Re: [Teep] Working Group Last Call for HTTP Transport for Trusted Execution Environment Provisioning: Agent-to-TAM Communication

"Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com> Sun, 15 March 2020 06:04 UTC

Return-Path: <tirumaleswarreddy_konda@mcafee.com>
X-Original-To: teep@ietfa.amsl.com
Delivered-To: teep@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B43B3A0FFA for <teep@ietfa.amsl.com>; Sat, 14 Mar 2020 23:04:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.089
X-Spam-Level:
X-Spam-Status: No, score=-2.089 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, T_SPF_TEMPERROR=0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nw6ombSTgBEz for <teep@ietfa.amsl.com>; Sat, 14 Mar 2020 23:04:45 -0700 (PDT)
Received: from us-smtp-delivery-140.mimecast.com (us-smtp-delivery-140.mimecast.com [63.128.21.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 216ED3A0FF7 for <teep@ietf.org>; Sat, 14 Mar 2020 23:04:45 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=mimecast20190606; t=1584252284; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=BX9cHhtvgCnJnWaHGbEGA4hVCVUffMqxmcjXijyJH0E=; b=SDgDl0wgL9BtRWv5pMU90d+BzxUp3XM8u/z4eCcA6CLVRSyFQhM5b25UIBAcrJS8pa4uUV 1X1g+ZXZbNFIcnqpN8jFTcoqu4KjNkIFcRNqAUD/xOz06RAMclCu2+LCPz4bx+3wLZZq4F xYJMYtccvh8Euu2rQgRUCWHxRwA1Ms8=
Received: from NAM04-BN3-obe.outbound.protection.outlook.com (mail-bn3nam04lp2056.outbound.protection.outlook.com [104.47.46.56]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-102-1xT3c_BPMiSxJNafBCTCLA-1; Sun, 15 Mar 2020 02:04:41 -0400
X-MC-Unique: 1xT3c_BPMiSxJNafBCTCLA-1
Received: from CY4PR1601MB1254.namprd16.prod.outlook.com (2603:10b6:903:d4::12) by CY4PR1601MB1352.namprd16.prod.outlook.com (2603:10b6:903:d3::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2814.18; Sun, 15 Mar 2020 06:04:39 +0000
Received: from CY4PR1601MB1254.namprd16.prod.outlook.com ([fe80::8172:432c:9870:d8fc]) by CY4PR1601MB1254.namprd16.prod.outlook.com ([fe80::8172:432c:9870:d8fc%5]) with mapi id 15.20.2814.021; Sun, 15 Mar 2020 06:04:38 +0000
From: "Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com>
To: "teep@ietf.org" <teep@ietf.org>
Thread-Topic: Working Group Last Call for HTTP Transport for Trusted Execution Environment Provisioning: Agent-to-TAM Communication
Thread-Index: AdXgu0iSExhAZRZISA2YiaXw3QSuswZ06BMA
Date: Sun, 15 Mar 2020 06:04:38 +0000
Message-ID: <CY4PR1601MB1254B12910386A4EB149D35EEAF80@CY4PR1601MB1254.namprd16.prod.outlook.com>
References: <CY4PR1601MB12540E3731269EF636F9D5B1EA180@CY4PR1601MB1254.namprd16.prod.outlook.com>
In-Reply-To: <CY4PR1601MB12540E3731269EF636F9D5B1EA180@CY4PR1601MB1254.namprd16.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
dlp-product: dlpe-windows
dlp-version: 11.4.0.45
dlp-reaction: no-action
x-originating-ip: [49.37.206.212]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: b211880c-e767-40d0-72fa-08d7c8a6beef
x-ms-traffictypediagnostic: CY4PR1601MB1352:
x-microsoft-antispam-prvs: <CY4PR1601MB1352D5DE8C97119488295EE3EAF80@CY4PR1601MB1352.namprd16.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-forefront-prvs: 0343AC1D30
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(376002)(39860400002)(366004)(346002)(136003)(32952001)(199004)(53546011)(6506007)(7696005)(66574012)(71200400001)(66476007)(66556008)(66446008)(55016002)(9686003)(76116006)(66946007)(64756008)(81166006)(33656002)(478600001)(86362001)(2906002)(966005)(316002)(26005)(81156014)(186003)(6916009)(8936002)(5660300002)(8676002)(9326002)(52536014)(85282002); DIR:OUT; SFP:1101; SCL:1; SRVR:CY4PR1601MB1352; H:CY4PR1601MB1254.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: 6INto9ootVHkVVZLYHK1+K0/BfAzibr0k9mEubZZSrERfi3rNUzNHWsE3IvUJpD4bloeUQciKR5Q9KZaMKPdV6ZfZmhBh/tPuPZgpozfaLeyiHGzD2NE9sbadSG70veVIxpyFu942311hxAt5tu5sXoZxG4LiRyi9iV2H1Z8MmyaOcRIgaf3pw4Woy53AR6LVwyKXnBSiw9zZWQYgCYIajgzVXbOrNKdqHXCXjsHYzw/CY6K1/yvVF9o1sKqCpBlstv4TRZb+zzZHxx62aU2gRqk/YAZAA9sulKfKoSslszYQXB7ICFBeIA+kbJh/c3imKv+oK741YkmhroTMP+HwIDVaiTNeNGwQFI5lJKt5LaV+jhaIc0RBZ4Lhkq1oT4NaT1CCM+f9aifxIzSp+jILHo3p61eKA0UUfRwSO0Yvc7NULQ+5xWC/gpAtCYM4DtjFATd69xTIQiSyJzChDWeIA2cHsoX0xJZkZ6d+mhqEXpAOCQDhrhufJSe3oDnZ9+ns7yMJPQWvwk0BEB7wJO9xjXCsdqazKbem9lZ1ebP7VXFoKiSYb3gHNZjlFXtrcik8rhaJC0Af3rtpMY62f6RAsltaVxnHWNk5IsIrxQFvew=
x-ms-exchange-antispam-messagedata: bovbIPDjzyHu7Nz4U5RybPourE3gG17fOaIKUftWMTVqwjQ86tEBmnTbEtke4B3Neix6rXyJWyHzBjuk8rcCNi+/b5dPPIl97zG2AUEoFk82SCbhFWA7ATBstY9Hfv9GEbaOwSMma12J7cUrV+eqaQ==
x-ms-exchange-transport-forked: True
MIME-Version: 1.0
X-OriginatorOrg: mcafee.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b211880c-e767-40d0-72fa-08d7c8a6beef
X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Mar 2020 06:04:38.8814 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: FCeIOcby71rc6XDaybgSodFAySQflFS6pdigNjizu2WdpVzAQJMTVxtwfVz7JkeFOW5xG9B7O4DJ5OTp5wCeq4niYmbcFZBDVeEiTtBr93aQ6WoCWe2LCGwJ3413ivbD
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR1601MB1352
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: mcafee.com
Content-Type: multipart/alternative; boundary="_000_CY4PR1601MB1254B12910386A4EB149D35EEAF80CY4PR1601MB1254_"
Archived-At: <https://mailarchive.ietf.org/arch/msg/teep/eUbMl5Qdl3rv-E5EvgtkMN_qhxI>
Subject: Re: [Teep] Working Group Last Call for HTTP Transport for Trusted Execution Environment Provisioning: Agent-to-TAM Communication
X-BeenThere: teep@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement <teep.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/teep>, <mailto:teep-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/teep/>
List-Post: <mailto:teep@ietf.org>
List-Help: <mailto:teep-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/teep>, <mailto:teep-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 15 Mar 2020 06:04:55 -0000

