From emu-bounces@ietf.org Mon Nov 19 03:50:26 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iu2Kn-0002V2-Ty; Mon, 19 Nov 2007 03:50:25 -0500 Received: from emu by megatron.ietf.org with local (Exim 4.43) id 1Iu2Kg-0002EI-Un for emu-confirm+ok@megatron.ietf.org; Mon, 19 Nov 2007 03:50:19 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iu2KT-0001tz-M2; Mon, 19 Nov 2007 03:50:05 -0500 Received: from ns1.neustar.com ([156.154.16.138]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Iu2KQ-0000US-M4; Mon, 19 Nov 2007 03:50:05 -0500 Received: from stiedprstage1.ietf.org (stiedprstage1.va.neustar.com [10.31.47.10]) by ns1.neustar.com (Postfix) with ESMTP id 60579327C0; Mon, 19 Nov 2007 08:50:02 +0000 (GMT) Received: from ietf by stiedprstage1.ietf.org with local (Exim 4.43) id 1Iu2KQ-0007Or-6l; Mon, 19 Nov 2007 03:50:02 -0500 Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Message-Id: Date: Mon, 19 Nov 2007 03:50:02 -0500 X-Spam-Score: 0.0 (/) X-Scan-Signature: 31247fb3be228bb596db9127becad0bc Cc: emu@ietf.org Subject: [Emu] I-D Action:draft-ietf-emu-eap-gpsk-07.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emu-bounces@ietf.org --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the EAP Method Update Working Group of the IETF. Title : EAP Generalized Pre-Shared Key (EAP-GPSK) Author(s) : C. Clancy, H. Tschofenig Filename : draft-ietf-emu-eap-gpsk-07.txt Pages : 36 Date : 2007-11-19 This Internet Draft defines an Extensible Authentication Protocol method called EAP Generalized Pre-Shared Key (EAP-GPSK). This method is a lightweight shared-key authentication protocol supporting mutual authentication and key derivation. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-emu-eap-gpsk-07.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-emu-eap-gpsk-07.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-emu-eap-gpsk-07.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2007-11-19034102.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-emu-eap-gpsk-07.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-emu-eap-gpsk-07.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2007-11-19034102.I-D\@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Emu mailing list Emu@ietf.org https://www1.ietf.org/mailman/listinfo/emu --NextPart-- From emu-bounces@ietf.org Mon Nov 19 15:34:30 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuDKA-0007AH-OF; Mon, 19 Nov 2007 15:34:30 -0500 Received: from emu by megatron.ietf.org with local (Exim 4.43) id 1IuDK9-0007A9-N8 for emu-confirm+ok@megatron.ietf.org; Mon, 19 Nov 2007 15:34:29 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuDK9-00079d-BB for emu@ietf.org; Mon, 19 Nov 2007 15:34:29 -0500 Received: from sj-iport-2-in.cisco.com ([171.71.176.71] helo=sj-iport-2.cisco.com) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IuDK8-0001LH-Ls for emu@ietf.org; Mon, 19 Nov 2007 15:34:29 -0500 Received: from sj-dkim-3.cisco.com ([171.71.179.195]) by sj-iport-2.cisco.com with ESMTP; 19 Nov 2007 12:34:28 -0800 Received: from sj-core-5.cisco.com (sj-core-5.cisco.com [171.71.177.238]) by sj-dkim-3.cisco.com (8.12.11/8.12.11) with ESMTP id lAJKYSkM026459 for ; Mon, 19 Nov 2007 12:34:28 -0800 Received: from xbh-sjc-211.amer.cisco.com (xbh-sjc-211.cisco.com [171.70.151.144]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id lAJKYSGc023317 for ; Mon, 19 Nov 2007 20:34:28 GMT Received: from xmb-sjc-225.amer.cisco.com ([128.107.191.38]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 19 Nov 2007 12:34:27 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Mon, 19 Nov 2007 12:34:48 -0800 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: EMU charter update for tunneled method Thread-Index: Acgq66C291A2zaUqTrGk3daCZ96Dew== From: "Joseph Salowey (jsalowey)" To: X-OriginalArrivalTime: 19 Nov 2007 20:34:27.0842 (UTC) FILETIME=[94934620:01C82AEB] DKIM-Signature: v=0.5; a=rsa-sha256; q=dns/txt; l=3602; t=1195504468; x=1196368468; c=relaxed/simple; s=sjdkim3002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=jsalowey@cisco.com; z=From:=20=22Joseph=20Salowey=20(jsalowey)=22=20 |Subject:=20EMU=20charter=20update=20for=20tunneled=20method |Sender:=20; bh=fabTOfcTIT9o1k/1uW85R5QIBTfq2G1+Bm8tmJ3T5/A=; b=qqzkkJ/u1Ls0RlUVVwoxhZyRxlvm7Oft+8a3PNJvJT2rj4jHs8W39oXjKNfBD2QXNxNDhrtI EE8T6Z92l6wg1CZX/0uFYJWxyYzW46GVVgDg0+CYcUnT0tuuFRmDyGMV; Authentication-Results: sj-dkim-3; header.From=jsalowey@cisco.com; dkim=pass ( sig from cisco.com/sjdkim3002 verified; ); X-Spam-Score: 0.0 (/) X-Scan-Signature: 25620135586de10c627e3628c432b04a Subject: [Emu] EMU charter update for tunneled method X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emu-bounces@ietf.org Below is a proposed update to the EMU charter to add a tunneled method. The following are the changes to the existing charter: - add charter item for tunneled EAP method - modified password based item to make use of the above tunneled method - modify "enhanced TLS" item to focus on adding channel bindings to a TLS based mechanism=20 - updated milestones=20 ------------------ Description of Working Group: The Extensible Authentication Protocol (EAP) [RFC 3748] is a network access authentication framework used in the PPP, 802.11, 802.16, VPN, PANA, and in some functions in 3G networks. EAP itself is a simple protocol and actual authentication happens in EAP methods. Over 40 different EAP methods exist. Most of this methods are proprietary methods and only a few methods are documented in RFCs. The lack of documented, open specifications is a deployment and interoperability problem. In addition, none of the EAP methods in the standards track implement features such as key derivation that are required for many modern applications. This poses a problem for, among other things, the selection of a mandatory to implement EAP method in new network access technologies. For example, no standards track methods meet new requirements such as those posed in RFC 4017, which documents IEEE 802.11 requirements for EAP methods. This group is chartered to work on the following types of mechanisms to meet RFC 3748 and RFC 4017 requirements: - An update to RFC 2716 to bring EAP-TLS into standards track, clarify specification, interoperability, and implementation issues gathered over the years, and update the document to meet the requirements of RFC 3748, RFC 4017, and EAP keying framework documents. Backwards compatibility with RFC 2716 is a requirement. - A mechanism based on strong shared secrets that meets RFC 3748 and RFC 4017 requirements. This mechanism should strive to be simple and compact for implementation in resource constrained environments. - A mechanism to support extensible communication within a TLS protected tunnel to support meeting the requirements of an enhanced TLS mechanism, a password based authentication mechanism, and to support additional inner authentication mechanisms. - Enhanced functionality to enable a TLS-based EAP method to support channel bindings. So as to enable RFC 2716bis to focus solely on clarifications to the existing protocol, this effort will be handled in a separate document. This item should not generate a new method rather it should be based on existing EAP-TLS or a TLS based tunneled method. =20 - A mechanism meeting RFC 3748 and RFC 4017 requirements that makes use of existing password databases such as AAA databases. The implementation should strive to be usable in resource constrained environments. This item will make use of the above tunneled method. Goals and Milestones: Done Form design team to work on strong shared secret mechanism Done Submit 2716bis I-D Done Submit first draft of shared secret mechanism I-D Done Form password based mechanism design team Done (July 2007) Submit 2716bis draft to IESG for Proposed Standard Dec 2007 Submit Strong Shared Secret Mechanism to IESG Dec 2007 Tunnel Method requirements Mar 2008 Tunnel Method first draft submitted May 2008 Submit Password method extensions to tunnel method June 2008 Submit Extended TLS method extensions to tunnel method Nov 2008 Submit Tunnel