From nobody Thu Oct 4 02:21:02 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B21B4130E09 for ; Thu, 4 Oct 2018 02:21:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=GCRT303w; dkim=pass (1024-bit key) header.d=ericsson.com header.b=Xz08zY8s Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KzwkDsNXTtnM for ; Thu, 4 Oct 2018 02:20:58 -0700 (PDT) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F399130E01 for ; Thu, 4 Oct 2018 02:20:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/simple; q=dns/txt; i=@ericsson.com; t=1538644852; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=WDxuMxkrjrYJn7nawnwpz/pQedsfbVo3r//OuBc8KAw=; b=GCRT303wLqXezhwQ9WAsQxlGC1w4izoYrNgmmS0clMzUH/Lg9em0N7gZyi4nMJlM Ocg3oxTiU21hQYfRr9CX6qrV33wVdKcnfcSyKQ7XPtf91/gQFkp/U3WgxQGOSpG9 xaBfSIdpVYpV4nIJlGOAR7giVeLxvLefzKONUwZCbf4=; X-AuditID: c1b4fb3a-99fff70000002fc1-55-5bb5db74fbcc Received: from ESESSMB504.ericsson.se (Unknown_Domain [153.88.183.122]) by sessmg22.ericsson.net (Symantec Mail Security) with SMTP id 14.99.12225.47BD5BB5; Thu, 4 Oct 2018 11:20:52 +0200 (CEST) Received: from ESESBMB501.ericsson.se (153.88.183.168) by ESESSMB504.ericsson.se (153.88.183.122) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Thu, 4 Oct 2018 11:20:51 +0200 Received: from EUR02-AM5-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB501.ericsson.se (153.88.183.168) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Thu, 4 Oct 2018 11:20:51 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=WDxuMxkrjrYJn7nawnwpz/pQedsfbVo3r//OuBc8KAw=; b=Xz08zY8sXUi37fGiLPPdjLxByXfm8tgpp/XeTZGUSyq6Ce/i5FT9iQIW0lZi3FObfeEBoxlJMEGt+xYBwbifNeUBWZ595h4AqaGHB/3g0XCq5dPyPjoA3/UXM9T2Rvre4V0UYb7iHrxUkktM4dBfBsUmqMAaZGCsYAJyBg8u66o= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3164.eurprd07.prod.outlook.com (10.170.245.26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1207.16; Thu, 4 Oct 2018 09:20:50 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::4426:8510:e19e:3ba2]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::4426:8510:e19e:3ba2%6]) with mapi id 15.20.1228.011; Thu, 4 Oct 2018 09:20:50 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: =?utf-8?B?TklTVCB0byBXaXRoZHJhdyBTUCA4MDAtMTIwIOKAnFJlY29tbWVuZGF0aW9u?= =?utf-8?B?IGZvciBFQVAgTWV0aG9kcyBVc2VkIGluIFdpcmVsZXNzIE5ldHdvcmsgQWNj?= =?utf-8?B?ZXNzIEF1dGhlbnRpY2F0aW9u4oCd?= Thread-Index: AQHUW8OKnNzmQJ8t602PqS3Pwd6l6g== Date: Thu, 4 Oct 2018 09:20:50 +0000 Message-ID: <65FF4657-6ABF-4188-8B5D-FF70F965B7B5@ericsson.