Subject: Re: [Teep] Working Group Last Call for HTTP Transport for Trusted Execution Environment Provisioning: Agent-to-TAM Communication

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Sun, 15 Mar 2020 06:04:38 +0000

Hi Dave,

Comments and nits below:

1)

   TAMs are reachable on the Internet, and Agents are on networks

   that might be behind a firewall, so that communication must be

   initiated by an Agent.  Thus, the Agent has an HTTP Client and

   the TAM has an HTTP Server.

Nit> Agents can also be behind NAT (and not reachable on the  Internet).

2)

      Agents are reachable on the Internet, and TAMs are on networks

       that might be behind a firewall, so that communication must be

       initiated by a TAM.  Thus, the Agent has an HTTP Server and the

       TAM has an HTTP Client.

Comment> What is the use case of hosting TAMs not reachable on Internet ?

Comment> If Agent is reachable on the Internet, it can be subjected to various attacks (e.g., DDoS).

3) Nit> Please add a reference to QUIC.

    Comment> Why refer to QUIC when it is not discussed in the document ?

4)    When HTTPS is used, TLS certificates MUST be checked according to [RFC2818].

Comment> RFC2818 refers to TLS 1.0 and several of its sections are outdated in comparison with TLS 1.3.

Comment> For example, when TLS 1.3 is used, is 0-RTT supported ?

Comment> RFC2818 refers to RFC2459 and is obsoleted by RFC5280.

Comment> What TLS versions should the client and server support (If TLS 1.2 needs to be supported, please add text discussing the privacy and security implications) ?

5)  HTTP is susceptible to several attacks including pervasive monitoring, any specific reason to support HTTP ?

6) If the TEEP implementation already had a cached TAM certificate that it trusts, it could skip to

     step 9 instead and generate a QueryResponse.)

Comment> I don't get the above line, none of the steps discuss caching of TAM certificate.

7)

   If any error occurs where the TEEP/HTTP Server cannot get a message

   buffer (empty or not) back from the TEEP implementation, the TEEP/

   HTTP Server generates an appropriate HTTP error response.

Comment> Any specific reason for not specifying the error code ?

8)

   Although TEEP is protected end-to-end inside of HTTP, there is still

   value in using HTTPS for transport, since HTTPS can provide

   additional protections as discussed in Section 6 of

   [I-D.ietf-httpbis-bcp56bis].

Comment> Please elaborate on end-to-end protection and how to defend from attacks like MiTM modifying the HTTP headers, replay attacks etc.

Comment> Why is ietf-httpbis-bcp56bis an Informative reference ?

Comment> What are the privacy implications of using HTTP ?

Comment> Why would the TAM administrator choose HTTP instead of HTTPS ?

7) IANA section needs to be updated with "application/teep+json" content-type.

Cheers,

-Tiru

From: Konda, Tirumaleswar Reddy
Sent: Tuesday, February 11, 2020 3:32 PM
To: [email-masked]
Subject: Working Group Last Call for HTTP Transport for Trusted Execution Environment Provisioning: Agent-to-TAM Communication

Hi all,

This message starts a Work Group Last Call (WGLC) for HTTP Transport for Trusted Execution Environment Provisioning: Agent-to-TAM Communication.  The version to be reviewed is https://tools.ietf.org/html/draft-ietf-teep-otrp-over-http-04

The WGLC will last for 2 weeks and will end on 26th Feb 2020.

Please send your comments to the list before this date and your assessment of whether or not it is ready to proceed to publication.

Regards,
Tiru & Nancy

---

From: Dave Thaler <[email-masked]>
Date: Wed, 1 Apr 2020 01:42:22 +0000

From: TEEP <[email-masked]> On Behalf Of Russ Housley
Sent: Tuesday, February 11, 2020 9:05 AM
To: [email-masked]
Subject: Re: [Teep] Working Group Last Call for HTTP Transport for Trusted Execution Environment Provisioning: Agent-to-TAM Communication

I read the document.  It looks really dood, but I have two comments:

1)     My reading is that application/teep+json is not required for the content type.  I think it should be.

It is required.  Section 4 uses a SHOULD over the exact set of headers, but section 5.2 (last paragraph) and section 6.3
are worded so that Content-Type is required.   Is the wording in those two sections sufficient or is there a specific
change you would like?

2)     Are there better examples "Foo" or "Bar" in the example.  If not, please explain them in the text.