Method to IESG Nov 2008 Submit Enhanced EAP-TLS to IESG Nov 2008 Submit Password based method to IESG _______________________________________________ Emu mailing list Emu@ietf.org https://www1.ietf.org/mailman/listinfo/emu From emu-bounces@ietf.org Mon Nov 19 17:03:38 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuEiO-00067e-MF; Mon, 19 Nov 2007 17:03:36 -0500 Received: from emu by megatron.ietf.org with local (Exim 4.43) id 1IuEiM-00067S-SX for emu-confirm+ok@megatron.ietf.org; Mon, 19 Nov 2007 17:03:35 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuEiM-00067K-Hx for emu@ietf.org; Mon, 19 Nov 2007 17:03:34 -0500 Received: from sj-iport-3-in.cisco.com ([171.71.176.72] helo=sj-iport-3.cisco.com) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IuEiM-00050D-96 for emu@ietf.org; Mon, 19 Nov 2007 17:03:34 -0500 Received: from sj-dkim-2.cisco.com ([171.71.179.186]) by sj-iport-3.cisco.com with ESMTP; 19 Nov 2007 14:03:33 -0800 Received: from sj-core-5.cisco.com (sj-core-5.cisco.com [171.71.177.238]) by sj-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id lAJM3Xi1022438 for ; Mon, 19 Nov 2007 14:03:33 -0800 Received: from xbh-sjc-231.amer.cisco.com (xbh-sjc-231.cisco.com [128.107.191.100]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id lAJM3XGo022374 for ; Mon, 19 Nov 2007 22:03:33 GMT Received: from xmb-sjc-225.amer.cisco.com ([128.107.191.38]) by xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 19 Nov 2007 14:03:25 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Mon, 19 Nov 2007 14:03:46 -0800 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Draft Agenda for IETF 70 Thread-Index: Acgq+A5LInHp1FkXR4GHCxh7eHMWXQ== From: "Joseph Salowey (jsalowey)" To: X-OriginalArrivalTime: 19 Nov 2007 22:03:26.0123 (UTC) FILETIME=[02704FB0:01C82AF8] DKIM-Signature: v=0.5; a=rsa-sha256; q=dns/txt; l=506; t=1195509813; x=1196373813; c=relaxed/simple; s=sjdkim2002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=jsalowey@cisco.com; z=From:=20=22Joseph=20Salowey=20(jsalowey)=22=20 |Subject:=20Draft=20Agenda=20for=20IETF=2070 |Sender:=20; bh=YkiJJUIVuXjr2VUufgS0ivL9yKZxTUSVR1djgwRIx6Y=; b=CvcB0aKOeeQGMh5FHm1IwZ4kEbAN60TXPfJcY6vqkvbqBoxDsGqCgBIJhamuNL3CjURv63Jn 2kxM/Q2VB4pi1Gc3Enh8rmfpsXGko9bWQkCipuZ6KuURUw2uEjoTVsZ9; Authentication-Results: sj-dkim-2; header.From=jsalowey@cisco.com; dkim=pass ( sig from cisco.com/sjdkim2002 verified; ); X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c Subject: [Emu] Draft Agenda for IETF 70 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emu-bounces@ietf.org Below is the draft agenda for the EMU session at IETF 70 in Atlanta. Let me know if you have something you want to present in one of the sections: EMU=20 TUESDAY, December 4, 2007=20 0900-1130 Morning Session I Cypress =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D 1. Administrivia (5 min) 2. Draft updates (10 min) 3. Charter Discussion (40 min) 4. Requirements Discussion (50 min) 5. Method presentations (45 min) _______________________________________________ Emu mailing list Emu@ietf.org https://www1.ietf.org/mailman/listinfo/emu From emu-bounces@ietf.org Sat Nov 24 17:58:05 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iw3wr-0002EE-40; Sat, 24 Nov 2007 17:58:05 -0500 Received: from emu by megatron.ietf.org with local (Exim 4.43) id 1Iw3wp-00028I-Ex for emu-confirm+ok@megatron.ietf.org; Sat, 24 Nov 2007 17:58:03 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iw3wp-00024r-1F for emu@ietf.org; Sat, 24 Nov 2007 17:58:03 -0500 Received: from mail4.sea5.speakeasy.net ([69.17.117.6]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Iw3wo-0000Ai-Br for emu@ietf.org; Sat, 24 Nov 2007 17:58:02 -0500 Received: (qmail 29589 invoked from network); 24 Nov 2007 22:58:01 -0000 Received: from dsl017-049-110.sfo4.dsl.speakeasy.net (HELO jm) ([69.17.49.110]) (envelope-sender ) by mail4.sea5.speakeasy.net (qmail-ldap-1.03) with SMTP for ; 24 Nov 2007 22:58:01 -0000 Received: by jm (sSMTP sendmail emulation); Sat, 24 Nov 2007 14:57:33 -0800 Date: