Re: [Emu] Adoption call for eap.arpa

2024-03-21 Thread Michael Richardson
s way at all. I suspect we can have what we want, we just need to explain it to the IAB well enough. Unfortunately too late in the week for a hallway conversation. I found some IESG to talk to at the last break, but no IAB. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =

Re: [Emu] Adoption call for eap.arpa

2024-03-21 Thread Michael Richardson
iewers that would decide, I guess. It's late in the week to pigeon hole someone, but ... maybe we can find someone. Is a sub-domain the only technical solution? I'm sure we will need to answer that. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- *

Re: [Emu] Adoption call for eap.arpa

2024-03-13 Thread Michael Richardson
ter than either unencrypted wifi (w/portal), or encrypted WPA-PSK wifi. So yes, we always want to run EAP-TLS to generate keys. This document is related to https://datatracker.ietf.org/doc/draft-richardson-emu-eap-onboarding/, (which I'll repost on Saturday), but modularizes the work into smaller piec

Re: [Emu] Adoption call for eap.arpa

2024-03-10 Thread Michael Richardson
I've read draft-dekok-emu-eap-arpa, I think it important step in getting a number of other efforts underway. Please adopt. -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide signature.asc Description: PGP signature

Re: [Emu] New Version Notification for draft-janfred-eap-fido-02.txt

2024-03-05 Thread Michael Richardson
col user, you would be justified if you just said, "no packed CBOR" -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide signature.asc Description: PGP signature ___ Emu ma

Re: [Emu] New Version Notification for draft-janfred-eap-fido-02.txt

2024-03-05 Thread Michael Richardson
| ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signature.asc Description: PGP signature ___ Emu mailing list Emu@ie

Re: [Emu] New Version Notification for draft-janfred-eap-fido-02.txt

2024-03-03 Thread Michael Richardson
ementation during the hackathon to have > a better understanding and can identify possible missing spec and the > different error conditions that we need to signal. :-) -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide

Re: [Emu] New I-D: A new EAP method called EAP-FIDO

2023-11-03 Thread Michael Richardson
he-water. I didn't know that WPA3 supported a password identifier (I guess: a "username" concept). That's pretty significant I think. Do you know why "largest mobile company" thinks it is a bad idea? -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =-

Re: [Emu] New I-D: A new EAP method called EAP-FIDO

2023-11-03 Thread Michael Richardson
step, because the FIDO Passkey that is already provisioned for > logging into the account in the web can now simply be used for network > access as well. I hope this turns out to be true. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =-

Re: [Emu] New I-D: A new EAP method called EAP-FIDO

2023-10-25 Thread Michael Richardson
hort time before, in the worst case at the time -- things > break and now the admins need to act quickly. And this reaction also involves > the end-users, that need to reconfigure their devices and that's never a good > idea, because the latency of end-user action is immense (

Re: [Emu] New I-D: A new EAP method called EAP-FIDO

2023-10-24 Thread Michael Richardson
the initial > FIDO credentials. > In practice, this means WebPKI most of the time. :) Actually, that's a stronger statement anyway. It means that the choice of CA has essentially been pinned, so you'd not be vulnerable to attacks like ComonoGate. -- Michael Richardson. o O ( I

Re: [Emu] eap.arpa domain in draft-ietf-emu-bootstrapped-tls

2023-09-11 Thread Michael Richardson
we are trying to avoid. > In contrast, if there's only one kind of on-boarding access, > authorization has to be done through DHCP which has much more limited > capabilities for that. There are possibly many different ways depending upon where you open the lid of your lapt

Re: [Emu] eap.arpa domain in draft-ietf-emu-bootstrapped-tls

2023-09-10 Thread Michael Richardson
I don't think the supplicant should know/care, at this point, what kind of access it is going to get. I liked what we we had done with eap-onboarding where you get limited network, and then if DHCP says, via the DHCP option (or the RA option) that there is a captive portal, then it should do that. Or,

