From jsalowey@cisco.com Wed Dec 14 08:35:15 2011 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DF6921F8B6E for ; Wed, 14 Dec 2011 08:35:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id afFYcPVSB5pS for ; Wed, 14 Dec 2011 08:35:13 -0800 (PST) Received: from mtv-iport-2.cisco.com (mtv-iport-2.cisco.com [173.36.130.13]) by ietfa.amsl.com (Postfix) with ESMTP id C558721F8B6C for ; Wed, 14 Dec 2011 08:35:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=jsalowey@cisco.com; l=333; q=dns/txt; s=iport; t=1323880513; x=1325090113; h=from:content-transfer-encoding:subject:date:message-id: to:mime-version; bh=3tF8MgSP5El3tuCQyVZ6LjxjloOoHODaTpBmTrTgYrc=; b=coz3yxSic2joLsouiW5Kr4qD32nGwCOPzbUSNFKs4gEefjKoCIuWZUe+ ouBtKkxVzsNFzhAgf47W1DhBnn+gU+QqYYVz1YUAjnkV8B8Hv8X7fqiaW moR6/BKdvjRsZ9br9DsgQu3EnSy9Xqzb3kPmwpdSIG31IemnClyPeL9wQ Y=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AvwEAOPP6E6rRDoG/2dsb2JhbABDqyeBBYILASeCMp8agSYBnlaIb4I3YwSIMoxChU2Mfg X-IronPort-AV: E=Sophos;i="4.71,353,1320624000"; d="scan'208";a="20681948" Received: from mtv-core-1.cisco.com ([171.68.58.6]) by mtv-iport-2.cisco.com with ESMTP; 14 Dec 2011 16:35:13 +0000 Received: from [10.33.251.93] ([10.33.251.93]) by mtv-core-1.cisco.com (8.14.3/8.14.3) with ESMTP id pBEGZDRn026617 for ; Wed, 14 Dec 2011 16:35:13 GMT From: Joe Salowey Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Date: Wed, 14 Dec 2011 08:35:31 -0800 Message-Id: <8D194B31-F1C4-46E0-9E43-74B19912DAD3@cisco.com> To: emu@ietf.org Mime-Version: 1.0 (Apple Message framework v1084) X-Mailer: Apple Mail (2.1084) Subject: [Emu] Appendices in draft-ietf-emu-chbind-11 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2011 16:35:15 -0000 I think the following appendices of the channel binding document are no = longer supported by the rest of the text and defined attributes. I = think they are out of date and should be removed: A.3. Downgrading attacks A.4. Bogus Beacons in IEEE 802.11r A.5. Forcing false authorization in IEEE 802.11i Thanks, Joe= From hartmans@mit.edu Wed Dec 14 11:26:30 2011 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75C4C1F0C5D for ; Wed, 14 Dec 2011 11:26:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.575 X-Spam-Level: X-Spam-Status: No, score=-102.575 tagged_above=-999 required=5 tests=[AWL=-0.310, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HNZLS4CPwq0F for ; Wed, 14 Dec 2011 11:26:30 -0800 (PST) Received: from permutation-city.suchdamage.org (permutation-city.suchdamage.org [69.25.196.28]) by ietfa.amsl.com (Postfix) with ESMTP id 1233D1F0C4F for ; Wed, 14 Dec 2011 11:26:28 -0800 (PST) Received: from carter-zimmerman.suchdamage.org (carter-zimmerman.suchdamage.org [69.25.196.178]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "laptop", Issuer "laptop" (not verified)) by mail.suchdamage.org (Postfix) with ESMTPS id 7F5F32013E; Wed, 14 Dec 2011 14:26:26 -0500 (EST) Received: by carter-zimmerman.suchdamage.org (Postfix, from userid 8042) id 7B9B642F2; Wed, 14 Dec 2011 14:25:58 -0500 (EST) From: Sam Hartman To: Joe Salowey References: <8D194B31-F1C4-46E0-9E43-74B19912DAD3@cisco.com> Date: Wed, 14 Dec 2011 14:25:58 -0500 In-Reply-To: <8D194B31-F1C4-46E0-9E43-74B19912DAD3@cisco.com> (Joe Salowey's message of "Wed, 14 Dec 2011 08:35:31 -0800") Message-ID: User-Agent: Gnus/5.110009 (No Gnus v0.9) Emacs/22.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: emu@ietf.org Subject: Re: [Emu] Appendices in draft-ietf-emu-chbind-11 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2011 19:26:30 -0000 >>>>> "Joe" == Joe Salowey writes: Joe> I think the following appendices of the channel binding Joe> document are no longer supported by the rest of the text and Joe> defined attributes. I think they are out of date and should be Joe> removed: A.3. Downgrading attacks A.4. Bogus Beacons in IEEE Joe> 802.11r A.5. Forcing false authorization in IEEE 802.11i I don't have an objection to removing