Sat, 24 Nov 2007 14:57:33 -0800 From: Jouni Malinen To: emu@ietf.org Subject: Re: [Emu] I-D Action:draft-ietf-emu-eap-gpsk-07.txt Message-ID: <20071124225733.GL8672@jm.kir.nu> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.16 (2007-06-09) X-Spam-Score: 0.0 (/) X-Scan-Signature: f4c2cf0bccc868e4cc88dace71fb3f44 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emu-bounces@ietf.org On Mon, Nov 19, 2007 at 03:50:02AM -0500, Internet-Drafts@ietf.org wrote: > Title : EAP Generalized Pre-Shared Key (EAP-GPSK) > Filename : draft-ietf-emu-eap-gpsk-07.txt Minor editorial comments: It looks like the general description of MK derivation in '4. Key Derivation' was not updated to match with the ciphersuite specific changes in 7.1.3 and 7.2.3. The following lines: o inputString = RAND_Peer || ID_Peer || RAND_Server || ID_Server o zero = 0x00 || 0x00 || ... || 0x00 (KS times) o MK = KDF-KS(zero, PL || PSK || CSuite_Sel || inputString)[0..KS-1] would need to be changed to: o inputString = RAND_Peer || ID_Peer || RAND_Server || ID_Server o MK = KDF-KS(PSK[0..KS-1], PL || PSK || CSuite_Sel || inputString)[0..KS-1] 7.1.3 and 7.2.3: MK = GKDF-16 (PSK[0..127], PL || PSK || CSuite_Sel || inputString) MK = GKDF-32 (PSK[0..255], PL || PSK || CSuite_Sel || inputString) The 0..127 and 0..255 are clearly usings bits, but these should be bytes to be consistent with the 0..KS-1 style used elsewhere, i.e., these lines should be MK = GKDF-16 (PSK[0..15], PL || PSK || CSuite_Sel || inputString) MK = GKDF-32 (PSK[0..31], PL || PSK || CSuite_Sel || inputString) Now that definition of 'zero' was removed from MK derivation, Method-ID derivation is using implicitly defined 'zero'. Even though it is relatively obvious what length will be used here, it would be better to state this explicitly: Add following line to 7.1.3 before Method-ID derivation: zero = 0x00 || 0x00 || ... || 0x00 (16 times) Add following line to 7.2.3 before Method-ID derivation: zero = 0x00 || 0x00 || ... || 0x00 (32 times) Especially the ciphersuite 2 case would benefit from explicit statement since HMAC-SHA256 could use any key length. I don't see any particular need for this to be 32 octets, but that would be consistent with other uses of GKDF and anyway, this matches with the KS-octet 'zero' used in Ch. 4. -- Jouni Malinen PGP id EFC895FA _______________________________________________ Emu mailing list Emu@ietf.org https://www1.ietf.org/mailman/listinfo/emu From emu-bounces@ietf.org Mon Nov 26 20:38:31 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwpPC-0001Tc-Rb; Mon, 26 Nov 2007 20:38:30 -0500 Received: from emu by megatron.ietf.org with local (Exim 4.43) id 1IwpPC-0001TV-CE for emu-confirm+ok@megatron.ietf.org; Mon, 26 Nov 2007 20:38:30 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwpPC-0001TN-2m for emu@ietf.org; Mon, 26 Nov 2007 20:38:30 -0500 Received: from sj-iport-6.cisco.com ([171.71.176.117]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IwpP8-0005Fb-Hw for emu@ietf.org; Mon, 26 Nov 2007 20:38:30 -0500 Received: from sj-dkim-4.cisco.com ([171.71.179.196]) by sj-iport-6.cisco.com with ESMTP; 26 Nov 2007 17:38:26 -0800 Received: from sj-core-1.cisco.com (sj-core-1.cisco.com [171.71.177.237]) by sj-dkim-4.cisco.com (8.12.11/8.12.11) with ESMTP id lAR1cQxu032448 for ; Mon, 26 Nov 2007 17:38:26 -0800 Received: from xbh-sjc-231.amer.cisco.com (xbh-sjc-231.cisco.com [128.107.191.100]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id lAR1cQus006729 for ; Tue, 27 Nov 2007 01:38:26 GMT Received: from xmb-sjc-225.amer.cisco.com ([128.107.191.38]) by xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 26 Nov 2007 17:38:25 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Mon, 26 Nov 2007 17:38:48 -0800 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Updated agenda for iETF 70 Thread-Index: AcgwlkHtYEiSI/geSfmOc6ZINfvCUg== From: "Joseph Salowey (jsalowey)" To: X-OriginalArrivalTime: 27 Nov 2007 01:38:25.0904 (UTC) FILETIME=[3432EF00:01C83096] DKIM-Signature: v=0.5; a=rsa-sha256; q=dns/txt; l=938; t=1196127506; x=1196991506; c=relaxed/simple; s=sjdkim4002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=jsalowey@cisco.com; z=From:=20=22Joseph=20Salowey=20(jsalowey)=22=20 |Subject:=20Updated=20agenda=20for=20iETF=2070 |Sender:=20; bh=cHmUIFi0r2iJruXz9Ryoy7xtogZXwdn7SgwjvPYQIac=; b=CfNDbG/IzMD5qlqht4AffQclbxBp7nRhcAK4asdhRPB/+Ht1GePIN15NuZh3IcJZduYQa5IA a0b0rWvpJgEs0alntjJXbpHoj0QdD631DBG1Rx3HQMgTMVt2sWV7B7Nl; Authentication-Results: sj-dkim-4; header.From=jsalowey@cisco.com; dkim=pass ( sig from cisco.com/sjdkim4002 verified; ); X-Spam-Score: -4.0 (----) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 Subject: [Emu] Updated agenda for iETF 70 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emu-bounces@ietf.org Below is an updated agenda for EMU at IETF 70. Let me know if you have any corrections or additions. We also need 2 note takers. Instead of wasting time in the meeting looking for note takers it would be helpful if a few participants volunteered ahead of time. =20 Thanks, Joe EMU TUESDAY, December 4, 2007 0900-1130 Morning Session I Cypress =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D 1. Administrivia (5 min) 2. Draft updates (10 min) 3. Charter Discussion (40 min) - http://www1.ietf.org/mail-archive/web/emu/current/msg00692.html 4. Tunneling methods Requirements Discussion (50 min) - review current requirements - tunneling passwords - tunneling EAP methods - tunnel establishment - tunnel extensibility 5. Tunneling Method presentations (45 min) - EAP-TTLS (15 min) - EAP-FAST (15 min) - Discussion (15 min) _______________________________________________ Emu mailing list Emu@ietf.org https://www1.ietf.org/mailman/listinfo/emu From emu-bounces@ietf.org Tue Nov 27 00:24:28 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iwsvq-0005Rz-AU; Tue, 27 Nov 2007 00:24:26 -0500 Received: from emu by megatron.ietf.org with local (Exim 4.43) id 1Iwsvp-0005PP-Gm for emu-confirm+ok@megatron.ietf.org; Tue, 27 Nov 2007 00:24:25 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iwsvp-0005OB-5p for emu@ietf.org; Tue, 27 Nov 2007 00:24:25 -0500 Received: from sj-iport-6.cisco.com ([171.71.176.117]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Iwsvm-0003UH-0b for emu@ietf.org; Tue, 27 Nov 2007 00:24:25 -0500 Received: from sj-dkim-3.cisco.com ([171.71.179.195]) by sj-iport-6.cisco.com with ESMTP; 26 Nov 2007 21:24:09 -0800 Received: from sj-core-2.cisco.com (sj-core-2.cisco.com [171.71.177.254]) by sj-dkim-3.cisco.com (8.12.11/8.12.11) with ESMTP id lAR5O9r2007198 for ; Mon, 26 Nov 2007 21:24:09 -0800 Received: from xbh-sjc-221.amer.cisco.com (xbh-sjc-221.cisco.com [128.107.191.63]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id lAR5O0bA014888 for ; Tue, 27 Nov 2007 05:24:09 GMT Received: from xmb-sjc-225.amer.cisco.com ([128.107.191.38]) by xbh-sjc-221.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 26 Nov 2007 21:24:06 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Mon, 26 Nov 2007 21:24:29 -0800 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Tunneling EAP method requirements Thread-Index: AcgwtciO+cOFCxYjQwSVG+Se0YLBGw== From: "Joseph Salowey (jsalowey)" To: X-OriginalArrivalTime: 27 Nov 2007 05:24:06.0380 (UTC) FILETIME=[BAF39AC0:01C830B5] DKIM-Signature: v=0.5; a=rsa-sha256; q=dns/txt; l=1693; t=1196141049; x=1197005049; c=relaxed/simple; s=sjdkim3002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=jsalowey@cisco.com; z=From:=20=22Joseph=20Salowey=20(jsalowey)=22=20 |Subject:=20Tunneling=20EAP=20method=20requirements |Sender:=20; bh=/Xri9ScZxV19g7s10zPXYbOhgK0Avx+cy/jJ7RkulxM=; b=YgLjbEp6N3tvQ3tT8nlDbxfcbZ3spP8j4xlhpkNJVbxBIp4EOadvzoLiWxdn6mckBKVzZ5qa dWpsJl9AhssiCng4dbpRCMp4ig23M3zCp8isz2UOimggvbpCot4nHYJO; Authentication-Results: sj-dkim-3; header.From=jsalowey@cisco.com; dkim=pass ( sig from cisco.com/sjdkim3002 verified; ); X-Spam-Score: -4.0 (----) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 Subject: [Emu] Tunneling EAP method requirements X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emu-bounces@ietf.org