Re: [Emu] WGLC on draft-ietf-emu-rfc7170bis-11

2023-08-26 Thread Michael Richardson
Alan DeKok wrote: > On Aug 26, 2023, at 2:13 PM, Michael Richardson > wrote: >> Are you saying that Windows 11 also has implemented (accessible via >> "insider program" only)? > I believe that TEAP is generally available in Windows 1

Re: [Emu] WGLC on draft-ietf-emu-rfc7170bis-11

2023-08-26 Thread Michael Richardson
Heikki Vatiainen wrote: > Test with Windows 11 and eapol_test - EAP-TLS followed by EAP-MSCHAPv2 Are you saying that Windows 11 also has implemented (accessible via "insider program" only)? Bernard could you confirm? -- Michael Richardson. o O ( IPv6 IøT consulting )

Re: [Emu] I-D Action: draft-ietf-emu-rfc7170bis-13.txt

2023-08-22 Thread Michael Richardson
Alan DeKok wrote: > This draft addresses the final open issues. I've updated the github > repository to verify and close the open issues. I have updated the shepherd write-up. I don't see any issues at that level now. The document is ready for AD review I think. -- M

Re: [Emu] draft-ietf-emu-rfc7170bis-12: minor findings

2023-08-21 Thread Michael Richardson
hat's a good idea. TLV number 11 was the PAC. It is documented in {{RFC7170}}, but is considered deprecated. In the IANA considerations, the other TLVs can be updated to "THIS DOCUMENT", leaving 11 pointing at 7170. -- Michael Richardson. o O ( IPv6 IøT consulting ) S

Re: [Emu] WGLC on draft-ietf-emu-rfc7170bis-11

2023-08-19 Thread Michael Richardson
Eliot Lear wrote: >> We don't need or want anonymous ciphersuites here. > We should keep the TLS-POK work in mind. I didn't find an obvious draft about that in the TLS WG. -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works In

Re: [Emu] WGLC on draft-ietf-emu-rfc7170bis-11

2023-08-18 Thread Michael Richardson
Heikki Vatiainen wrote: >> On Aug 17, 2023, at 5:02 PM, Michael Richardson >> wrote: >> > section 3.9.: what is "server unauthenticated provisioning" > >> (sounds like TEAP-BRSKI?) >> >> Yes. > Should it b

Re: [Emu] WGLC on draft-ietf-emu-rfc7170bis-11

2023-08-17 Thread Michael Richardson
>> fragments, vs round-trips? > RADIUS defines retransmission rules. I don't think we need to worry > here about lost fragments. Sure, but the question is: is it better to have 5 1K things, or 1 5K thing? Assuming that the TEAP level TLVs can be broken up that way. >> I

Re: [Emu] Is the CSRattributes use in draft-ietf-emu-rfc7170bis a greenfield?

2023-08-17 Thread Michael Richardson
Alan DeKok wrote: Alan> On Aug 17, 2023, at 5:34 PM, Michael Richardson Alan> wrote: >> https://www.ietf.org/archive/id/draft-ietf-lamps-rfc7030-csrattrs-06.html#name-alternative-use-of-csr-temp >> ( https://youtu.be/biGtfqj7zgM?t=1640 ) >> >

[Emu] Is the CSRattributes use in draft-ietf-emu-rfc7170bis a greenfield?

2023-08-17 Thread Michael Richardson
xpect to put out an 07 by next week with some ASN.1 editorial fixes] -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide signature.asc Description: PGP signature ___ Emu mailing list Em

Re: [Emu] WGLC on draft-ietf-emu-rfc7170bis-11

2023-08-17 Thread Michael Richardson
<https://www.rfc-editor.org/info/rfc4086>. [RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data Encodings", RFC 4648, DOI 10.17487/RFC4648, October 2006, <https://www.rfc-editor.org/info/rfc4648>. I suggest when listing the con

Re: [Emu] WGLC on draft-ietf-emu-rfc7170bis-11

2023-08-17 Thread Michael Richardson
s seems like the time for > the WGLC to go forward. Please post your comments to the mailing list > by August 28th. Even a "good to go" is genuinely helpful input. If you have, or plan to implement, the document shepherd would like to know. -- Michael Richardson

