Subject: Re: Last Call: <draft-ietf-nea-pt-eap-06.txt> (PT-EAP: Posture Transport (PT) Protocol For EAP Tunnel Methods) to Proposed Standard

From: SM <[email-masked]>
Date: Tue, 08 Jan 2013 23:25:24 -0800

At 06:43 02-01-2013, The IESG wrote:
>The IESG has received a request from the Network Endpoint Assessment WG
>(nea) to consider the following document:
>- 'PT-EAP: Posture Transport (PT) Protocol For EAP Tunnel Methods'
>   <draft-ietf-nea-pt-eap-06.txt> as Proposed Standard
>
>The IESG plans to make a decision in the next few weeks, and solicits
>final comments on this action. Please send substantive comments to the
>[email-masked] mailing lists by 2013-01-16. Exceptionally, comments may be

This is a quick comment.

In Section 1:

   "The PT-EAP protocol MUST be protected by an outer
    TLS-based EAP tunnel method to ensure the exchanged messages are
    protected from a variety of threats from hostile intermediaries."

The RFC 2119 boilerplate is after that "MUST".

In Section 1.1:

   "This document does not define an architecture or reference model.
    Instead, it defines a protocol that works within the reference model
    described in the NEA Requirements specification [RFC5209]."

The reference is informative.

In Section 6:

   "PT-EAP does not directly utilize or require direct knowledge of
    any personally identifiable information (PII).  PT-EAP will
    typically be used in conjunction with other EAP methods
    that provide for the user authentication (if bi-directional
    authentication is used), so the user's credentials are not
    directly seen by the PT-EAP inner method."

Section 9 RFC 5209 mentions that:

   "However, in situations where the endpoint is owned by the user
    or where local laws protect the rights of the user even when
    using endpoints owned by another party, it is critical that the NEA
    implementation enable the user to control what endpoint information
    is shared with the network."

I didn't find any information in the draft to assess the privacy 
implications.  Are there any such implications?

Regards,
-sm

---

From: "Nancy Cam-Winget (ncamwing)" <[email-masked]>
Date: Mon, 14 Jan 2013 20:29:51 +0000

Hi SM,

Thanks for the thorough review of the draft.  Please see comments below:

>The RFC 2119 boilerplate is after that "MUST".
[NCW] I can change it to a lower case "must", ok?

>The reference is informative.
[NCW] We can move the reference to be normative.

>implications.  Are there any such implications?
[NCW] I don't think there are specifically for PT-EAP.  The sections you
reference
Were to (in section 6) addressing the general EAP identity as PT-EAP is
really not
An "authentication" method.

---

From: SM <[email-masked]>
Date: Mon, 14 Jan 2013 13:34:09 -0800

Hi Nancy,
>[NCW] I can change it to a lower case "must", ok?

That's ok.

>[NCW] We can move the reference to be normative.

Ok.

>An "authentication" method.

If I understood the above correctly PT-EAP does not transport any 
information which could be used to identify an individual.  That's 
different from PT-EAP not being an "authenticated" method. Therefore, 
there isn't much to say in terms of privacy considerations.

I suggest not including the following then:

   "As a transport protocol, PT-EAP does not directly utilize or
    require direct knowledge of any personally identifiable
    information (PII)."

The draft can leverage the second paragraph of Section 6 as "privacy 
considerations" instead of making a statement about PII.  I'll copy 
this message to ietf-privacy@ to get a better opinion.

In Section 6:

   "Therefore, it is important for deployers to leverage these
    protections in order to prevent disclosure of PII potentially
    contained within PA-TNC or PB-TNC within the PT-EAP payload."

I suggest "information about an individual" instead of PII [1].

Regards,
-sm

1. I used the wording from draft-iab-privacy-considerations-06

---

From: Stephen Hanna <[email-masked]>
Date: Mon, 14 Jan 2013 22:17:57 +0000

Changing our reference to RFC 5209 to be normative may cause
more problems than it solves. As RFC 3967 (BCP 97) says,

> IETF procedures generally require that a standards track RFC
> may not have a normative reference to another standards track
> document at a lower maturity level or to a non standards track
> specification (other than specifications from other standards
> bodies). For example, a standards track document may not have
> a normative reference to an informational RFC.

Generally, documents that contain use cases or architectures are
Informational. References to such documents in a standards track
document are informative because referring to the use cases is
not required in order to implement the standard.

RFC 5209 lists use cases for NEA, describes a reference model
for NEA, and includes requirements that the NEA protocols must
meet. None of the requirements in RFC 5209 are requirements on
implementations of the NEA protocols. Therefore, the PT-EAP spec
should not include a normative reference to RFC 5209. And that's
good, because RFC 5209 is an Informational RFC.

If I've missed something (e.g. a reason why the reference should
be normative), please explain it more clearly.

Thanks,

Steve

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> SM
> Sent: Monday, January 14, 2013 4:34 PM
> To: Nancy Cam-Winget (ncamwing)
> Cc: [email-masked]; [email-masked]; [email-masked]
> Subject: Re: Last Call: <draft-ietf-nea-pt-eap-06.txt> (PT-EAP: Posture
> Transport (PT) Protocol For EAP Tunnel Methods) to Proposed Standard
> 
> Hi Nancy,