Re: [Teep] Working Group Last Call for HTTP Transport for Trusted Execution Environment Provisioning: Agent-to-TAM Communication

[Dave Thaler <[e-mail]>]

From: TEEP <[e-mail]> On Behalf Of Konda, Tirumaleswar Reddy
Sent: Saturday, March 14, 2020 11:05 PM
To: [e-mail]
Subject: Re: [Teep] Working Group Last Call for HTTP Transport for Trusted Execution Environment Provisioning: Agent-to-TAM Communication


Hi Dave,



Comments and nits below:



1)

   TAMs are reachable on the Internet, and Agents are on networks

   that might be behind a firewall, so that communication must be

   initiated by an Agent.  Thus, the Agent has an HTTP Client and

   the TAM has an HTTP Server.



Nit> Agents can also be behind NAT (and not reachable on the  Internet).



Updated (in forthcoming -06)



2)

      Agents are reachable on the Internet, and TAMs are on networks

       that might be behind a firewall, so that communication must be

       initiated by a TAM.  Thus, the Agent has an HTTP Server and the

       TAM has an HTTP Client.



Comment> What is the use case of hosting TAMs not reachable on Internet ?



Answered in

https://github.com/ietf-teep/otrp-over-http/issues/2

https://datatracker.ietf.org/meeting/106/materials/slides-106-teep-sessa-enarx-a-teep-use-case-00

https://datatracker.ietf.org/meeting/106/materials/slides-106-teep-sessa-teep-over-http-00 slides 7-9<https://datatracker.ietf.org/meeting/106/materials/slides-106-teep-sessa-teep-over-http-00%20slides%207-9>

and also the minutes from IETF 106 when the use cases were presented.



Conclusion, as I understand it, was that this draft is not responsible for answering your question
since it's out of scope.  The document just needs to say enough to say it's out of scope, which is the
intent of the current text.



Comment> If Agent is reachable on the Internet, it can be subjected to various attacks (e.g., DDoS).



That's an issue for anyone writing the transport for that use case to deal with :)



3) Nit> Please add a reference to QUIC.

    Comment> Why refer to QUIC when it is not discussed in the document ?



Added informational reference, and mention in section 1.



4)    When HTTPS is used, TLS certificates MUST be checked according to [RFC2818].



Comment> RFC2818 refers to TLS 1.0 and several of its sections are outdated in comparison with TLS 1.3.

Comment> For example, when TLS 1.3 is used, is 0-RTT supported ?

Comment> RFC2818 refers to RFC2459 and is obsoleted by RFC5280.

Comment> What TLS versions should the client and server support (If TLS 1.2 needs to be supported, please add text discussing the privacy and security implications) ?



https://tools.ietf.org/html/draft-ietf-httpbis-bcp56bis-09#section-4.3 says:
>   o  Certificates - Applications using HTTP should specify that TLS
>      certificates are to be checked according to [RFC2818<https://tools.ietf.org/html/rfc2818>] when HTTPS

>      is used.



Which is what this doc says.   Do you think that bcp56bis is deficient in not asking app protocols to

say what TLS versions should be supported?   If so, you should provide that feedback soon (if you didn't already) since it's

listed as WG Consensus: Waiting for Write-Up



I'm hesitant to add any text here without a specific recommendation from that doc since I'd probably get it wrong.

Leaving it silent, on the other hand, means people should get the answer from bcp56bis, which is referenced in the

Security considerations section.   I don't know if that's sufficient or not, but would want advice from someone like

Mark.



5)  HTTP is susceptible to several attacks including pervasive monitoring, any specific reason to support HTTP ?



For debugging purposes before putting it into production.



Also some argue that since TEEP already does its own security layer inside, the value of multiple layers of security

Is diminished, especially if you're a constrained node looking to reduce code size.   The text in the security consideration

Section is targeted at such folks explaining why they should consider HTTPS anyway.   (That may or may not convince them

but that's their call.)



6) If the TEEP implementation already had a cached TAM certificate that it trusts, it could skip to

     step 9 instead and generate a QueryResponse.)



Comment> I don't get the above line, none of the steps discuss caching of TAM certificate.



Caching of certificates would be a TEEP protocol layer thing, not a transport layer thing, so you'd get the answer

from the TEEP protocol spec.  Here it's referring to the OCSP_DATA in the QueryRequest in section 4.1

of draft-ietf-teep-protocol.   The fact that the "caching" is not mentioned in that

spec is a valid issue for that spec to fix.



Updated text here to reference OCSP_DATA.



7)

   If any error occurs where the TEEP/HTTP Server cannot get a message

   buffer (empty or not) back from the TEEP implementation, the TEEP/

   HTTP Server generates an appropriate HTTP error response.



Comment> Any specific reason for not specifying the error code ?



Yes.  There are many possible error reasons and legal HTTP error codes for them,
so it's up to the implementation to pick an appropriate one based on HTTP specs.



https://tools.ietf.org/html/draft-ietf-httpbis-bcp56bis says:
   Instead, applications using HTTP should define their errors to use
   the most applicable status code, making generous use of the general
   status codes (200, 400 and 500) when in doubt.  Importantly, they
   should not specify a one-to-one relationship between status codes and
   application errors, thereby avoiding the exhaustion issue outlined

   above.



FYI, when MNot reviewed this spec (as author of bcp56bis) he said it looked ok.



8)

   Although TEEP is protected end-to-end inside of HTTP, there is still

   value in using HTTPS for transport, since HTTPS can provide

   additional protections as discussed in Section 6 of

   [I-D.ietf-httpbis-bcp56bis].



Comment> Please elaborate on end-to-end protection and how to defend from attacks like MiTM modifying the HTTP headers, replay attacks etc.



I'm going to push back on this... can you elaborate on why you think there's something specific to

this document here, beyond what's stated in the reference (plus of course the fact that TEEP is protected

end-to-end inside of HTTP)?



Comment> Why is ietf-httpbis-bcp56bis an Informative reference ?



Fair question. I don't have a strong preference either way.

Current answer is because it's not used in any sentence in a normative way.



Comment> What are the privacy implications of using HTTP ?



See Section 6.1 of bcp56bis.



Comment> Why would the TAM administrator choose HTTP instead of HTTPS ?



For debugging purposes before putting it into production.



7) IANA section needs to be updated with "application/teep+json" content-type.



No, the media type is up to the protocol spec, not the transport.  It's in the TEEP Protocol's

IANA consideration section.   This is stated in section 4 of this draft where it says:

Ø     (replacing

Ø     the content type with the relevant TEEP content type per the TEEP

Ø     specification):



Dave



Cheers,

-Tiru