In adding the tunneling method to the charter we need to make sure we work off a valid set of requirements. We have a set of requirements that are based on tunneling passwords: 1. Transport of encrypted password for support of legacy password databases (REQUIRED) 2. Mutual authentication (specifically authentication of the server) (REQUIRED) 3. resistance to offline dictionary attacks, man-in-the-middle attacks (REQUIRED) 4. Compliance with RFC 3748, RFC 4017 and EAP keying (including EMSK and MSK generation) (REQUIRED) 5. Peer identity confidentiality (REQUIRED) 6. Crypto agility and ciphersuite negotiation (REQUIRED) 7. Session resumption (no password needed) (REQUIRED) 8. Fragmentation and reassembly (REQUIRED) 9. Cryptographic binding (REQUIRED if additional inner mechanisms are supported) 10. Password/PIN change (DESIRABLE) 11. Transport Channel binding data (REQUIRED) 12. Protected result indication (REQUIRED)=20 13. Support for certificate validation protocols (DESIRABLE) 14. Extension mechanism (in support of 10 - 12) (REQUIRED) In addition we should consider requirements in the use of the tunneling and changes to the behavior introduced by tunneling: 1. Tunneling EAP methods for authentication (eg, chaining, result indication, etc.) 2. Additional data that needs to be tunneled (channel binding, etc.) 3. Extensibility 4. Additional requirements for the tunnel itself 5. Changes to the above requirements (required to meet 3748, 4017, eap keying etc.) Are there specific items to be added or changed in the original list based on these areas? Are there other areas we need to consider when looking for requirements? =20 _______________________________________________ Emu mailing list Emu@ietf.org https://www1.ietf.org/mailman/listinfo/emu From emu-bounces@ietf.org Tue Nov 27 17:10:29 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ix8dR-00025v-IO; Tue, 27 Nov 2007 17:10:29 -0500 Received: from emu by megatron.ietf.org with local (Exim 4.43) id 1Ix8dQ-000213-RN for emu-confirm+ok@megatron.ietf.org; Tue, 27 Nov 2007 17:10:28 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ix8dQ-0001wm-As for emu@ietf.org; Tue, 27 Nov 2007 17:10:28 -0500 Received: from sj-iport-5.cisco.com ([171.68.10.87]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Ix8dP-0003Vs-Q0 for emu@ietf.org; Tue, 27 Nov 2007 17:10:28 -0500 Received: from sj-dkim-4.cisco.com ([171.71.179.196]) by sj-iport-5.cisco.com with ESMTP; 27 Nov 2007 14:02:02 -0800 Received: from sj-core-5.cisco.com (sj-core-5.cisco.com [171.71.177.238]) by sj-dkim-4.cisco.com (8.12.11/8.12.11) with ESMTP id lARM22kn007509 for ; Tue, 27 Nov 2007 14:02:02 -0800 Received: from xbh-sjc-221.amer.cisco.com (xbh-sjc-221.cisco.com [128.107.191.63]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id lARM221f016282 for ; Tue, 27 Nov 2007 22:02:02 GMT Received: from xmb-sjc-225.amer.cisco.com ([128.107.191.38]) by xbh-sjc-221.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 27 Nov 2007 14:02:02 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Tue, 27 Nov 2007 14:02:24 -0800 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Agenda update Thread-Index: AcgxQTDf6vDPEi6qTLSE3XlmzkIS5g== From: "Joseph Salowey (jsalowey)" To: X-OriginalArrivalTime: 27 Nov 2007 22:02:02.0027 (UTC) FILETIME=[239E47B0:01C83141] DKIM-Signature: v=0.5; a=rsa-sha256; q=dns/txt; l=1214; t=1196200922; x=1197064922; c=relaxed/simple; s=sjdkim4002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=jsalowey@cisco.com; z=From:=20=22Joseph=20Salowey=20(jsalowey)=22=20 |Subject:=20Agenda=20update |Sender:=20; bh=hVL88vTMFg3IvgjOa+zgmKXKGYqbbayvGn/7Rd59r5g=; b=dycK/xdqDtKj5DButoPxxICBqKdw7nz5pIiQTuuTK/oX6k6bumPOJJpTmdOndoeQ5YeTr01m G0bJ8zhvb2T5VcdPuvzd2IPsGeiBYfRDqrcsVfmy9yLR5Q80p2DXQl8E; Authentication-Results: sj-dkim-4; header.From=jsalowey@cisco.com; dkim=pass ( sig from cisco.com/sjdkim4002 verified; ); X-Spam-Score: -4.0 (----) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 Subject: [Emu] Agenda update