Subject: [NSIS] MA re-use mechanism in case of TCP

From: Christian Dickmann <[email-masked]>
Date: Sat, 10 Mar 2007 18:22:05 -0500

Hi Robert,

I am not 100% sure if I already asked this question (I know I intended 
to do so once, but I can't find any mail I sent about the issue).
Section 5.7.1 says about MA re-use:
"If multiplexing does occur,
   which is indicated by sending the Response over an existing messaging
   association, the following rules apply:

   o  The re-used messaging association MUST NOT have weaker security
      properties than would have been offered in the full Response that
      would have been sent without re-use."

And it also states: " For such a Response,
   the security protocols listed in the Stack-Proposal MUST NOT depend
   on the Query."

As a standard GIST nodes should at least support TCP and TLS over TCP, 
the majority of all Responses will offer both. Using the rule I quoted 
first means, that the Responder is not allowed to decide to re-use a 
TCP-only MA, because it is always weaker than the TLS over TCP profile. 
If that is correct, I think it should be stated somewhere, because the 
other text in the draft suggests (at least thats what I read) that a 
re-use of a TCP connection would use the standard procedure (send the 
Response over the MA).
So am I reading these rules correctly? Is this the intended protocol 
behavior? Do you agree that the TCP case should be stated more 
explicitly to avoid misunderstanding?

Best Regards,
Christian Dickmann

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: "Hancock, Robert" <[email-masked]>
Date: Mon, 12 Mar 2007 14:13:39 -0000

hi, 

> -----Original Message-----
> From: Christian Dickmann [mailto:[email-masked]] 
> Sent: 10 March 2007 23:22
> To: [email-masked]
> Subject: [NSIS] MA re-use mechanism in case of TCP
> 
> Hi Robert,
> 
> I am not 100% sure if I already asked this question (I know I 
> intended to do so once, but I can't find any mail I sent 
> about the issue).

ok so far (but read on...)

> As a standard GIST nodes should at least support TCP and TLS 
> over TCP, the majority of all Responses will offer both. 
> Using the rule I quoted first means, that the Responder is 
> not allowed to decide to re-use a TCP-only MA, because it is 
> always weaker than the TLS over TCP profile. 

the rule could be read that way, but that is not the intention.
after all, if the node was prepared to offer TCP and TLS/TCP in
the original response, it is presumably happy to use TCP (and
so re-use would be possible).

the actual problem is the ambiguity: the first rule could mean
"weaker security properties than *all of the options that* 
would have been offered in the full Response"
or
"weaker security properties than *any of the options that* 
would have been offered in the full Response"

and I think the valid approach is the first.

what we are really trying to rule out is a case such as:
- node has MA using only TCP (e.g. for NSLP foo)
- node gets Query for NSLP bar, which absolutely requires TLS/TCP
  e.g. for message privacy
- node would send a response listing *only* TLS/TCP for the MA
- but re-uses the TCP one instead.

so i suspect that this needs to be clarified.

r.

> If that is correct, I think it should be stated somewhere, 
> because the other text in the draft suggests (at least thats 
> what I read) that a re-use of a TCP connection would use the 
> standard procedure (send the Response over the MA).
> So am I reading these rules correctly? Is this the intended 
> protocol behavior? Do you agree that the TCP case should be 
> stated more explicitly to avoid misunderstanding?
> 
> Best Regards,
> Christian Dickmann
> 
>

---

From: Christian Dickmann <[email-masked]>
Date: Mon, 12 Mar 2007 10:49:37 -0400

Hi Robert,

see inline.

> so i suspect that this needs to be clarified.

OK, makes sense. And I agree, that this needs to be clarified in the text.

Christian

---

From: "Hancock, Robert" <[email-masked]>
Date: Mon, 12 Mar 2007 16:12:18 -0000

ok

opened issue
http://nsis.srmr.co.uk/cgi-bin/roundup.cgi/nsis-ntlp-issues/issue211

r. 

> Sent: 12 March 2007 14:50
> To: Hancock, Robert
> Cc: [email-masked]
> Subject: Re: [NSIS] MA re-use mechanism in case of TCP
> 
> Hi Robert,
> 
> see inline.
> 
> >> As a standard GIST nodes should at least support TCP and TLS over 
> >> TCP, the majority of all Responses will offer both.
> >> Using the rule I quoted first means, that the Responder is not 
> >> allowed to decide to re-use a TCP-only MA, because it is always 
> >> weaker than the TLS over TCP profile.
> >>     
> >