Subject: Re: [Netconf] netconf-tls

From: "tom.petch" <[email-masked]>
Date: Tue, 2 Sep 2008 09:59:33 +0200

----- Original Message -----
From: "David Harrington" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, August 28, 2008 4:39 PM
Subject: [Netconf] netconf-tls

> The syslog WG is finalizing their document on syslog-tls. The IESG
> review raised a number of DISCUSSES for important security issues.
>
> draft-hodges-server-ident-check-00 is an attempt to standardize how
> applications check server identities using TLS.

I am not comfortable with this I-D and do not see it as a good reference without
substantially more discussion; its focus is much narrower than the title
suggests.  Trouble is, where can that discussion be?  The TLS list has shown
itself reluctant to discuss such issues and indeed, the I-D, while TLS-centric,
does make claims to have a wider scope.  I did e-mail the AD who raised the
DISCUSS on syslog-tls citing this expired I-D asking for a wider discussion but
as yet, nothing has materialised.  So for the moment, I would not use it, but
rather go back to the many RFC already published with such sections.

Tom Petch

                                                                      I strongly
recommend
> the editors of netconf-tls pay close attention to the work being done
> for syslog-tls and the hodges draft, to ensure consistency and
> compatibility and to ease the approval path.
>
> David Harrington
> [email-masked]
> [email-masked]
> [email-masked]
>
> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf

_______________________________________________
Netconf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/netconf

---

From: "tom.petch" <[email-masked]>
Date: Tue, 2 Sep 2008 09:59:33 +0200

----- Original Message -----
From: "David Harrington" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, August 28, 2008 4:39 PM
Subject: [Netconf] netconf-tls

Tom Petch

                                                                      I strongly
recommend

---

From: "Bert Wijnen \(IETF\)" <[email-masked]>
Date: Tue, 2 Sep 2008 15:36:51 +0200

Tom, just to be sure I understand your response correctly.

You are saying that we should NOT take the draft-hodges-server-ident-check
document as a good source of things to consider, right?

Bert
----- Original Message ----- 
From: "tom.petch" <[email-masked]>
To: "David Harrington" <[email-masked]>; <[email-masked]>
Sent: Tuesday, September 02, 2008 9:59 AM
Subject: Re: [Netconf] netconf-tls

>                                                                      I
> strongly

---

From: "Bert Wijnen \(IETF\)" <[email-masked]>
Date: Tue, 2 Sep 2008 15:36:51 +0200

Bert

---

From: "David B Harrington" <[email-masked]>
Date: Tue, 2 Sep 2008 11:57:06 -0400

Hi,

An AD raised a DISCUSS during the IESG approval process and pointed to
the hodges draft. As Tom points out, the draft is expired.

My primary concern is that we do not develop multiple <NM
protocol>/TLS solutions, all with different rules for matching the
identities used in certificates, and with different required
cipher-suites, etc. We should be trying to make it easier for
operators to manage the security for NM protocols, not harder.

Syslog WG has a TLS-transport draft currently under consideration by
the IESG, and the IESG has raised a number of "late surprises" related
to that draft. A (D)TLS transport draft has been published and brought
into some discussion in the ISMS WG. CAPWAP uses DTLS. IPFIX supports
a TLS transport, IIRC. 

I think the worse thing we could do is ignore what has gone before and
develop a netconf-silo with its own TLS solution that is inconsistent
with other IETF NM protocol transports. 

I recommend the author of the netconf/tls draft review the discussions
in the syslog WG to see whether the discussions are relevant to
netconf or not, and to determine whether the compliance requirements
for netconf/tls are consistent with other <NM protocol>/tls proposals
- especially the ones already approved by, or in the process of
approval by, the IESG.

I don't care whether the hodges draft is used as the basis for the
evaluation, but will warn that at least one AD seems to be using that
draft as their basis for evaluation.

dbh

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Bert Wijnen (IETF)
> Sent: Tuesday, September 02, 2008 9:37 AM
> To: tom.petch; Netconf
> > I am not comfortable with this I-D and do not see it as a 
> good reference
> > without
> > suggests.  Trouble is, where can that discussion be?  The 
> TLS list has
> > shown
> > does make claims to have a wider scope.  I did e-mail the 
> AD who raised
> > the
> > as yet, nothing has materialised.  So for the moment, I 
> would not use it,
> > but

---

From: "David B Harrington" <[email-masked]>
Date: Tue, 2 Sep 2008 11:57:06 -0400

Hi,

dbh

---

From: "tom.petch" <[email-masked]>
Date: Tue, 2 Sep 2008 18:16:06 +0200

----- Original Message -----
From: "Bert Wijnen (IETF)" <[email-masked]>
To: "tom.petch" <[email-masked]>; "Netconf" <[email-masked]>
Sent: Tuesday, September 02, 2008 3:36 PM
Subject: Re: [Netconf] netconf-tls

> document as a good source of things to consider, right?

Sorry, I was being too coy.

Yes, I think that more discussion of this I-D is needed before it will serve as
a reference for authors of '... over TLS..' I-Ds.

It claims to be about verifying server identity in PKI (why not clients, what
about certificates without PKI?) and yet its scope is narrower, largely being
about string comparison.  In syslog-tls, the discussions have ranged wider
(fingerprints, formats of locally configured names, what to do with multiple
names in the certificate, roots of chains, ...) and my sense is that much of
this has come from above, ie is seen as a requirement of the IETF for a TLS
specification (in the third quarter of 2008).

The I-D is lifted from RFC4513 and may be adequate for that context but not IMO
for the IETF at large.

Tom Petch

---

From: "tom.petch" <[email-masked]>
Date: Tue, 2 Sep 2008 18:16:06 +0200

----- Original Message -----
From: "Bert Wijnen (IETF)" <[email-masked]>
To: "tom.petch" <[email-masked]>; "Netconf" <[email-masked]>
Sent: Tuesday, September 02, 2008 3:36 PM
Subject: Re: [Netconf] netconf-tls

Tom Petch