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.11.0.180909 x-originating-ip: [192.176.1.92] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR07MB3164; 6:Uh9IdCSryke4SXy8gJ2RVQqZAB8Oj/4stx13+T5pUt9pPDREP9tmYtpYAIzlzgExxDadxQ6BMKyJR+3M0o2XJvGoM2OUFcwN0v3cQrgXz6pRiRmR/2khnQjwHCDyWswbGRjwh052gMz+TsvMOdhTbTmTc8LKs+dF2GGTkQiSUiY/tvTul2LojJxXxCPfxkWSEJNeRDyJcSQf3/z7ROJ/QlRvz966ry9pVXEX8h6/qceVMBPqOZVS1KO2n0YflESv61wbXGkvHUvNG8nsLOEiokNA+DlcMU2xpntzKOj6XHAKNsHQ3Dg5xVeJepMCaIC5AizSkJ/EFJHtxm82HDjWBZfCDum6WbcZ6WJW1C75LCpDQW79wRyhIbraqrUOGQatwHyDlofgaq17pg2upsI6v8gQuYB16LfZMulbHlxBxr5+Q15VC/Ig/TiJ3lRjO4YNmTPgqxcI418sKQCQQq6uKw==; 5:o5Dru79NR05PzN09+cXDgu3/4UoRNOjy1SlPrFvSwYP2D2XZQz3Fp1ygnNFzG5MIf3W/tymr/M/af9YBAVakE7GActnpCiesJVE5NhynaWfRZPHJOsCSujwYQsf1lXeFI+CYvO2wHKlWyr0pNoxdB/r1rQAQAVzNRfY4zlzliJg=; 7:7rC27dKOSrzx1qJT6f5h6B51zTe6jgaCXAtl4aL+OBwbZrDcrgPw2BK5T/FF2gwiOz+I5QonK9jQPTOKXKC35WBK9HVamrtpI7feA9GHkmfXe2qV6BuX22XlmBVjrL6mJ8WrdmblMK3mUq/rJidpIgAdxaIHn7vE8lOKoEEg5aeMzCEbi7qeGdZHMWsUkxetE5K2x8q4GEg0DoxOz5WGeQtApuHc6LUUaFOIxNADpYZSwULJpDZMqqCP3M/4GUzr x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 49e5af9f-7fd2-41f6-f664-08d629daad70 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3164; x-ms-traffictypediagnostic: HE1PR07MB3164: authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(131022147185803)(65766998875637); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(3002001)(3231355)(944501410)(52105095)(93006095)(93001095)(10201501046)(149066)(150057)(6041310)(20161123558120)(20161123562045)(20161123564045)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(201708071742011)(7699051)(76991048); SRVR:HE1PR07MB3164; BCL:0; PCL:0; RULEID:; SRVR:HE1PR07MB3164; x-forefront-prvs: 0815F8251E x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(366004)(376002)(39860400002)(396003)(136003)(69234005)(189003)(199004)(6116002)(3846002)(68736007)(5640700003)(6506007)(6486002)(97736004)(2900100001)(6436002)(2906002)(58126008)(99286004)(6306002)(6512007)(33656002)(256004)(53936002)(316002)(14444005)(66066001)(8936002)(83716004)(25786009)(71200400001)(71190400001)(305945005)(1730700003)(7736002)(5660300001)(81156014)(81166006)(105586002)(36756003)(44832011)(966005)(478600001)(14454004)(26005)(102836004)(186003)(486006)(476003)(2616005)(2351001)(6916009)(106356001)(82746002)(5250100002)(86362001)(2501003); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3164; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: 9zeXCghOoJbB3ID7eyB7R4s0wOtFKbGcTLhrLFCfj6Z6Dv3OJCWUbOv/BWyIGRNWFaT6cbem2ySAL/qVHsqMOpSrsIiARoj9wKpQ06MtWlCinjCrweiEdT3HLnSLXjCWAd16TGwYbVCBsnyJbMRXNnq01wOxnNBnJUrtvBTtqwSh6wYFmkn4gEOfRnLXmAq6+HbyJOdm2gbGviIHShdQYku5KTwp/Qe9JjA/FU6UTRFiEBp+ucvLRqMbujT8UwsAat4v90CntaEzxZJdYe3YGh5+f1SD8AvadNWPt8OTiVM09zjC7xNZBLHtU19nb8eQq2AiBXG0oqJxPnvqefTKls8lz9yu9O3TeVk4zyPOF4Q= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <52071AD5BEED2A45B9CCC534FF49DD53@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 