Subject: RE: [Nea] WG Review: Network Endpoint Assessment (nea)

From: Lakshminath Dondeti <[email-masked]>
Date: Tue, 17 Oct 2006 00:28:33 -0700

At 12:00 AM 10/17/2006, Khosravi, Hormuzd M wrote:
>Sam,
>
>I believe if we move 'quickly' in this WG we will be able to meet
>interoperability goals to certain extent atleast. The bottom-line is
>this technology is already being deployed by different vendors in
>academia and enterprises. The question is should IETF get involved in
>standardizing this or leave it to the individual vendors. I believe the
>IETF should and that standardization will certainly help the community,
>if we can move fast enough.

Whereas interoperability is a noble goal, the IETF also has the good 
habit of clearly specifying what our protocols do and don't do.  Our 
bar is thankfully higher than marketing literature for example.

>The recent email by Jari Arkko to standardize some of the EAP methods
>which are being used and deployed today but no RFCs exist for them, is
>certainly a step in the right direction.

Good example actually: 3748 contains brutal truths about some of the 
legacy EAP methods, for instance on MD5-Challenge -- which no one 
should really be using for access control -- it says:

Auth. mechanism:           Password or pre-shared key.
Ciphersuite negotiation:   No
Mutual authentication:     No
Integrity protection:      No
Replay protection:         No
Confidentiality:           No
Key derivation:            No
Key strength:              N/A
Dictionary attack prot.:   No
Fast reconnect:            No
Crypt. binding:            N/A
Session independence:      N/A
Fragmentation:             No
Channel binding:           No

In other words, someone who uses that protocol gets zilch!  Now of 
course, in the "real" world, a variant of this protocol was used and 
soon after publicly demonstrated to be useless.

best regards,
Lakshminath

>My 2 cents,
>Hormuzd

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: "Khosravi, Hormuzd M" <[email-masked]>
Date: Tue, 17 Oct 2006 00:00:52 -0700

Sam,

My 2 cents,
Hormuzd

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Friday, October 13, 2006 12:43 PM
To: Frank Yeh Jr
Cc: Ted Hardie; [email-masked]; [email-masked]
Subject: Re: [Nea] WG Review: Network Endpoint Assessment (nea)

>>>>> "Frank" == Frank Yeh <[email-masked]> writes:

    Frank> Standardized VS vendor-specific attributes is not something
that needs to be
    Frank> solved today. Solutions can start with vendor-specific and
migrate toward a
    Frank> standard, if one develops, without changing the protocol. The
specification
    Frank> should not preclude the addition of standardized attributes.
IE the
    Frank> specification is like an alphabet, attributes are like
vocabulary. You can add
    Frank> new words without changing the letters.

One of the things coming out of the most recent BOF was a strong
desire for PA-level interoperability.  That can be accomplished
through standardized attributes or vendor-specific attributes that are
sufficiently well documented (and not subject to patents) that third
parties can implement collectors or analysis tools that interoperate
with the vendor tools for the vendor attributes.

Will we be able to meet these interoperability goals?  Why or why not?

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea