IETF Logo Mail Archive

Re: [TLS] Comment on draft-thomson-tls-sic-00

John Mattsson <john.mattsson@ericsson.com> Fri, 29 March 2019 10:34 UTC

Return-Path: <john.mattsson@ericsson.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4761712036B for <tls@ietfa.amsl.com>; Fri, 29 Mar 2019 03:34:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2NWG7NdBK6AT for <tls@ietfa.amsl.com>; Fri, 29 Mar 2019 03:34:56 -0700 (PDT)
Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-vi1eur04on061d.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe0e::61d]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A115312025F for <TLS@ietf.org>; Fri, 29 Mar 2019 03:34:55 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=//1/1Jp3uIb1R22dp9+YuTulgMjNXBSWJ7WyxHkcJ2E=; b=b8496jiRJb/UrxMpePPtyU4p5+frFN0TEOarMsNhm588ACi/QfMOVjjLedWIYePrZZyl6C4iPlk+mLDQ+MAYnayZ3HSwTJEJVhusjCAtb5ytC0kglzL4BNqJPlGeWI5fzRoOh3taaRmvrI4hFRm1r1FGqzNk7VwXF0pv2j0u1NE=
Received: from VI1PR07MB4175.eurprd07.prod.outlook.com (20.176.6.24) by VI1PR07MB5005.eurprd07.prod.outlook.com (20.177.201.217) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1771.6; Fri, 29 Mar 2019 10:34:52 +0000
Received: from VI1PR07MB4175.eurprd07.prod.outlook.com ([fe80::5424:92d0:ef7:e047]) by VI1PR07MB4175.eurprd07.prod.outlook.com ([fe80::5424:92d0:ef7:e047%5]) with mapi id 15.20.1750.014; Fri, 29 Mar 2019 10:34:52 +0000
From: John Mattsson <john.mattsson@ericsson.com>
To: "TLS@ietf.org" <TLS@ietf.org>
Thread-Topic: Comment on draft-thomson-tls-sic-00
Thread-Index: AQHU5hHk9r1yI3Oidk+mAiqUq9JKM6YierSA
Date: Fri, 29 Mar 2019 10:34:51 +0000
Message-ID: <745ED9FE-9C31-4687-BD64-836155A28AEC@ericsson.com>
References: <AC987170-3F9F-4682-B49B-872B9028692F@ericsson.com>
In-Reply-To: <AC987170-3F9F-4682-B49B-872B9028692F@ericsson.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/10.17.0.190309
x-originating-ip: [2001:67c:370:128:7c96:4baf:7492:e0ae]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 5e3d9cee-004d-4363-9957-08d6b4322d40
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600127)(711020)(4605104)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:VI1PR07MB5005;
x-ms-traffictypediagnostic: VI1PR07MB5005:
x-ms-exchange-purlcount: 1
x-microsoft-antispam-prvs: <VI1PR07MB50050AA20D2D12DDB6E8938C895A0@VI1PR07MB5005.eurprd07.prod.outlook.com>
x-forefront-prvs: 0991CAB7B3
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(39860400002)(376002)(366004)(396003)(346002)(199004)(189003)(13464003)(51444003)(7736002)(106356001)(5660300002)(33656002)(6436002)(71190400001)(6512007)(2906002)(6306002)(2351001)(76176011)(6246003)(44832011)(6916009)(105586002)(2616005)(476003)(5640700003)(11346002)(99286004)(86362001)(478600001)(97736004)(53936002)(81166006)(229853002)(53546011)(25786009)(81156014)(446003)(14444005)(256004)(486006)(83716004)(71200400001)(6116002)(36756003)(305945005)(6346003)(46003)(102836004)(6506007)(186003)(82746002)(68736007)(8936002)(2501003)(316002)(14454004)(8676002)(58126008)(6486002)(966005); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR07MB5005; H:VI1PR07MB4175.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: a2X/Rivd4oLWUzJrtJlL+uAf3NOujDcpweIQubEUEEnRtakfPrAgecUyjhgdCrXvCi96RRR/OXlwluHjwvmX+zMqYvPk7e/QE/d6YToxIDS1D1nE9aLKxPJvNHMOkdoOuOzSQN1LX2RX0ovzi/aULdu9AfoLITlvgoVUbkXzK645wYOgefq9zFPyngeGTfnP2HdAyWax59EY6hu360j7tSPa98Q2FQHycQpn1lPDzaf/x6oVfbgT5jbCTGffoXOPa/SfsOkSyPtPETbftSvTuVD6N3borbMBEVJQzucskCuvKH9wcMDmNd1llvv4rSpAdyGCxiwZM//OUKxvagWPX1nsqXpooEBB9+gOhxStrzo0SVzUiKO43cMtRn40Xvey5HoWrMDqtjoHdEwm0Kb0eCo4cILwJA3FM2xhf2nMFmE=
Content-Type: text/plain; charset="utf-8"
Content-ID: <7AF95EFF98C943429C0C1460C9E32965@eurprd07.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: ericsson.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5e3d9cee-004d-4363-9957-08d6b4322d40
X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Mar 2019 10:34:51.9366 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR07MB5005
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/sASi9QI52ckGXHIrORPeFudVXQc>
Subject: Re: [TLS] Comment on draft-thomson-tls-sic-00
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 29 Mar 2019 10:34:59 -0000

Some more comments after reading the draft in detail.

- The abstract and introduction only talks about the ClientHello use case. Should shortly mention the CertificateRequest use case as well.

- I notice that the draft does not have any requirement on how the client gets access to the intermediary certificates. I think this is the right approach.

The problem discussed in EMU is that that many access points drops EAP connections after 40 - 50 packets and that EAP-TLS connections with large certificate chains may therefore be unable to complete.

One approach discussed in EMU is that the client could take intermediate certificates from an earlier EAP-TLS connection that was dropped by the access point. This drafts currently allows that. I think that is correct. I cannot see that the distribution of intermediary certificates need any security requirements as the client can verify them with the help of one of its trust anchors.

Cheers,
John

-----Original Message-----
From: John Mattsson <john.mattsson@ericsson.com>
Date: Friday, 29 March 2019 at 10:29
To: "TLS@ietf.org" <TLS@ietf.org>
Subject: Comment on draft-thomson-tls-sic-00

    Hi,
    
    I am strongly supporting of solving the problem this draft is trying to solve. This is a problem that the EMU WG has identified and discussed in the past.
    
    https://tools.ietf.org/html/draft-ms-emu-eaptlscert-02
    
    I will add text discussing draft-thomson-tls-sic-00 to draft-ms-emu-eaptlscert-03 and ask for agenda time in EMU at IETF 105 to discuss if draft-thomson-tls-sic-00 solves the problems of the EMU WG.
    
    The EMU WG actually shortly discussed this Monday if the WG thought there was any updates to TLS that needed to be driven in the TLS WG.
    
    Cheers,
    John

v2.23.0 | Report a Bug | By Email