49e5af9f-7fd2-41f6-f664-08d629daad70 X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Oct 2018 09:20:50.7703 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3164 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpjleLIzCtJLcpLzFFi42KZGbG9Srfk9tZog20/WC2OrV/L4sDosWTJ T6YAxigum5TUnMyy1CJ9uwSujEMXZjIWXGGu+HxtC1sD4wnmLkZODgkBE4lpm76wdTFycQgJ HGWUOL38JyOE85VR4trEmVDOYiaJi+c/s4M4LAITmCX+/DoHlZnEJDHvxD52COcho8S72dPB JrMJGEjM3dPABmKLCChK/LjUBhYXFjjOKHH7SR5Ig4jAGUaJmydmMEMU6Ukc/PwNrIFFQEVi 7cIGoBUcHLwC9hK9G3VBwowCYhLfT61hArGZBcQlbj2ZzwTxhYDEkj3noT4SlXj5+B8riC0q oC8x/0EHK0RcQeLPpUdsELasxKX53YwQ9j52icvraiFsXYkPU6dCzfGVaOl8ww5hA928d7s8 yDkSAloSK3bzQZwTK9HaOh1qfLbEtj0voMZ7S9z8MwVqjJzEqt6HLCDvSgjsZ5aYf+sHC0RC RuLNg9UsExgNZiF5ZxbQCmYBTYn1u/Qhwh4S7x9dYIWwFSWmdD9kB7F5BQQlTs58wrKAkXUV o2hxanFxbrqRkV5qUWZycXF+nl5easkmRmDqOLjlt9UOxoPPHQ8xCnAwKvHwfr+yNVqINbGs uDL3EKMEB7OSCK/hAqAQb0piZVVqUX58UWlOavEhRmkOFiVxXqc0iyghgfTEktTs1NSC1CKY LBMHp1QDY9K5LUwxlQsW//fV4tgvuqEr9bdNT8G9HTKnYtayn5L7c3lyfOS58lcqB5xWXmq/ 6N+g8cd/kmXYO8997m7iHzwzU1sbm+zO3399pn7rvr6e5Yk/Px5cEL+swOLEvZbJV1XenFnR dDpidv2Tz5bHpCbPeytyiPuU5qsf7renZS/4m3h3z62cD4eVWIozEg21mIuKEwHfMuGDGQMA AA== Archived-At: Subject: [Emu] =?utf-8?q?NIST_to_Withdraw_SP_800-120_=E2=80=9CRecommendat?= =?utf-8?q?ion_for_EAP_Methods_Used_in_Wireless_Network_Access_Authenticat?= =?utf-8?b?aW9u4oCd?= X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Oct 2018 09:21:01 -0000 RllJLA0KwqANCk5JU1QgaGFzIGRlY2lkZWQgdG8gd2l0aGRyYXcgU1AgODAwLTEyMCDigJxSZWNv bW1lbmRhdGlvbiBmb3IgRUFQIE1ldGhvZHMgVXNlZCBpbiBXaXJlbGVzcyBOZXR3b3JrIEFjY2Vz cyBBdXRoZW50aWNhdGlvbuKAnSBvbiBPY3RvYmVyIDE5LCAyMDE4LiBUaGUgZG9jdW1lbnQgU1Ag ODAwLTEyMCBpcyBvdXQgb2YgZGF0ZSBhbmQgTklTVCBpcyBpbnN0ZWFkIHJlZmVycmluZyB0byBy ZWxldmFudCBJRVRGIHN0YW5kYXJkcy4NCg0KaHR0cHM6Ly9jc3JjLm5pc3QuZ292L3B1YmxpY2F0 aW9ucy9kZXRhaWwvc3AvODAwLTEyMC9maW5hbA0KwqANCkNoZWVycywNCkpvaG4NCsKgDQoNCg0K From nobody Tue Oct 9 03:33:02 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A0517131256 for ; Tue, 9 Oct 2018 03:33:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6lWvFIC7D-Gd for ; Tue, 9 Oct 2018 03:32:58 -0700 (PDT) Received: from aer-iport-1.cisco.com (aer-iport-1.cisco.com [173.38.203.51]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 908FC131254 for ; Tue, 9 Oct 2018 03:32:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=6417; q=dns/txt; s=iport; t=1539081177; x=1540290777; h=subject:to:references:from:message-id:date:mime-version: in-reply-to; bh=GHeEKAjk9zc55hZnJFW9EM2IZTKDCK/gU0mAouUbebc=; b=ZpxXvmGxqjMFr0i3PgTaajI7RHzlYjCkQQgcLNLLt5DklQtOWuiLpLaT URhnQWmVQ7wTVl6NGaQB1lWIo15O3I52cWm0zhdB3V+Y7pjyllFdVkEpD D0yH1CgLboWVeL0+8FOxEMIFPqG2ib4C+E5g9I1bHmgJAJdlFKI2hywPJ g=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0A9AAA5g7xb/xbLJq1kGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBZYJsfyiDdYh0jTslmGkIBRgLhEkChGk4FgEDAQECAQE?