Subject: [abfab] How does the EAP server know proxies did their thing?

From: Sam Hartman <[email-masked]>
Date: Tue, 15 Feb 2011 15:41:02 -0500

ABFAB depends on proxies doing certain things.  For example we depend on
a proxy near the acceptor 
verifying the hostname of the acceptor.

how does the EAP server know whether that has happened?

This message is not about malicious actors:safety pup says don't stick
malicious parties in your trust path. We'll be discussing trust a lot in
the architecture document and in some presentations we hope to give in
Prague.

However even when you discard malice, there are a lot of ways things can
go wrong. A proxy might not be upgraded to support ABFAB-specific
processing. Configuration might be set incorrectly. A proxy might not
have some data source it needs.

I think it would be desirable to have some way to do this.

I'm sort of imagining an attribute that the proxy includes indicating it
has performed some check and the policy applied to perform that check.
I'm not entirely sure what level of granularity is required.
I'm wondering if there are participants who would be interested in
working through details of this?

--Sam

---

From: Leif Johansson <[email-masked]>
Date: Tue, 15 Feb 2011 23:07:22 +0100

Not speaking as a chair...

> working through details of this?

I'm thinking about the channel-binding-cookie we built into my old
negotiate-ng draft to say that an http proxy knew about the CB token.
Perhaps a similar model might work... At least your description of
the problem sounds similar to the problems we were trying to solve
back then.

	Cheers Leif

---

From: Sam Hartman <[email-masked]>
Date: Tue, 15 Feb 2011 18:47:21 -0500

>>>>> "Leif" == Leif Johansson <[email-masked]> writes:

    Leif> Not speaking as a chair...

    >> I'm sort of imagining an attribute that the proxy includes
    >> indicating it has performed some check and the policy applied to
    >> perform that check.  I'm not entirely sure what level of
    >> granularity is required.  I'm wondering if there are participants
    >> who would be interested in working through details of this?

    Leif> I'm thinking about the channel-binding-cookie we built into my
    Leif> old negotiate-ng draft to say that an http proxy knew about
    Leif> the CB token.  Perhaps a similar model might work... At least
    Leif> your description of the problem sounds similar to the problems
    Leif> we were trying to solve back then.

I think so.
There's not actually any need to do anything cryptographic.
But yes, a cookie jar of proxy processing steps is what we're looking
> for here  I think.

---

From: Alan DeKok <[email-masked]>
Date: Fri, 18 Feb 2011 09:30:32 +0100

> how does the EAP server know whether that has happened?

  It doesn't.

> working through details of this?

  I think it would be useful.  Sharing information is a good idea.

  For simplicity, it would probably be best if there was no negotiation.
 i.e. the proxy just says "I did this".

  Any negotiation about which checks need to be done is probably an
issue for contracts, lawyers, etc.

  Alan DeKok.