Hi Dave,



Comments and nits below:



1)

   TAMs are reachable on the Internet, and Agents are on networks

   that might be behind a firewall, so that communication must be

   initiated by an Agent.  Thus, the Agent has an HTTP Client and

   the TAM has an HTTP Server.



Nit> Agents can also be behind NAT (and not reachable on the  Internet).



2)

      Agents are reachable on the Internet, and TAMs are on networks

       that might be behind a firewall, so that communication must be

       initiated by a TAM.  Thus, the Agent has an HTTP Server and the

       TAM has an HTTP Client.



Comment> What is the use case of hosting TAMs not reachable on Internet ?

Comment> If Agent is reachable on the Internet, it can be subjected to various attacks (e.g., DDoS).



3) Nit> Please add a reference to QUIC.

    Comment> Why refer to QUIC when it is not discussed in the document ?



4)    When HTTPS is used, TLS certificates MUST be checked according to [RFC2818].



Comment> RFC2818 refers to TLS 1.0 and several of its sections are outdated in comparison with TLS 1.3.

Comment> For example, when TLS 1.3 is used, is 0-RTT supported ?

Comment> RFC2818 refers to RFC2459 and is obsoleted by RFC5280.

Comment> What TLS versions should the client and server support (If TLS 1.2 needs to be supported, please add text discussing the privacy and security implications) ?



5)  HTTP is susceptible to several attacks including pervasive monitoring, any specific reason to support HTTP ?



6) If the TEEP implementation already had a cached TAM certificate that it trusts, it could skip to

     step 9 instead and generate a QueryResponse.)



Comment> I don't get the above line, none of the steps discuss caching of TAM certificate.



7)

   If any error occurs where the TEEP/HTTP Server cannot get a message

   buffer (empty or not) back from the TEEP implementation, the TEEP/

   HTTP Server generates an appropriate HTTP error response.



Comment> Any specific reason for not specifying the error code ?



8)

   Although TEEP is protected end-to-end inside of HTTP, there is still

   value in using HTTPS for transport, since HTTPS can provide

   additional protections as discussed in Section 6 of

   [I-D.ietf-httpbis-bcp56bis].



Comment> Please elaborate on end-to-end protection and how to defend from attacks like MiTM modifying the HTTP headers, replay attacks etc.

Comment> Why is ietf-httpbis-bcp56bis an Informative reference ?

Comment> What are the privacy implications of using HTTP ?

Comment> Why would the TAM administrator choose HTTP instead of HTTPS ?



7) IANA section needs to be updated with "application/teep+json" content-type.



Cheers,

-Tiru



From: Konda, Tirumaleswar Reddy
Sent: Tuesday, February 11, 2020 3:32 PM
To: teep@ietf.org
Subject: Working Group Last Call for HTTP Transport for Trusted Execution Environment Provisioning: Agent-to-TAM Communication

Hi all,

This message starts a Work Group Last Call (WGLC) for HTTP Transport for Trusted Execution Environment Provisioning: Agent-to-TAM Communication.  The version to be reviewed is https://tools.ietf.org/html/draft-ietf-teep-otrp-over-http-04

The WGLC will last for 2 weeks and will end on 26th Feb 2020.

Please send your comments to the list before this date and your assessment of whether or not it is ready to proceed to publication.

Regards,
Tiru & Nancy