X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emu-bounces@ietf.org I received some feedback that it would be more productive to move the method presentations before the requirements discussion so the requirements discussion can benefit from the lessons learned in the existing method designs. The updated agenda looks like: EMU TUESDAY, December 4, 2007 0900-1130 Morning Session I Cypress =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D 1. Administrivia (5 min) 2. Draft updates (10 min) 3. Charter Discussion (40 min) - http://www1.ietf.org/mail-archive/web/emu/current/msg00692.html 4. Tunneling Method presentations (30 min) - EAP-TTLS (15 min) http://www.ietf.org/internet-drafts/draft-funk-eap-ttls-v0-02.txt http://www.ietf.org/internet-drafts/draft-hanna-eap-ttls-agility-00.txt - EAP-FAST (15 min) http://www.ietf.org/rfc/rfc4851 http://www.ietf.org/internet-drafts/draft-cam-winget-eap-fast-provisioni ng-05.txt http://www.ietf.org/internet-drafts/draft-zhou-emu-fast-gtc-00.txt 5. Tunneling methods Requirements Discussion (60 min) - review current requirements - tunneling passwords - tunneling EAP methods - tunnel establishment - tunnel extensibility _______________________________________________ Emu mailing list Emu@ietf.org https://www1.ietf.org/mailman/listinfo/emu From emu-bounces@ietf.org Wed Nov 28 06:30:06 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxL7F-0006le-OW; Wed, 28 Nov 2007 06:30:05 -0500 Received: from emu by megatron.ietf.org with local (Exim 4.43) id 1IxL7E-0006lW-I1 for emu-confirm+ok@megatron.ietf.org; Wed, 28 Nov 2007 06:30:04 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxL7E-0006lN-59 for emu@ietf.org; Wed, 28 Nov 2007 06:30:04 -0500 Received: from exprod7og106.obsmtp.com ([64.18.2.165]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IxL7D-0008Tj-CG for emu@ietf.org; Wed, 28 Nov 2007 06:30:04 -0500 Received: from source ([66.129.224.36]) by exprod7ob106.postini.com ([64.18.6.12]) with SMTP; Wed, 28 Nov 2007 03:23:59 PST Received: from proton.jnpr.net ([10.10.2.37]) by emailsmtp56.jnpr.net with Microsoft SMTPSVC(6.0.3790.3959); Wed, 28 Nov 2007 03:30:00 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Subject: RE: [Emu] EMU charter update for tunneled method Date: Wed, 28 Nov 2007 06:28:26 -0500 Message-ID: In-Reply-To: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [Emu] EMU charter update for tunneled method Thread-Index: Acgq66C291A2zaUqTrGk3daCZ96DewADLN9w References: From: "Stephen Hanna" To: "Joseph Salowey (jsalowey)" , X-OriginalArrivalTime: 28 Nov 2007 11:30:00.0765 (UTC) FILETIME=[0332A6D0:01C831B2] X-Spam-Score: -4.0 (----) X-Scan-Signature: b2809b6f39decc6de467dcf252f42af1 Cc: X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emu-bounces@ietf.org Here is my feedback on this proposed charter update. 1) RFC 3748 and RFC 4017 requirements should apply to all deliverables. The proposed language omits them from the tunneled method deliverable. Please add them to that deliverable. 2) Some of the new milestones are not clear. The main problem is that there's no verb. For example, what does "Tunnel Method requirements" mean? It should say "Agree on Tunnel Method requirements" or some such. 3) I think that we should have an Internet Draft on "Tunnel Method requirements" that goes through the normal approval process to achieve IETF consensus and become an RFC. Agreeing on a Tunnel Method is a major effort (and quite valuable). We should have IETF consensus on the requirements before we start. Publishing the requirements as an Internet Draft will also make it easier for other standards groups to comments, which is probably a good idea in this instance. 