Re: [Emu] Housekeeping functionality (Was: Re: I-D Action: draft-ietf-emu-rfc7170bis-09.txt)

2023-08-03 Thread Michael Richardson
int. > I'll see if I can put some wording around "authorize based on > _provisioned_ credentials, and not _connecting_ credentials" > Alan DeKok. > _______ Emu mailing list > Emu@ietf.org https://www.ietf.org/mailma

Re: [Emu] Housekeeping functionality (Was: Re: I-D Action: draft-ietf-emu-rfc7170bis-09.txt)

2023-08-02 Thread Michael Richardson
hould be EAP Failure. > I'm unsure if this is a substantive change to the document at this > phase. Given that no one has implemented PKCS provisioning yet, it may > be acceptable to make this change. This seems reasonable to me. -- Michael Richardson. o O

Re: [Emu] I-D Action: draft-ietf-emu-rfc7170bis-08.txt

2023-07-10 Thread Michael Richardson
iew. > I'll take a look. It's not written up, having been discussed in detail only last Wednesday. I'll get slides posted to LAMPS in the next week. But, the short of it: Here is an CSR, please fill in the blanks. -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Softwar

Re: [Emu] I-D Action: draft-ietf-emu-rfc7170bis-08.txt

2023-07-10 Thread Michael Richardson
Alan DeKok wrote: > * CAs should validate (somehow) any CSR they receive, to check that the > contents are reasonable I guess this is the new section 3.2.8. There are quite a number of subtlies here. First, the CSR is not really that complex :-) more importantly, there are not really

Re: [Emu] [IANA #1269174] Early review: draft-richardson-emu-eap-onboarding (IETF 116)

2023-04-02 Thread Michael Richardson
no* processing changes in any DNS places. It's just a unique name that we need as a REALM) -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide signature.asc Description: PGP signature __

Re: [Emu] Call for EMU agenda items for IETF 116

2023-02-27 Thread Michael Richardson
ning code is much slower than anticipated, but it is occuring. It's not clear to me what else the document can/should say. -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide signature.asc Description: PGP

Re: [Emu] [Acme] I-D Action: draft-ietf-acme-integrations-13.txt

2023-02-12 Thread Michael Richardson
RFC7030 to > specify how to use RFC9266. EST only references tls-unique. How should > we proceed here? AFAIK, a TLS1.3 exporter just needs a string to be specified somewhere. Where should we specify this? -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandel

Re: [Emu] New Version Notification for draft-richardson-emu-eap-onboarding-02.txt

2023-02-05 Thread Michael Richardson
internet-dra...@ietf.org wrote: > A new version of I-D, draft-richardson-emu-eap-onboarding-02.txt > has been successfully submitted by Michael Richardson and posted to the > IETF repository. > Name: draft-richardson-emu-eap-onboarding > Revision:

Re: [Emu] I-D Action: draft-ietf-emu-rfc7170bis-02.txt

2023-01-05 Thread Michael Richardson
t right, due to the "window" including the File/Edit menus...) "Works best in 640x480" is still true :-) -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide signature.asc Description: PGP signature ___

Re: [Emu] Adoption call for RFC 7170bis

2022-12-23 Thread Michael Richardson
possible because it would break deployed code (that he cares about) if done in TEAPv1. -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide signature.asc Description: PGP signature ___ Emu mailing list Emu@ietf.org https://www.ietf.org/mailman/listinfo/emu

Re: [Emu] Second WG Last Call for EAP-AKA' PFS

2022-12-18 Thread Michael Richardson
John Mattsson wrote: > Thanks for the suggestion, Michael. Currently we are unfortunately > using xml. The aasvg version seems nice. I make an issue on GitHub and > see what we can do. You can do it with XML, but it's a manual process. The RPC might be able ot do this for you at

Re: [Emu] Second WG Last Call for EAP-AKA' PFS

2022-12-16 Thread Michael Richardson
The document looks good to me. Thank you for the _7.5. Post-Quantum Considerations_ section. If the authors are using kramdown, they could consider enable aasvg processing of their ascii art diagrams. For instance: https://www.sandelman.ca/tmp/fig1.svg -- Michael Richardson. o O ( IPv6 IøT

