Subject: [Nea] PA Security Proposal

From: "Paul Sangster" <[email-masked]>
Date: Thu, 25 Oct 2007 12:50:22 -0700

The design team has been working towards submitting a -05 version of the
I-D next week.  Our hope was this version would be ready for WGLC by
early Nov (prior to IETF 70).  Several folks have commented that they
felt that the MUST requirement for PA security in PA-5 (see message
below) was too strong and should be lowered to SHOULD or MAY.  After
some comments on the alias and discussions in the design team, we would
like to propose the wording of PA-5 be changed from a MUST to a SHOULD
to help reflect the broader positions of WG members while still stating
the WG preference for PA candidate protocols providing authentication,
integrity and confidentiality protection.
 
Just a reminder that these requirements will be used by the WG when
evaluating and selecting candidate NEA protocols.  The change of PA-5
from MUST to SHOULD allows the WG some room to evaluate and potentially
select a candidate PA protocol that offers a subset or no PA security
while continuing to emphasize the WG preference for PA security
protections.  Such flexibility should be beneficial during the WG
evaluations of candidate PA protocols.  This would enable us to better
understand the impact on the PA protocol by including security
protections and allow for alternative countermeasures to be considered
(e.g. protection offered inside particular attributes).
 
In order for the design team to stay on schedule, we ask that the WG
raise any objections to this approach ASAP so we can close discussions
by 5PM PDT on Tues, Oct 30th and prepare the draft for submission the
following day.
 
Thanks,
 
Paul

________________________________

		From: Paul Sangster 
		Sent: Thursday, September 06, 2007 2:31 PM
		To: [email-masked]
		Subject: Should we downgrade PA security to a SHOULD,
MAY or remove it?

		Hopefully everyone noticed that our -04 revision was
published and is 
		awaiting comments from the WG.  As mentioned in my prior
e-mail on 8/24/07,
		we've made a significant number of changes based on
comments received 
		during WGLC.  We tried to address those comments but one
significant
		question that was not addressed relates to our
requirement PA-5 below:
		 
		 "PA-5 The PA protocol MUST provide authentication,
integrity, and 
		       confidentiality of attributes communicated
between a Posture 
		       Collector and Posture Validator. This enables
end-to-end security 
		       across a NEA deployment that might involve
traversal of several 
		       systems."
		 
		The question is should this requirement be a SHOULD,
MAY, or removed 
		entirely?  This requirement guides our selection process
for the PA
		protocol and currently would prevent candidate PA
protocols from being
		selected if they lack proper security protections.  In
the past
		we've discussed the overlapping requirements for
security upon PA (MUST),
		PB (MAY) and PT (MUST) and in Prague this factored into
our decision to
		reduce PB to a MAY (instead of a MUST).  This topic is
also discussed in 
		section 8.2 and other parts of the spec.
		 
		The current PA security protections were included to
provide for end to end 
		(e.g. Posture Collector to Posture Validator)
authentication, integrity and
		confidentiality protection of the PA attributes.  These
attributes might travel to remote 
		systems hosting the posture validator that are separate
from the posture 
		transport server thus PT protections are no longer
present.  Several folks 
		have mentioned that the protection of the link between
the posture transport 
		server and remote posture validator could be provided in
other less complex 
		ways and so requiring a standards based PA security
protocol isn't critical 
		and will just make our deliverable more difficult.  We
also would need to
		specify a solution consistent with the principals of RFC
4107 which could
		be challenging.
		 
		We would like to request that the working group discuss
whether we should 
		downgrade PA-5 to SHOULD, MAY or remove it all together.
In order
		to bound the discussion we would like to conclude the
discussion by 10PM PDT
		on thursday, Sept 20th (2 weeks).  This will allows the
editors time to make 
		any revisions to the specification and re-submit in a
timely manner so we can
		product a new I-D ready for a re-start the WGLC process.
		 
		Paul

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea

---

From: Gary Tomlinson <[email-masked]>
Date: Fri, 26 Oct 2007 13:11:20 -0700

I concur with this proposal.  It makes sense to me for the PA design team to
explore the alternatives and produce a PA protocol that strikes the proper
use case reach versus ROI balance.

Gary