I assume you're referring to the User-Agent strings in the example.   We don't have an actual examples from real
implementations to use yet.  I take your request as a request to explain that the User-Agent values are just examples
and would be filled in with implementation specific values.

Thanks Russ,
Dave

Russ

---

From: Dave Thaler <[email-masked]>
Date: Wed, 1 Apr 2020 02:37:52 +0000

From: TEEP <[email-masked]> On Behalf Of Konda, Tirumaleswar Reddy
Sent: Saturday, March 14, 2020 11:05 PM
To: [email-masked]
Subject: Re: [Teep] Working Group Last Call for HTTP Transport for Trusted Execution Environment Provisioning: Agent-to-TAM Communication

Hi Dave,

Comments and nits below:

1)

Updated (in forthcoming -06)

2)

       TAM has an HTTP Client.

Answered in

https://github.com/ietf-teep/otrp-over-http/issues/2

https://datatracker.ietf.org/meeting/106/materials/slides-106-teep-sessa-enarx-a-teep-use-case-00

https://datatracker.ietf.org/meeting/106/materials/slides-106-teep-sessa-teep-over-http-00 slides 7-9<https://datatracker.ietf.org/meeting/106/materials/slides-106-teep-sessa-teep-over-http-00%20slides%207-9>

and also the minutes from IETF 106 when the use cases were presented.

Conclusion, as I understand it, was that this draft is not responsible for answering your question
since it's out of scope.  The document just needs to say enough to say it's out of scope, which is the
intent of the current text.

That's an issue for anyone writing the transport for that use case to deal with :)

Added informational reference, and mention in section 1.

https://tools.ietf.org/html/draft-ietf-httpbis-bcp56bis-09#section-4.3 says:
>   o  Certificates - Applications using HTTP should specify that TLS
>      certificates are to be checked according to [RFC2818<https://tools.ietf.org/html/rfc2818>] when HTTPS

>      is used.

Which is what this doc says.   Do you think that bcp56bis is deficient in not asking app protocols to

say what TLS versions should be supported?   If so, you should provide that feedback soon (if you didn't already) since it's

listed as WG Consensus: Waiting for Write-Up

I'm hesitant to add any text here without a specific recommendation from that doc since I'd probably get it wrong.

Leaving it silent, on the other hand, means people should get the answer from bcp56bis, which is referenced in the

Security considerations section.   I don't know if that's sufficient or not, but would want advice from someone like

Mark.

For debugging purposes before putting it into production.

Also some argue that since TEEP already does its own security layer inside, the value of multiple layers of security

Is diminished, especially if you're a constrained node looking to reduce code size.   The text in the security consideration

Section is targeted at such folks explaining why they should consider HTTPS anyway.   (That may or may not convince them

but that's their call.)

Caching of certificates would be a TEEP protocol layer thing, not a transport layer thing, so you'd get the answer

from the TEEP protocol spec.  Here it's referring to the OCSP_DATA in the QueryRequest in section 4.1

of draft-ietf-teep-protocol.   The fact that the "caching" is not mentioned in that

spec is a valid issue for that spec to fix.

Updated text here to reference OCSP_DATA.

7)

Yes.  There are many possible error reasons and legal HTTP error codes for them,
so it's up to the implementation to pick an appropriate one based on HTTP specs.

https://tools.ietf.org/html/draft-ietf-httpbis-bcp56bis says:
   Instead, applications using HTTP should define their errors to use
   the most applicable status code, making generous use of the general
   status codes (200, 400 and 500) when in doubt.  Importantly, they
   should not specify a one-to-one relationship between status codes and
   application errors, thereby avoiding the exhaustion issue outlined

   above.

FYI, when MNot reviewed this spec (as author of bcp56bis) he said it looked ok.

8)

I'm going to push back on this... can you elaborate on why you think there's something specific to

this document here, beyond what's stated in the reference (plus of course the fact that TEEP is protected

end-to-end inside of HTTP)?

Fair question. I don't have a strong preference either way.

Current answer is because it's not used in any sentence in a normative way.

See Section 6.1 of bcp56bis.

For debugging purposes before putting it into production.

No, the media type is up to the protocol spec, not the transport.  It's in the TEEP Protocol's

IANA consideration section.   This is stated in section 4 of this draft where it says:

Ø     (replacing

Ø     the content type with the relevant TEEP content type per the TEEP

Ø     specification):

Dave

Cheers,

-Tiru