4) The terms "tunneled" and "tunnel" are used interchangably. We should choose one or the other and stick to it. I think the term "tunneled" is more common for this usage so I suggest that we use that term. 5) In the second paragraph, the "this methods" should be "these methods". I appreciate your work on drafting this proposed charter update. It's a good start. I'm glad that we're getting some discussion of it and look forward to more discussion on the email list and in Vancouver. Thanks, Steve -----Original Message----- From: Joseph Salowey (jsalowey) [mailto:jsalowey@cisco.com]=20 Sent: Monday, November 19, 2007 3:35 PM To: emu@ietf.org Subject: [Emu] EMU charter update for tunneled method Below is a proposed update to the EMU charter to add a tunneled method. The following are the changes to the existing charter: - add charter item for tunneled EAP method - modified password based item to make use of the above tunneled method - modify "enhanced TLS" item to focus on adding channel bindings to a TLS based mechanism=20 - updated milestones=20 ------------------ Description of Working Group: The Extensible Authentication Protocol (EAP) [RFC 3748] is a network access authentication framework used in the PPP, 802.11, 802.16, VPN, PANA, and in some functions in 3G networks. EAP itself is a simple protocol and actual authentication happens in EAP methods. Over 40 different EAP methods exist. Most of this methods are proprietary methods and only a few methods are documented in RFCs. The lack of documented, open specifications is a deployment and interoperability problem. In addition, none of the EAP methods in the standards track implement features such as key derivation that are required for many modern applications. This poses a problem for, among other things, the selection of a mandatory to implement EAP method in new network access technologies. For example, no standards track methods meet new requirements such as those posed in RFC 4017, which documents IEEE 802.11 requirements for EAP methods. This group is chartered to work on the following types of mechanisms to meet RFC 3748 and RFC 4017 requirements: - An update to RFC 2716 to bring EAP-TLS into standards track, clarify specification, interoperability, and implementation issues gathered over the years, and update the document to meet the requirements of RFC 3748, RFC 4017, and EAP keying framework documents. Backwards compatibility with RFC 2716 is a requirement. - A mechanism based on strong shared secrets that meets RFC 3748 and RFC 4017 requirements. This mechanism should strive to be simple and compact for implementation in resource constrained environments. - A mechanism to support extensible communication within a TLS protected tunnel to support meeting the requirements of an enhanced TLS mechanism, a password based authentication mechanism, and to support additional inner authentication mechanisms. - Enhanced functionality to enable a TLS-based EAP method to support channel bindings. So as to enable RFC 2716bis to focus solely on clarifications to the existing protocol, this effort will be handled in a separate document. This item should not generate a new method rather it should be based on existing EAP-TLS or a TLS based tunneled method. =20 - A mechanism meeting RFC 3748 and RFC 4017 requirements that makes use of existing password databases such as AAA databases. The implementation should strive to be usable in resource constrained environments. This item will make use of the above tunneled method. Goals and Milestones: Done Form design team to work on strong shared secret mechanism Done Submit 2716bis I-D Done Submit first draft of shared secret mechanism I-D Done Form password based mechanism design team Done (July 2007) Submit 2716bis draft to IESG for Proposed Standard Dec 2007 Submit Strong Shared Secret Mechanism to IESG Dec 2007 Tunnel Method requirements Mar 2008 Tunnel Method first draft submitted May 2008 Submit Password method extensions to tunnel method June 2008 Submit Extended TLS method extensions to tunnel method Nov 2008 Submit Tunnel Method to IESG Nov 2008 Submit Enhanced EAP-TLS to IESG Nov 2008 Submit Password based method to IESG _______________________________________________ Emu mailing list Emu@ietf.org https://www1.ietf.org/mailman/listinfo/emu _______________________________________________ Emu mailing list Emu@ietf.org https://www1.ietf.org/mailman/listinfo/emu