Re: [Emu] I-D Action: draft-ietf-emu-bootstrapped-tls-01.txt

2022-10-28 Thread Michael Richardson
e who does not know the meaning of this > phrase, so I suggest the authors reword this so it is clear to everyone > what is meant by that, regardless of knowing the respective saying. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richa

Re: [Emu] Adoption call for EAP-DPP

2022-09-14 Thread Michael Richardson
), it would be good if your Security Considerations addressed some of the same issues that those documents deal with. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Emu mailing

Re: [Emu] EAP onboarding at ANIMA WG

2022-07-11 Thread Michael Richardson
o do more. This is not surprising in RFC8995(BRSKI), as it typically creates a provisional TLS connection to the Registrar, which is *later* authorized by an RFC8366 voucher. Can we do this with supplicants? I imagine so, but the write-up in the document could be challenging. -- Michael Richardson. o O (

[Emu] EAP onboarding at ANIMA WG

2022-07-11 Thread Michael Richardson
Topic/Title: EAP defaults for devices that need to onboard Name of Presenter(s): Michael Richardson (with Alan DeKok) Length of time requested: 5 minutes (new work) Document If applicable: https://datatracker.ietf.org/doc/draft-richardson-emu-eap-onboarding/ Alan and I have written a -00

Re: [Emu] Provisioning, configuration, etc. and EAP

2022-03-29 Thread Michael Richardson
Alan DeKok wrote: > On Mar 28, 2022, at 9:00 AM, Michael Richardson > wrote: >> Well, this is not something I'd do as part of onboarding, but rather >> as part of _configuration_, and I agree that it would be better to >> just use IP for

Re: [Emu] Provisioning, configuration, etc. and EAP

2022-03-28 Thread Michael Richardson
of having renewals spread across time, but there are also disadvantages as it spreads the failure signal across time as well which makes it harder to see that there is a real problem. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandel

Re: [Emu] Provisioning, configuration, etc. and EAP

2022-03-28 Thread Michael Richardson
ell, but it's not a concern, AFAIK, until you get into the O(10^2) range. > It's 2022... why is it difficult to get onto a friends WiFi network, > securely, and easily? Two out of three? -- ] Never tell me the odds! | ipv6 mesh networks [ ] Micha

Re: [Emu] Provisioning, configuration, etc. and EAP

2022-03-26 Thread Michael Richardson
WPA-PSK for the home, because RCM (Madinas) just can't cope with maintaining policies for different devices when the devices all have the same PSK. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___

Re: [Emu] Provisioning, configuration, etc. and EAP

2022-03-26 Thread Michael Richardson
h an existing configuration > update it? When / where / why / how? Why is this step different than configuration? There is a plan to unify/contrast the terminology in section 4 of: draft-irtf-t2trg-secure-bootstrapping/ but that section hasn't happened yet. -- Michael

Re: [Emu] Question for draft-ietf-emu-tls-eap-types-03

2021-06-29 Thread Michael Richardson
Alan DeKok wrote: > On Jun 28, 2021, at 8:50 PM, Michael Richardson wrote: >> To date, Enterprises with laptops and PCs have provisioned the IDevID into >> the TPM, themselves, at the same time the device is wiped and the golden >> image is installed.

Re: [Emu] Question for draft-ietf-emu-tls-eap-types-03

2021-06-28 Thread Michael Richardson
ient certificate is not transmitted in the clear during the handshake. If the supplicant can validate the server certificate, then a Mallory-in-the-Middle (onpath) attack also does not get the identity. -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ot

Re: [Emu] Issue 47 Certificate identity checks

2021-04-13 Thread Michael Richardson
he realm name enough to make the imposter cert from the non-authorized CA? I'm just trying to understand how the HTTPS cert is involved here. -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide signature.as

