Subject: [Nea] RE: Should we downgrade PA security to a SHOULD, MAY or remove it?

From: "Paul Sangster" <[email-masked]>
Date: Sat, 15 Sep 2007 13:29:20 -0700

Unfortunately, this thread has failed to have traction.  Since we
currently have a MUST for PA security would someone like to assert that
this MUST should be lowered and provide some rationale to start this
discussion?

________________________________

	From: Paul Sangster 
	Sent: Thursday, September 06, 2007 2:31 PM
	To: [email-masked]
	Subject: Should we downgrade PA security to a SHOULD, MAY or
remove it?

	Hopefully everyone noticed that our -04 revision was published
and is 
	awaiting comments from the WG.  As mentioned in my prior e-mail
on 8/24/07,
	we've made a significant number of changes based on comments
received 
	during WGLC.  We tried to address those comments but one
significant
	question that was not addressed relates to our requirement PA-5
below:
	 
	 "PA-5 The PA protocol MUST provide authentication, integrity,
and 
	       confidentiality of attributes communicated between a
Posture 
	       Collector and Posture Validator. This enables end-to-end
security 
	       across a NEA deployment that might involve traversal of
several 
	       systems."
	 
	The question is should this requirement be a SHOULD, MAY, or
removed 
	entirely?  This requirement guides our selection process for the
PA
	protocol and currently would prevent candidate PA protocols from
being
	selected if they lack proper security protections.  In the past
	we've discussed the overlapping requirements for security upon
PA (MUST),
	PB (MAY) and PT (MUST) and in Prague this factored into our
decision to
	reduce PB to a MAY (instead of a MUST).  This topic is also
discussed in 
	section 8.2 and other parts of the spec.
	 
	The current PA security protections were included to provide for
end to end 
	(e.g. Posture Collector to Posture Validator) authentication,
integrity and
	confidentiality protection of the PA attributes.  These
attributes might travel to remote 
	systems hosting the posture validator that are separate from the
posture 
	transport server thus PT protections are no longer present.
Several folks 
	have mentioned that the protection of the link between the
posture transport 
	server and remote posture validator could be provided in other
less complex 
	ways and so requiring a standards based PA security protocol
isn't critical 
	and will just make our deliverable more difficult.  We also
would need to
	specify a solution consistent with the principals of RFC 4107
which could
	be challenging.
	 
	We would like to request that the working group discuss whether
we should 
	downgrade PA-5 to SHOULD, MAY or remove it all together.  In
order
	to bound the discussion we would like to conclude the discussion
by 10PM PDT
	on thursday, Sept 20th (2 weeks).  This will allows the editors
time to make 
	any revisions to the specification and re-submit in a timely
manner so we can
	product a new I-D ready for a re-start the WGLC process.
	 
	Paul

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea

---

From: "Joseph Salowey \(jsalowey\)" <[email-masked]>
Date: Mon, 17 Sep 2007 16:11:31 -0700

My concern is that applying security at the PA layer has the most
management complexity.  There is a fair amount of complexity in key
management at this layer.  This will require the working group to spend
a significant amount of time and energy to define. I believe that the
security relationships are more manageable at the broker or transport
layer.  It is also not clear to me what are the practical advantages
requiring standard security mechanisms at the PA layer.

Note that if you are going to go down the path of stand alone security
for the PA layer then you need to work on the description of trust in
the requirements document, since the current document discusses trust
between a NEA client and an NEA server instead of the PA components.  

Cheers,

Joe

> -----Original Message-----
> From: Paul Sangster [mailto:[email-masked]] 
> Sent: Saturday, September 15, 2007 1:29 PM
> To: [email-masked]
> Subject: [Nea] RE: Should we downgrade PA security to a 
> SHOULD,MAY or remove it?
> 
> Unfortunately, this thread has failed to have traction.  
> Since we currently have a MUST for PA security would someone 
> like to assert that this MUST should be lowered and provide 
> some rationale to start this discussion?
> 
> 
> 	Subject: Should we downgrade PA security to a SHOULD, 
> MAY or remove it?
> 	
> 	
> 	Hopefully everyone noticed that our -04 revision was 
> published and is 
> 	awaiting comments from the WG.  As mentioned in my 
> prior e-mail on 8/24/07,
> 	we've made a significant number of changes based on 
> comments received 
> 	during WGLC.  We tried to address those comments but 
> one significant
> 	question that was not addressed relates to our 
> requirement PA-5 below:
> 	 
> 	 "PA-5 The PA protocol MUST provide authentication, 
> integrity, and 
> 	       confidentiality of attributes communicated 
> between a Posture 
> 	       Collector and Posture Validator. This enables 
> end-to-end security 
> 	       across a NEA deployment that might involve 
> traversal of several 
> 	       systems."
> 	 
> 	The question is should this requirement be a SHOULD, 
> MAY, or removed 
> 	entirely?  This requirement guides our selection 
> process for the PA
> 	protocol and currently would prevent candidate PA 
> protocols from being
> 	we've discussed the overlapping requirements for 
> security upon PA (MUST),
> 	PB (MAY) and PT (MUST) and in Prague this factored into 
> our decision to
> 	reduce PB to a MAY (instead of a MUST).  This topic is 
> also discussed in 
> 	The current PA security protections were included to 
> provide for end to end 
> 	(e.g. Posture Collector to Posture Validator) 
> authentication, integrity and
> 	systems hosting the posture validator that are separate 
> from the posture 
> 	transport server thus PT protections are no longer 
> present.  Several folks 
> 	have mentioned that the protection of the link between 
> the posture transport 
> 	server and remote posture validator could be provided 
> in other less complex 
> 	ways and so requiring a standards based PA security 
> protocol isn't critical 
> 	and will just make our deliverable more difficult.  We 
> also would need to
> 	specify a solution consistent with the principals of 
> RFC 4107 which could
> 	be challenging.
> 	 
> 	We would like to request that the working group discuss 
> whether we should 
> 	downgrade PA-5 to SHOULD, MAY or remove it all 
> together.  In order
> 	to bound the discussion we would like to conclude the 
> discussion by 10PM PDT
> 	on thursday, Sept 20th (2 weeks).  This will allows the 
> editors time to make 
> 	any revisions to the specification and re-submit in a 
> timely manner so we can