= =?us-ascii?q?CbRwMhTkBAQEBAgEBASFLGwsYGBICAicwBgEMBgIBAYMdAYF5CA+jeIEuigw?= =?us-ascii?q?KBYJtiGOCAIESJwyCX4MbAQGBS2WCMoJXAoh9hmaENYleCYQFgWmKVgYXgU6?= =?us-ascii?q?EZ4JohmKVd4FZIYFVMxoIGxU7gmyCJheIWoVAPTCKByIJgiABAQ?= X-IronPort-AV: E=Sophos; i="5.54,360,1534809600"; d="asc'?scan'208"; a="7105990" Received: from aer-iport-nat.cisco.com (HELO aer-core-1.cisco.com) ([173.38.203.22]) by aer-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 09 Oct 2018 10:32:55 +0000 Received: from [10.61.245.214] ([10.61.245.214]) by aer-core-1.cisco.com (8.15.2/8.15.2) with ESMTP id w99AWtkB027979; Tue, 9 Oct 2018 10:32:55 GMT To: Alan DeKok , emu@ietf.org References: From: Eliot Lear Openpgp: preference=signencrypt Autocrypt: addr=lear@cisco.com; prefer-encrypt=mutual; keydata= xsBNBFMe1UQBCADdYOS5APDpIpF2ohAxB+nxg1GpAYr8iKwGIb86Wp9NkK5+QwbW9H035clT lpVLciExtN8E3MCTPOIm7aITPlruixAVwlBY3g7U9eRppSw9O2H/7bie2GOnYxqmsw4v1yNZ 9NcMLlD8raY0UcQ5r698c8JD4xUTLqybZXaK2sPeJkxzT+IwupRSQ+vXEvFFGhERQ88zo5Ca Sa1Gw/Rv54oH0Dq2XYkO41rhxQ60BKZLZuQK1d9+1y3I+An3AJeD3AA31fJZD3H8YRKOBgqe ILPILbw1mM7gCtCjfvFCt6AFCwEsjITGx55ceoQ+t5B5XGYJEppMWsIFrwZsfbL+gP31ABEB AAHNJUVsaW90IExlYXIgPGxlYXJAb2Zjb3Vyc2VpbXJpZ2h0LmNvbT7CwJEEEwECADsCGwMC HgECF4ACGQEWIQSY0L2QRh2wkqeyYR2HtmtG2dJ6MwUCWxJwMwULCQgHAgYVCAkKCwIEFgID AQAKCRCHtmtG2dJ6MyMyCACXvtFjAYGMtOkD9MD4nI3ifFpkrj8xTMbXjrv5hdqmzRmQ0wqA 1U/OlZux+P/NaVMiZNZc8zw0nsx/INAqDOVd4/tLWF+ywTkeRFR0VnaUxLwCReZAZOaRS+md +52u/6ddoFja2RnjZ43qbbuvVUARQVIyMJz+GbR6mEZQHR0psD7dDYZDyrpivCxm8zHQwmB6 AZUlO7OJgljDvVPVDCabg/ZnJw1qS0OzSiNb0MySk1D5A7FdwDgeKxuMYUOOoVVTTMWNWcME UkRX9LxElswEt0PQWiz/j3FYXTxiFfl/1vKcHx4pM+E5C5mhTbrdFUFLJC3Y5fLID7stK/Ch aEaBzsBNBFMe1UQBCAC0WV7Ydbv95xYGPhthTdChBIpPtl7JPCV/c6/3iEmvjpfGuFNaK4Ma cj9le20EA5A1BH7PgLGoHOiPM65NysRpZ96RRVX3TNfLmhGMFr5hPOGNdq+xcGHVutmwPV9U 7bKeUNRiPFx3YdEkExddqV2E8FltT0x2FSKe2xszPPHB6gVtMckX5buI9p1K3fbVhXdvEkcY Y/jB0JEJGyhS5aEbct5cHUvDAkT81/YFK5Jfg8RRwu1q1t1YuIJSOWAZQ9J9oUsg6D9RpClU +tIFBoe3iTp1AUfJcypucGKgLYKtpu/aygcpQONHYkYW5003mPsrajFhReVF5veycMbHs4u5 ABEBAAHCwF8EGAECAAkFAlMe1UQCGwwACgkQh7ZrRtnSejOSuQgA27p2rYB7Kh20dym6V8c6 2pWpBHHTgxr/32zevxHSiXl6xvUCg5T8WUwfUk8OvgDcBErK/blDAMXQzSg3sp450JhR8RnX HXF5Zz2T04X7HnlIVJGwf2CjnwyEAJCqMzaCmI+g3Imvg/8L4nyBFvhlFHDv+kIvMiujyycj PAu7xxKplBs1/IEwmDoAMjneFmawvfeQnwdMhSKK8PjKSuzGU5uUmxj3GBfRqvTM0qpmhMPF OmDhJSmH55HLAky2MlmqJYXJPt/9EfSEhFiua1M6gLiuNEuPkp+8jcnHQqKr0IeHt8UqcwLt 2mGfIyl0FVdF9hvWPjNRzGbgqoT1Di03RQ== Message-ID: <3dc3b4e1-d5aa-3179-f5e4-c90e309ceb71@cisco.com> Date: Tue, 9 Oct 2018 