Re: [Emu] Consensus call for result indicators in EAP-TLS 1.3

2021-02-06 Thread Michael Richardson
more like that we are going from perhaps 5.5 round trips to 6.5 round trips (for example). I posit this, because I think that the increase in round trip count is largely irrelevant on non-challenged (RFC7228 term) networks. -- Michael Richardson. o O ( IPv6 IøT consulting )

Re: [Emu] Underspecification of EAP-TLS 1.3 State Machine

2021-02-03 Thread Michael Richardson
ion seems to be basically dancing around this. TLS 1.3 is too flexible, and we can't either constrain the TLS 1.3 state machine, nor can we depend upon it anymore the way that one could with 1.2. -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ott

Re: [Emu] [TLS] Fwd: Benjamin Kaduk's Discuss on draft-ietf-emu-eap-tls13-13: (with DISCUSS and COMMENT)

2021-01-05 Thread Michael Richardson
"to the EAP-TLS layer that the EAP-TLS method has finished" so I still think that there might be a typo :-) -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide signature.asc Description: PGP signature

Re: [Emu] [TLS] Fwd: Benjamin Kaduk's Discuss on draft-ietf-emu-eap-tls13-13: (with DISCUSS and COMMENT)

2021-01-05 Thread Michael Richardson
Alan DeKok wrote: > Therefore, we need an explicit signal to the EAP-TLS layer that the Do you mean, "to the EAP layer"? s/EAP-TLS layer/EAP/ ?? > EAP-TLS method has finished. -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software W

Re: [Emu] [Ace] [core] Proposed charter for ACE (EAP over CoAP?)

2020-12-09 Thread Michael Richardson
ot;could", as if it was an afterthought. Tell me what is your application? What will be impossible if we don't do this work? -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide signature.asc Description:

Re: [Emu] [Ace] [core] Proposed charter for ACE (EAP over CoAP?)

2020-12-07 Thread Michael Richardson
Could someone point to a use case for "EAP over CoAP" please? Is the goal to key an OSCORE context, or what? -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@sa

Re: [Emu] Making Security Practical ... was RE: Moving towards less security in 2020 - OCSP

2020-11-02 Thread Michael Richardson
ake the decision. Eliot, 1) it seems that if the CA hasn't put stapling information in, then it won't be needed. 2) if you still want stapling, then it seems to me that there are lifetimes in the staple which can be adjusted to deal with anticipated service interruptions in connectivity

Re: [Emu] Consensus Call on OCSP usage in draft-ietf-emu-eap-tls13-11

2020-10-30 Thread Michael Richardson
Joseph Salowey wrote: > On Fri, Oct 30, 2020 at 4:44 AM Michael Richardson > wrote: >> >> Joseph Salowey wrote: >> >> I suggest: >> >> >> >> “EAP-TLS servers supporting TLS 1.3 that use OCSP to do certificate

Re: [Emu] Consensus Call on OCSP usage in draft-ietf-emu-eap-tls13-11

2020-10-30 Thread Michael Richardson
> [Joe] Thanks Michael, I think your suggestion is a better way to phrase it Just so that we are clear: this mandates OCSP+stapling for systems that do revocation checks. Systems that don't do revocation checks (current mbedtls), therefore don't need to do OCSP or stapling. -- Micha

Re: [Emu] Consensus Call on OCSP usage in draft-ietf-emu-eap-tls13-11

2020-10-29 Thread Michael Richardson
't know much about the last part. I suggest it be split as three paragraphs for readability. -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide signature.asc Description: PGP signature

Re: [Emu] draft-ietf-emu-eap-tls13-11: OCSP Stapling

2020-10-26 Thread Michael Richardson
alidity periods. But, I agree with Eliot: the OCSP responder is new. It seems that maybe SHOULD would appropriate on OCSP. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT architect [ ] m...@san

Re: [Emu] draft-ietf-emu-eap-tls13-11: OCSP Stapling

2020-10-26 Thread Michael Richardson
>> system. > Again, what threat are we protecting against? The self-contained CA might have a passphrase, so there is some accomodation updating the signing key for new algorithms, etc. while the trust anchor which is distributed is appropriate pessimistic. -- Michae