these sections, although I actually think the attacks described are still real attacks. I think an alternate solution would be to add a paragraph to the top of appendix A pointing out that channel bindings are part of the solution. To actually prevent the attacks we'd need to define lower-layer documents describing what attributes you bind and you'd need to deploy with the appropriate configuration in the local database. I.E. as far as this document goes it does still support solving these attacks. We just reduced our scope to avoid the lower-layer specific issues, so more work is needed. I'd prefer to simply add a paragraph to the introduction of the appendix clearly explaining what additional work needs to happen. However I'm happy removing if that's what the WG wants. From jsalowey@cisco.com Thu Dec 15 11:20:58 2011 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ACC1D21F889A for ; Thu, 15 Dec 2011 11:20:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 98YUyHhup5zI for ; Thu, 15 Dec 2011 11:20:57 -0800 (PST) Received: from mtv-iport-3.cisco.com (mtv-iport-3.cisco.com [173.36.130.14]) by ietfa.amsl.com (Postfix) with ESMTP id 0CC9F21F8ABD for ; Thu, 15 Dec 2011 11:20:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=jsalowey@cisco.com; l=1389; q=dns/txt; s=iport; t=1323976857; x=1325186457; h=subject:mime-version:from:in-reply-to:date:cc: content-transfer-encoding:message-id:references:to; bh=qo3YBK9tR8iqw2Z30D5vtjh5aThZ/qLEtgrcroEjkz4=; b=LzgPMFDwHOrDHUXWeeS1mVGE8ss2O5poCm3iQ1PL2fyI1uda2r319hDk 8HVJ+HhAoQw0TF1MjzO8sXrPca3JUuGlo2Cpw6skO3HfDAEnboPrPlJUP O1rkIxozsTggFL/fHX3EhQ1h4yZ6P9QmD3Mc33FXishcc/nmZzYqSATYk U=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Av0EAANI6k6rRDoJ/2dsb2JhbABDDqsogQWBcgEBAQQSASc/EAtGVwYTGweheAGeT4shYwSINIxChU6MJlg X-IronPort-AV: E=Sophos;i="4.71,359,1320624000"; d="scan'208";a="20956542" Received: from mtv-core-4.cisco.com ([171.68.58.9]) by mtv-iport-3.cisco.com with ESMTP; 15 Dec 2011 19:20:54 +0000 Received: from [10.33.251.93] ([10.33.251.93]) by mtv-core-4.cisco.com (8.14.3/8.14.3) with ESMTP id pBFJKr2Z014308; Thu, 15 Dec 2011 19:20:53 GMT Mime-Version: 1.0 (Apple Message framework v1084) Content-Type: text/plain; charset=us-ascii From: Joe Salowey In-Reply-To: Date: Thu, 15 Dec 2011 11:21:10 -0800 Content-Transfer-Encoding: 7bit Message-Id: <9B8F64EF-1A7B-4140-A0D4-45BB7CCB8F67@cisco.com> References: <8D194B31-F1C4-46E0-9E43-74B19912DAD3@cisco.com> To: Sam Hartman X-Mailer: Apple Mail (2.1084) Cc: emu@ietf.org Subject: Re: [Emu] Appendices in draft-ietf-emu-chbind-11 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2011 19:20:59 -0000 I'm OK with the approach you propose. Joe On Dec 14, 2011, at 11:25 AM, Sam Hartman wrote: >>>>>> "Joe" == Joe Salowey writes: > > Joe> I think the following appendices of the channel binding > Joe> document are no longer supported by the rest of the text and > Joe> defined attributes. I think they are out of date and should be > Joe> removed: A.3. Downgrading attacks A.4. Bogus Beacons in IEEE > Joe> 802.11r A.5. Forcing false authorization in IEEE 802.11i > > I don't have an objection to removing these sections, although I > actually think the attacks described are still real attacks. I think an > alternate solution would be to add a paragraph to the top of appendix A > pointing out that channel bindings are part of the solution. To > actually prevent the attacks we'd need to define lower-layer documents > describing what attributes you bind and you'd need to deploy with the > appropriate configuration in the local database. I.E. as far as this > document goes it does still support solving these attacks. We just > reduced our scope to avoid the lower-layer specific issues, so more work > is needed. > > I'd prefer to simply add a paragraph to the introduction of the appendix > clearly explaining what additional work needs to happen. > However I'm happy removing if that's what the WG wants.