Subject: [Nea] Comments on nea-pt-eap-00 draft

From: Nancy Cam-Winget <[email-masked]>
Date: Tue, 08 Nov 2011 14:18:01 -0700

Hi,

Here is an initial set of comments against the first version of the PT-EAP
draft:

> €    PT-EAP defines the standalone method for carrying NEA data and specifies
> its bounds and usage to an EAP tunnel method.  As such, I recommend that the
> draft stick to naming this method PT-EAP (vs. The use of both PT-EAP and
> PT-TNC)
> 
> €    Update the abstract to:
> This document specifies PT-EAP, an EAP based Posture Transport (PT) protocol
> designed to be used only inside an EAP tunnel method.  As such, the document
> also describes the intended applicability of PT-EAP as well as the evaluation
> against the requirements defined in the NEA Requirements and PB-TNC
> specifications. 
> 
> €    Introduction update the first sentence to:
> This document specifies PT-EAP, and EAP based Posture Transport (PT) protocol
> protected by a TLS based tunnel established by an EAP tunnel method.
> 
> €    2nd paragraph of Introduction should be updated to:
> The PT protocol in the NEA architecture is responsible for transporting PB-TNC
> batches (often containing PA-TNC [3] attributes) across the network between
> the NEA Client and NEA Server.  The PT protocol must be protected by an outer
> TLS-based tunnel to ensure the exchanged messages are protected from a variety
> of threats from hostile intermediaries.
> 
> €    To be consistent with a single reference of the inner method,  my
> suggestion is to remove the 5th and 6th paragraph and replace the entire 4th
> paragraph with:
> 
> PT-EAP is an inner EAP method designed to be used under a protected tunnel
> such as EAP-FAST and EAP-TTLS.
> 
> €    Given proposal to just focus on inner method, replace all instances of
> PT-TNC with PT-EAP
> 
> €    Section 1.1 remove TNC reference (e.g. the last sentence of the
> paragraph)
> 
> €    Section 3.1: 4th paragraph, 2nd sentence seems to be a non sequitur,
> suggest to remove it (e.g. the sentence reading:
> ²Some EAP tunnel methods may provide explicit confirmation of inner method
> success; others may not.  This is out of scope for the EAP-TNC method.²)
> 
> €    Section 3.4: as NEA has changed the behavior of the method, it merits its
> own type and thus should be a TBD.
> 
> €    Section 4: language to enforce use on within protected tunnel should be
> used, suggest wording to: ³is designed and MUST run inside an EAP tunnel
> method²

Thanks, Nancy

---

From: Stephen Hanna <[email-masked]>
Date: Mon, 14 Nov 2011 05:27:11 -0500

Thanks for your comments, Nancy. Personally (WG chair hat off), I find them quite reasonable.  However, I do have a few responses:

1)      I would like to see the document not require that this protocol be carried over an outer TLS-based tunnel. I think we should say "an outer TLS-based tunnel or equivalent protections". There could be times when the outer tunnel is based on IPsec, for example.

2)      There's only one instance of PT-TNC in the document. I think you mean EAP-TNC where you say PT-TNC.

3)      The WG should decide where and how to refer to TCG and TNC. I think it's valuable to mention that this protocol will be equivalent to the next version of the corresponding TCG spec: IF-T for Tunneled EAP Methods.

What do others think?

Thanks,

Steve

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Nancy Cam-Winget
Sent: Tuesday, November 08, 2011 4:18 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [Nea] Comments on nea-pt-eap-00 draft

Hi,

Here is an initial set of comments against the first version of the PT-EAP draft:
*    PT-EAP defines the standalone method for carrying NEA data and specifies its bounds and usage to an EAP tunnel method.  As such, I recommend that the draft stick to naming this method PT-EAP (vs. The use of both PT-EAP and PT-TNC)

*    Update the abstract to:
This document specifies PT-EAP, an EAP based Posture Transport (PT) protocol designed to be used only inside an EAP tunnel method.  As such, the document also describes the intended applicability of PT-EAP as well as the evaluation against the requirements defined in the NEA Requirements and PB-TNC specifications.

*    Introduction update the first sentence to:
This document specifies PT-EAP, and EAP based Posture Transport (PT) protocol protected by a TLS based tunnel established by an EAP tunnel method.

*    2nd paragraph of Introduction should be updated to:
The PT protocol in the NEA architecture is responsible for transporting PB-TNC batches (often containing PA-TNC [3] attributes) across the network between the NEA Client and NEA Server.  The PT protocol must be protected by an outer TLS-based tunnel to ensure the exchanged messages are protected from a variety of threats from hostile intermediaries.

*    To be consistent with a single reference of the inner method,  my suggestion is to remove the 5th and 6th paragraph and replace the entire 4th paragraph with:

PT-EAP is an inner EAP method designed to be used under a protected tunnel such as EAP-FAST and EAP-TTLS.