Re: [Emu] draft-ietf-emu-eap-tls13-11: OCSP Stapling

2020-10-26 Thread Michael Richardson
o, running an OCSP server is something > that will be very new for many enterprises. -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide signature.asc Description: PGP signature ___ Emu mailing list Emu@ietf.org https://www.ietf.org/mailman/listinfo/emu

Re: [Emu] draft-ietf-emu-eap-tls13-11: OCSP Stapling

2020-10-26 Thread Michael Richardson
3. I do not think the > requirent should be softened, but if it is, my view is that is should > be softened as little as possible. -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide signature.asc Description: PGP signatu

Re: [Emu] draft-ietf-emu-eap-tls13-11: OCSP Stapling

2020-10-22 Thread Michael Richardson
etf.org/mailman/listinfo/emu >> > -------- > Alternatives: > > ___ > Emu mailing list > Emu@ietf.org &

Re: [Emu] draft-ietf-emu-eap-tls13-11: OCSP Stapling

2020-10-22 Thread Michael Richardson
Hannes Tschofenig wrote: > Thanks for the question. I am objecting to the mandatory use of OCSP for TLS 1.3 in EAP-TLS. > I am fine with having it optional. okay, so it's not about the stapling, at all for you, it's about the OCSP itself. -- Michael Richardson. o O ( IP

Re: [Emu] draft-ietf-emu-eap-tls13-11: OCSP Stapling

2020-10-21 Thread Michael Richardson
mu-eaptlscert worse. I am sure the authors are aware of > this fact since they are also co-authors of draft-ietf-emu-eaptlscert. -- Michael Richardson. o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide signatu

Re: [Emu] [Iot-directorate] Iotdir early review of draft-ietf-emu-eap-noob-01

2020-07-08 Thread Michael Richardson
/IP/Ethernet/WiFi stuff. Those devices do not use EAP today, and they are hard to upgrade. (and from a security point of view, those architectures concern me greatly) -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.

Re: [Emu] Secdir early review of draft-ietf-emu-eap-noob-01

2020-06-28 Thread Michael Richardson
ce? This is a good question, and I can offer no answer for the EAP-NOOB case, and I leave it to the authors to respond to your other comments. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works|IoT archite

Re: [Emu] TEAP Request-Action TLV

2020-04-30 Thread Michael Richardson
to send to me. > Hard code the ordering of requests so everyone knows what to expect. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Emu mailing list Emu@ietf.org https://www.ietf.org/mailman/listinfo/emu

Re: [Emu] I-D Action: draft-ietf-emu-eaptlscert-02.txt

2020-03-16 Thread Michael Richardson
ing the ID as a privacy enhancement. I don't think such a thing would be desireable, and TLS 1.3 provides other equivalent privacy enhancements, but I want to suggest you consider a new certificate container which contains a reference. IKEv2 already has that. -- Michael Richardson , Sandelman Soft

Re: [Emu] [lamps] Using public CA infrastructure for autonomic bootstrapping over EAP.

2020-02-01 Thread Michael Richardson
y EE issued by the public trust anchor could be a valid authenticator. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/

[Emu] using public CAs for IDevID and device certificates

2020-01-17 Thread Michael Richardson
Michael Richardson wrote: > 3. End User Client Certificates > A client certificate used to authenticate an end user may be used for > mutual authentication in TLS, ***EAP-TLS***, or messaging. The client > (to be very very very clear: not a consensus document a

Re: [Emu] [lamps] EAP/EMU recommendations for client cert validation logic

2020-01-17 Thread Michael Richardson
same root store as Web browsers > is the anti-pattern, because the requirements are different. And yet, almost every single thing out there would like to be connected to by a browser. They can't, so we have an app-per-thing, and/or no-security. -- Michael Richardson , Sandelman Softw

[Emu] Using public CA infrastructure for autonomic bootstrapping over EAP.

2020-01-17 Thread Michael Richardson
an expiry/retry time in the certs-only CMC Simple PKI Repsonse. I don't see a date in a RFC5652 Signed-Only certs-only container that could be used to cause pledges to get the /cacerts earlier than the expiry time of the CA. -- ] Never tell me the odds!

