Subject: [tram] WGLC draft-ietf-tram-stunbis-12

From: Simon Perreault <[email-masked]>
Date: Mon, 1 May 2017 08:21:02 -0400

TRAMsters,

This email initiates a two-week working-group last call on this draft:

https://datatracker.ietf.org/doc/draft-ietf-tram-stunbis/

Please read it now. Substantial comments should be addressed to the
group. Nits should be sent directly to the authors.

Thanks,
Simon & Gonzalo

---

From: Brandon Williams <[email-masked]>
Date: Sun, 14 May 2017 17:40:45 -0400

FWIW ... I reviewed the changes in the latest draft. They appear to 
cover what we discussed in Chicago. I agree with the authors that the 
outstanding issues have been addressed.

--Brandon

On 05/01/2017 08:21 AM, Simon Perreault wrote:
> _______________________________________________
> tram mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tram
>

---

From: Simon Perreault <[email-masked]>
Date: Mon, 15 May 2017 08:57:10 -0400

> outstanding issues have been addressed.

Thanks!

-- 
Simon Perreault
Director of Engineering, Platform | Jive Communications, Inc.
https://jive.com | +1 418 478 0989 ext. 1241 | [email-masked]

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Wed, 17 May 2017 11:06:34 +0000

I think https://tools.ietf.org/html/draft-ietf-tram-stunbis-12#section-9.2.1 needs more discussion, a man-in-the-middle attacker can also change the "nonce cookie" forcing the client to pick a weaker password algorithm. (D)TLS is required to prevent the MITM attack (just like (D)TLS is required to prevent the downgrade attack to MESSAGE-INTEGRITY). 

-Tiru

-----Original Message-----
From: tram [mailto:[email-masked]] On Behalf Of Brandon Williams
Sent: Monday, May 15, 2017 3:11 AM
To: [email-masked]
Subject: Re: [tram] WGLC draft-ietf-tram-stunbis-12

FWIW ... I reviewed the changes in the latest draft. They appear to cover what we discussed in Chicago. I agree with the authors that the outstanding issues have been addressed.

--Brandon

---

From: Brandon Williams <[email-masked]>
Date: Wed, 17 May 2017 11:31:33 -0400

Wouldn't changing the nonce cookie invalidate the nonce? causing the 
server to reject signed messages that include the now bad nonce? 
Security on the one message would be dropped to a lower level, but not 
for the channel as a whole, right?

Agreed that we should mention the issue and (D)TLS. Just don't want to 
over-state.

--Brandon

-- 
Brandon Williams; Chief Architect
Cloud Networking; Akamai Technologies Inc.

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Thu, 18 May 2017 01:31:46 +0000

> From: Brandon Williams [mailto:[email-masked]]
> Sent: Wednesday, May 17, 2017 9:02 PM
> To: Konda, Tirumaleswar Reddy <[email-masked]>;
> [email-masked]
> Wouldn't changing the nonce cookie invalidate the nonce? causing the server
> to reject signed messages that include the now bad nonce?

Yes, server will reject the nonce cookie.

> Security on the one message would be dropped to a lower level, but not for
> the channel as a whole, right?

Yup.

> 
> Agreed that we should mention the issue and (D)TLS. Just don't want to over-
> state.

Works for me.

Cheers,
-Tiru

> > I think https://tools.ietf.org/html/draft-ietf-tram-stunbis-12#section-9.2.1
> needs more discussion, a man-in-the-middle attacker can also change the
> "nonce cookie" forcing the client to pick a weaker password algorithm. (D)TLS
> is required to prevent the MITM attack (just like (D)TLS is required to prevent
> the downgrade attack to MESSAGE-INTEGRITY).
> >
> > -Tiru
> >
> > FWIW ... I reviewed the changes in the latest draft. They appear to cover
> what we discussed in Chicago. I agree with the authors that the outstanding
> issues have been addressed.
> >
> > --Brandon
> >