Subject: [Unbearable] question wrt draft-mandyam-tokbind-attest

From: =JeffH <[email-masked]>
Date: Mon, 14 Nov 2016 14:51:25 +0900

I have a question wrt 
https://tools.ietf.org/html/draft-mandyam-tokbind-attest-00 :

why did you design this with the attestation information conveyed in a 
new TLS extension, rather than convey it as a TokenBinding.extension..

<https://tools.ietf.org/html/draft-ietf-tokbind-protocol-10#section-3.4>

..?  Is it due to the use case of "Platform Attestation for Anomaly 
Detection" in section 5 ?

thanks,

=JeffH

---

From: "Mandyam, Giridhar" <[email-masked]>
Date: Mon, 14 Nov 2016 15:12:37 +0000

Hello Jeff,
Thanks for taking the time to review the document.

> why did you design this with the attestation information conveyed in a new TLS extension, rather than convey it as a TokenBinding.extension.

We constructed this proposal in such a way as to not interfere with ongoing tokbind interop testing, which is why we defined a completely new TLS extension.  Moreover, when we came up with this proposal a few months back were using a version of the tokbind protocol spec that is out-of-date now (the references point to version -08 of the document, but the version that introduced the current description of tokbind.extensions is -09.  

But we are certainly open to your suggestion, and can modify the proposal as such.  That could certainly be a cleaner way to do things, in my opinion.

>..?  Is it due to the use case of "Platform Attestation for Anomaly Detection" in section 5 ?

Section 5 is just an example of when an attestation in the TLS handshake could be useful.  It did not drive our decisions on defining a new extension.

-Giri Mandyam

-----Original Message-----
From: Unbearable [mailto:[email-masked]] On Behalf Of =JeffH
Sent: Sunday, November 13, 2016 9:51 PM
To: IETF TokBind WG <[email-masked]>
Subject: [Unbearable] question wrt draft-mandyam-tokbind-attest

I have a question wrt

why did you design this with the attestation information conveyed in a new TLS extension, rather than convey it as a TokenBinding.extension..

..?  Is it due to the use case of "Platform Attestation for Anomaly Detection" in section 5 ?

thanks,

=JeffH

_______________________________________________
Unbearable mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/unbearable