Re: [Secdispatch] Requesting agenda time for draft-halen-fed-tls-auth

[Eric Rescorla <[e-mail]>]

Document: draft-halen-fed-tls-auth-03.txt

I took a quick look at this document. It's not entirely clear
to me what it is you want to standardize. Is it the metadata
structures defined in S. 4? Assuming so, then I think this
would need a new WG and I would suggest a BOF to assess
IETF interest.


I'm having a little trouble understanding the main idea
here. You say:

   This key exchange is performed through the publication of the
   federation metadata by the federation and the use of that federation
   metadata by its members.  Without a federation, the server side is
   often required to create a public key infrastructure (PKI) in order
   to distribute client certificates.The Swedish education sector uses

But as I understand this design, you in fact have a PKI, it's
just that it's carried in a single JWS-signed metadata object
rather than in X.509 certificates. This seems less flexible,
so it's not clear to me what the advantage of this design
is.

This needs considerably more detail about how it is used
in practice. Specifically, it's not clear to me what
the reference identity is that I am supposed to compare
the pins to. I.e., if I think I am connecting to a given
domain name, which is the common practice, how do I look
that up in the metadata?

-Ekr



On Wed, Jul 6, 2022 at 6:28 AM Stefan Halen <stefan.halen=
[e-mail]> wrote:

> Hi Secdispatch,
>
> I would like to request agenda time at IETF 114 for dispatching
> draft-halen-fed-tls-auth
> https://datatracker.ietf.org/doc/draft-halen-fed-tls-auth
>
> Time: 15 min
>
> The draft describes how to federate machine-to-machine authentication
> using already well-established protocols. Federated TLS Authentication
> (FedTLS) is a simple layer on top of TLS utilizing mutual TLS and public
> key pinning to establish a secure end-to-end channel. Information about
> the peers (e.g., organization, certificate issuers, pins) are aggregated
> and published by a federation as a JWS.
>
> Background
>
> In Sweden we are running a SAML federation and a FedTLS federation for
> the school sector. The school's administrative processes are digitized
> and automated. There is also a standardized protocol that enables
> schools to automate the User Lifecycle Management (ULM) for remote
> services. One of the stakeholders is the National Agency for Education.
> They will use the FedTLS federation to secure the ULM API for the
> digital national tests. FedTLS is also used for license management and
> for ordering digital teaching material and more to come. We are also
> considering providing FedTLS as a service in the federation for the
> Swedish health care sector.
>
> Open Source implementations:
> https://github.com/Sambruk/EgilSCIM
> https://github.com/joesiltberg/bowness
> https://github.com/Sambruk/windermere
>
> Feedback is greatly appreciated.
>
> Regards,
> Stefan Halén
> The Swedish Internet Foundation
> _______________________________________________
> Secdispatch mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/secdispatch
>