Re: [Emu] [lamps] EAP/EMU recommendations for client cert validation logic

2020-01-17 Thread Michael Richardson
iCert Global CA G2 CA Issuers - URI:http://cacerts.digicert.com/DigiCertGlobalCAG2.crt What's that quote about doctor's fixing themselves? -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Descript

Re: [Emu] BRSKI-TEAP vs regular connection (was Re: EAP questions ...)

2020-01-16 Thread Michael Richardson
Eliot Lear (elear) wrote: >> On 15 Jan 2020, at 16:10, Michael Richardson wrote: >> >> >> Eliot Lear (elear) wrote: >>>> Owen, do we have a need to recognize that a device needs to perform >>>> onboarding again after a m

Re: [Emu] BRSKI-TEAP vs regular connection (was Re: EAP questions ...)

2020-01-15 Thread Michael Richardson
n the action > request frames. To clear, it would be doing TEAP (or EAP-TLS) to connect to the network, because it is already enrolled. If there are BRSKI-specific responses defined in TEAP, then I'm surprised. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =-

Re: [Emu] [lamps] EAP/EMU recommendations for client cert validation logic

2020-01-08 Thread Michael Richardson
are trusted by default for EAP. How can anyone be using public CAs for EAP, if none are trusted for EAP, and no public CAs issue certificates with id-kp-serverAuth? -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: P

Re: [Emu] EAP/EMU recommendations for client cert validation logic

2019-12-17 Thread Michael Richardson
(public) CAs without invalidating the voucher. There might be a (3) that I can't think of right now. But, if these two requirements seem to contradict each other, then high-five to you, you were paying attention :-) -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Emu mailing list Emu@ietf.org https://www.ietf.org/mailman/listinfo/emu

Re: [Emu] Idea: New X509 Extension for securing EAP-TLS

2019-11-14 Thread Michael Richardson
On 2019-11-14 7:59 p.m., Alan DeKok wrote: > On Nov 13, 2019, at 6:23 PM, Michael Richardson wrote: >> I think that the issue isn't, can we find or define a OID that has the >> right semantics. >> I think that the issue whether or not any public CAs are

Re: [Emu] Idea: New X509 Extension for securing EAP-TLS

2019-11-13 Thread Michael Richardson
On 2019-11-13 7:40 a.m., Alan DeKok wrote: > On Nov 12, 2019, at 3:13 PM, Cappalli, Tim (Aruba) wrote: >> How does a public CA prove ownership of an SSID? > Do public CAs *always* verify addresses and/or telephone numbers, which are > normally included in certificates? They are?  I've

Re: [Emu] Idea: New X509 Extension for securing EAP-TLS

2019-11-13 Thread Michael Richardson
On 2019-11-13 4:07 a.m., Alan DeKok wrote: > On Nov 12, 2019, at 11:43 AM, Russ Housley wrote: >> Can the extended key usage for EAP over a LAN ( id-kp-eapOverLAN ) solve >> this for you? It is defined in RFC 4334. A certificate for Web PKI should >> not include this extended key usage. >>

Re: [Emu] Idea: New X509 Extension for securing EAP-TLS

2019-11-12 Thread Michael Richardson
On 2019-11-12 3:53 p.m., Jan-Frederik Rieckers wrote: > On 12.11.19 00:15, Owen Friel (ofriel) wrote: >> One deployment consideration is if an operator wants to use a public PKI >> (e.g. Lets Encrypt) for their AAA certs, then it could be years, if ever, >> before these extensions could be

Re: [Emu] Idea: New X509 Extension for securing EAP-TLS

2019-11-12 Thread Michael Richardson
On 2019-11-12 7:15 a.m., Owen Friel (ofriel) wrote: > This is also related to ongoing anima discussions about RFC 8366, and how it > can bootstrap trust when the pinned domain cert is a public PKI CA, and not a > private CA, and hence additional domain (or realm or FQDN) info is also > needed

[Emu] BRSKI-TEAP vs regular connection (was Re: EAP questions ...)

