>
CC: "draft-ietf-dots-signal-channel.all@ietf.org" <draft-ietf-dots-signal-channel.all@ietf.org>, "ietf@ietf.org" <ietf@ietf.org>, "dots@ietf.org" <dots@ietf.org>
Thread-Topic: [Dots] Secdir telechat review of draft-ietf-dots-signal-channel-31
Thread-Index: AQHU842Y1PTA/7yjVUSrEcvW+vhbdqY9NliAgAAS56CAAAbVgIAAAslg
Date: Mon, 15 Apr 2019 15:18:40 +0000
Message-ID: <BYAPR16MB2790C6154049FD8E2BEF56E1EA2B0@BYAPR16MB2790.namprd16.prod.outlook.com>
References: <155533088202.10777.9128855796755282458@ietfa.amsl.com> <787AE7BB302AE849A7480A190F8B93302EA60294@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <6c4b8d89-c114-103e-9a6e-5a8ae6a59350@cs.tcd.ie> <BYAPR16MB2790A2E8BF38B8B8014DED07EA2B0@BYAPR16MB2790.namprd16.prod.outlook.com> <a2a50713-3bd7-ffac-7287-7ce171e32359@cs.tcd.ie>
In-Reply-To: <a2a50713-3bd7-ffac-7287-7ce171e32359@cs.tcd.ie>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
dlp-product: dlpe-windows
dlp-version: 11.2.0.6
dlp-reaction: no-action
authentication-results: spf=none (sender IP is ) smtp.mailfrom=TirumaleswarReddy_Konda@McAfee.com;
x-originating-ip: [1.39.154.147]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 234e268e-919d-48b3-5c5e-08d6c1b5a43b
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600140)(711020)(4605104)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:BYAPR16MB2581;
x-ms-traffictypediagnostic: BYAPR16MB2581:
x-microsoft-antispam-prvs: <BYAPR16MB25816DA30F31F39A7E3C3899EA2B0@BYAPR16MB2581.namprd16.prod.outlook.com>
x-forefront-prvs: 000800954F
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(366004)(396003)(136003)(39860400002)(346002)(32952001)(199004)(189003)(13464003)(33656002)(2201001)(305945005)(68736007)(316002)(296002)(5660300002)(4326008)(229853002)(102836004)(478600001)(86362001)(2906002)(6506007)(71200400001)(66066001)(53546011)(74316002)(71190400001)(110136005)(54906003)(72206003)(14454004)(7696005)(2501003)(7736002)(486006)(446003)(52536014)(55016002)(11346002)(93886005)(9686003)(53936002)(8936002)(76176011)(105586002)(106356001)(186003)(80792005)(6246003)(25786009)(81156014)(99286004)(3846002)(97736004)(6116002)(476003)(81166006)(6436002)(8676002)(26005)(256004)(14444005)(85282002); DIR:OUT; SFP:1101; SCL:1; SRVR:BYAPR16MB2581; H:BYAPR16MB2790.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: McAfee.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: f0NBsnknE9dZcMmLBKI5H4mHzCTxyLf5PRw34FWLB4OYZ5b7jYbnrxBuMZo0KxCNLGqyzgrPv5dL+Zql0oVCXVcDkEf4Y4dClILooN/ZwdK8B+rNpHuOslXhh4IVjOwf/1msIs+iYiN/Eudm41AOCksWqegqik/iHoEXHUKo/FrQSTwLFa/ITJULmBqXxhPBbNnILKjWqg2ErkakGnQ064kq/i782diXoPhwWXvW0ceUuSptDh1z6UxpjFO4wRCSQ1C0U6WZ4lBbThDqDZBkCaGaPlfH5Fu9vxiwmsjwFvYKEuI/G9nTf6ydF0qW1PxNS5fP7rEHXqUVX+sQxzzfpQcJx2IjhmAIufqg5Z0FtDcSSj6aV4UiSm5xkgalurL6qPALWsJ8dtNvzAQ8XYd1djOTAojOswEzTMGjgkE55rc=
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 234e268e-919d-48b3-5c5e-08d6c1b5a43b
X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Apr 2019 15:18:40.6387 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR16MB2581
X-OriginatorOrg: mcafee.com
X-NAI-Spam-Flag: NO
X-NAI-Spam-Level:
X-NAI-Spam-Threshold: 15
X-NAI-Spam-Score: 0.1
X-NAI-Spam-Version: 2.3.0.9418 : core <6525> : inlines <7052> : streams <1818740> : uri <2832450>
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/qD1CF7W5eBd33hLbS5-3rg-XKos>
Subject: Re: [secdir] [Dots] Secdir telechat review of draft-ietf-dots-signal-channel-31
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 15 Apr 2019 15:19:30 -0000

> -----Original Message-----
> From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
> Sent: Monday, April 15, 2019 8:28 PM
> To: Konda, Tirumaleswar Reddy <TirumaleswarReddy_Konda@McAfee.com>;
> mohamed.boucadair@orange.com; secdir@ietf.org
> Cc: draft-ietf-dots-signal-channel.all@ietf.org; ietf@ietf.org; dots@ietf.org
> Subject: Re: [Dots] Secdir telechat review of draft-ietf-dots-signal-channel-31
> 
> 
> 
> On 15/04/2019 15:38, Konda, Tirumaleswar Reddy wrote:
> >> -----Original Message----- From: Dots <dots-bounces@ietf.org> On
> >> Behalf Of Stephen Farrell Sent: Monday, April 15, 2019 6:56 PM To:
> >> mohamed.boucadair@orange.com; secdir@ietf.org Cc:
> >> draft-ietf-dots-signal-channel.all@ietf.org; ietf@ietf.org;
> >> dots@ietf.org Subject: Re: [Dots] Secdir telechat review of
> >> draft-ietf-dots-signal-channel-31
> >>
> >>
> >> Hiya,
> >>
> >> On 15/04/2019 14:16, mohamed.boucadair@orange.com wrote:
> >>>> - p13: The cuid still seems to me to be too static (there's a
> >>>
> >>> [Med] This is a feature not a bug. This scheme is particularly
> >>> useful to recover state, for example, upon reboot or crash of a DOTS
> >>> client.
> >>>
> >>
> >> Well, fair enough, but FWIW I'm not convinced that a client that can
> >> keep state (the private key and other dots stuff) couldn't also as
> >> easily keep a cuid value. And ISTM there should also be equally good
> >> ways to recommend for generating a cuid that don't have that
> >> 1:1 mapping to a key pair. All that said, it's not me needs to be
> >> convinced, but the IESG, so probably best to wait and see if they
> >> think this is worth changing or not before doing so.
> >
> > The advantage of the 1:1 mapping is the DOTS servers can validate the
> > DOTS client is not using the 'cuid' of another client.
> 
> So that'd be "an" advantage, if it is one;-)
> 
> But given the servers are supposed to authenticate the client via TLS client-auth
> (or else the server doesn't see the public key), I don't see the need.

The above validation helps defend against a compromised DOTS client using the 'cuid' of another DOTS client. 

-Tiru

> Nor do I recall that the server is supposed to compare the key to the cuid - if
> that check is to be done, then that'd need to be in the spec or a client that re-
> keys would have to make a new cuid. (Apologies if that's in the spec and I've
> forgotten it.)
> 
> Cheers,
> S.
> 
> 
> >
> > -Tiru
> >
> >>
> >> S.
> >>
> >

v2.23.0 | Report a Bug | By Email