*    Given proposal to just focus on inner method, replace all instances of PT-TNC with PT-EAP

*    Section 1.1 remove TNC reference (e.g. the last sentence of the paragraph)

*    Section 3.1: 4th paragraph, 2nd sentence seems to be a non sequitur, suggest to remove it (e.g. the sentence reading:
"Some EAP tunnel methods may provide explicit confirmation of inner method success; others may not.  This is out of scope for the EAP-TNC method.")

*    Section 3.4: as NEA has changed the behavior of the method, it merits its own type and thus should be a TBD.

*    Section 4: language to enforce use on within protected tunnel should be used, suggest wording to: "is designed and MUST run inside an EAP tunnel method"

Thanks, Nancy

---

From: Ira McDonald <[email-masked]>
Date: Mon, 14 Nov 2011 08:31:08 -0500

Hi

I agree with Nancy's and Steve's comments.  I do think it's important
to highlight that this document is/will be equivalent to the next version
of TCG IF-T for Tunneled EAP Methods.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG IPP WG
Co-Chair - TCG Trusted Mobility Solutions WG
Chair - TCG Embedded Systems Hardcopy SG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music/High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto:[email-masked]
Winter  579 Park Place  Saline, MI  48176  734-944-0094
Summer  PO Box 221  Grand Marais, MI 49839  906-494-2434

On Mon, Nov 14, 2011 at 5:27 AM, Stephen Hanna <[email-masked]> wrote:

> Thanks for your comments, Nancy. Personally (WG chair hat off), I find
> them quite reasonable.  However, I do have a few responses:****
>
> ** **
>
> **1)      **I would like to see the document not require that this
> protocol be carried over an outer TLS-based tunnel. I think we should say
> "an outer TLS-based tunnel or equivalent protections". There could be times
> when the outer tunnel is based on IPsec, for example.****
>
> **2)      **There's only one instance of PT-TNC in the document. I think
> you mean EAP-TNC where you say PT-TNC.****
>
> **3)      **The WG should decide where and how to refer to TCG and TNC. I
> think it's valuable to mention that this protocol will be equivalent to the
> next version of the corresponding TCG spec: IF-T for Tunneled EAP Methods.
> ****
>
> ** **
>
> What do others think?****
>
> ** **
>
> Thanks,****
>
> ** **
>
> Steve****
>
> ** **
>
> *From:* [email-masked] [mailto:[email-masked]<[email-masked]>]
> *On Behalf Of *Nancy Cam-Winget
> *Sent:* Tuesday, November 08, 2011 4:18 PM
> *To:* [email-masked]
> *Subject:* [Nea] Comments on nea-pt-eap-00 draft****
>
> ** **
>
> Hi,
>
> draft:****
>      PT-EAP defines the standalone method for carrying NEA data and
> specifies its bounds and usage to an EAP tunnel method.  As such, I
> recommend that the draft stick to naming this method PT-EAP (vs. The use of
> both PT-EAP and PT-TNC)
>
> *This document specifies PT-EAP, an EAP based Posture Transport (PT)
> protocol designed to be used only inside an EAP tunnel method.  As such,
> the document also describes the intended applicability of PT-EAP as well as
> the evaluation against the requirements defined in the NEA Requirements and
> PB-TNC specifications.
>
> **    Introduction update the first sentence to:
> *This document specifies PT-EAP, and EAP based Posture Transport (PT)
> protocol protected by a TLS based tunnel established by an EAP tunnel
> method.
>
> **    2nd paragraph of Introduction should be updated to:
> *The PT protocol in the NEA architecture is responsible for transporting
> PB-TNC batches (often containing PA-TNC [3] attributes) across the network
> between the NEA Client and NEA Server.  The PT protocol must be protected
> by an outer TLS-based tunnel to ensure the exchanged messages are protected
> from a variety of threats from hostile intermediaries.
>
> **    To be consistent with a single reference of the inner method,  my
> suggestion is to remove the 5th and 6th paragraph and replace the entire
> 4th paragraph with:
>
> *PT-EAP is an inner EAP method designed to be used under a protected
> tunnel such as EAP-FAST and EAP-TTLS.
>
> **    Given proposal to just focus on inner method, replace all instances
> of PT-TNC with PT-EAP
>
> *    *Section 1.1 remove TNC reference (e.g. the last sentence of the
> paragraph)
>
> **    Section 3.1: 4th paragraph, 2nd sentence seems to be a non
> sequitur, suggest to remove it (e.g. the sentence reading:
> *"Some EAP tunnel methods may provide explicit confirmation of inner
> method success; others may not.  This is out of scope for the EAP-TNC
> method.")
>
> **    *Section 3.4: as NEA has changed the behavior of the method, it
> merits its own type and thus should be a TBD.
>
> **    Section 4: language to enforce use on within protected tunnel
> should be used, suggest wording to: "is designed and MUST run inside an EAP
> tunnel method"****
>
>
> Thanks, Nancy****
>
> ** **
>
> _______________________________________________
> Nea mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nea
>
>