2019-11-07 Thread Michael Richardson
On 2019-11-07 12:43 p.m., Alan DeKok wrote: >> E.g. we have documented in >> https://tools.ietf.org/html/draft-lear-eap-teap-brski-05#section-5 that: >> >> " A device that has not been bootstrapped at all SHOULD send an >> identity of teap-bootstrap@TBD1. " >> >> If we register that

Re: [Emu] POST WGLC Comments draft-ietf-emu-eap-tls13

2019-10-11 Thread Michael Richardson
, can wired just be a degenerate version of wifi, where there can be only one "ESSID", and there are no beacons to consider? -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software

Re: [Emu] POST WGLC Comments draft-ietf-emu-eap-tls13

2019-10-11 Thread Michael Richardson
le do not expect to scan anything? -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.ca/| ruby on rails[ signatu

Re: [Emu] Re-charter text

2019-08-22 Thread Michael Richardson
shall produce the following documents: These read like milestones rather than areas of focus. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network architect [ ] m...@sandelman.ca http://www.sandelman.c

Re: [Emu] EAP-AKA' and Re: WG adoption call for draft-arkko-eap-aka-pfs

2019-04-03 Thread Michael Richardson
) allows you to even manually turn off 2G. They both allow you > to turn off 4G for battery savings but not 2G for security reasons. Ask > the company that made your phone ;) Sad to know. Thanks for explaining this. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Emu mailing list Emu@ietf.org https://www.ietf.org/mailman/listinfo/emu

Re: [Emu] EAP and Transport Protocol

2019-04-01 Thread Michael Richardson
t;open1x" on the client side, but > those have been dead for 10 years. >> In particular, the use of the > Early truncation? lack of fragmentation :-) -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Softw

Re: [Emu] EAP-AKA' and Re: WG adoption call for draft-arkko-eap-aka-pfs

2019-03-30 Thread Michael Richardson
5G, then anything that gets in the way of adoption is a problem. If it's not important enough to fix the IPR, then it's actually that important. - adopting AKA is very important. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sa

[Emu] EAP-AKA' and Re: WG adoption call for draft-arkko-eap-aka-pfs

2019-03-29 Thread Michael Richardson
itigating this patent is more important than 5G succeeding for roaming. Finally, I want to point to: https://lwn.net/Articles/780078/ -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works| network arch

Re: [Emu] Notes on session resumption with TLS-based EAP methods

2019-03-10 Thread Michael Richardson
If there is no legit use case for TLS resumption, then it seems that EAP servers SHOULD disable TLS resumption. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Emu mailing

Re: [Emu] Notes on session resumption with TLS-based EAP methods

2019-03-09 Thread Michael Richardson
me uses TTLS. It's not clear that anything in the alan> spec forbids or prevents this. What's in it for the user? Is this an attack? Does it avoid an interaction with a human? Does it enable mobility between different networks? Does this avoid some interaction with a two-factor authenticator? --

Re: [Emu] FW: New Version Notification for draft-ietf-emu-eap-tls13-03.txt

2018-11-14 Thread Michael Richardson
ard-nosed, I would say that's an internal management issue, > and not a standards issue. But I get your point, and there are ways to > address this (see below). It might be a lack of standard way to access logs of EAP server issue. -- Michael Richardson , Sandelman Software Works

[Emu] ship and forget use cases for onboarding

2018-10-22 Thread Michael Richardson
aying, let's not invent a problem before we understand who actually has the problem and make sure that the people who can solve the problem are at our table. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- signature.asc Description: PGP signature ___ Emu mailing list Emu@ietf.org https://www.ietf.org/mailman/listinfo/emu

Re: [Emu] Fwd: New Version Notification for draft-lear-brski-pop-00.txt

2018-10-22 Thread Michael Richardson
ip-to-holding-company. Holding company leases to end user for period of time. End user identity is never communicated back, and might be very much pseudonymous. I'm thinking about car-rentals, hotel rooms (full of devices), ... -- ] Never tell me the odds! | ipv6