12:32:54 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="rNlhf0EU0zXacV6tFsNm12lRCPRgQNgci" X-Outbound-SMTP-Client: 10.61.245.214, [10.61.245.214] X-Outbound-Node: aer-core-1.cisco.com Archived-At: Subject: Re: [Emu] Comments on draft-lear-eap-teap-brski X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Oct 2018 10:33:01 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --rNlhf0EU0zXacV6tFsNm12lRCPRgQNgci Content-Type: multipart/mixed; boundary="SqKSBqFlpZLjCNUshzqQLLBVstG2ODS4s"; protected-headers="v1" From: Eliot Lear To: Alan DeKok , emu@ietf.org Message-ID: <3dc3b4e1-d5aa-3179-f5e4-c90e309ceb71@cisco.com> Subject: Re: [Emu] Comments on draft-lear-eap-teap-brski References: In-Reply-To: --SqKSBqFlpZLjCNUshzqQLLBVstG2ODS4s Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US Hi Alan, My apologies for the long delay in this reply On 21.07.18 16:11, Alan DeKok wrote: > One of the confusions from the meeting was "How can a device authenti= cate via 802.1X if it doesn't trust the network?" > > I think the confusion is due to terminology. The discussion in the m= eeting, and in the draft was about the device "authenticating" to the net= work during initial bootstrapping. The authors may correct me if I'm wro= ng, but this step is really "provisioning". I think I caught one instance where "authentication" was really superfluous.=C2=A0 I would be happy to find more cases. > > i.e. the device gets on the network without authenticating itself in = the traditional sense (password, certificate, etc.) > > The document isn't clear on this, which makes it more difficult to un= derstand. > > From Section 3.1 of the document: > > The device establishes an outer TEAP tunnel with the TEAP server and= > does not validate the server certificate. > > I would also add that the TEAP server does not authenticate the devic= e (as such). Instead, this step is about provisioning. Added words to this effect. > > Continuing from Section 3.1: > > The device sends a BRSKI-RequestVoucher TLV to the TEAP server. The= > TEAP server forwards the RequestVoucher message to the MASA server, > and the MASA server replies with a signed voucher. The TEAP server > sends a BRSKI-Voucher TLV to the device. > > If the MASA server does not issue a signed voucher, the TEAP server > sends an EAP-Error TLV with a suitable error code to the device. > > It would help to say that neither the TEAP server nor the MASA server= has (as yet) authenticated the device. Which means that the device has = established a secure tunnel to an unknown endpoint. That endpoint may la= ter reject the device, at which point the device tries another SSID. > > As a practical example, there may be two businesses who wish to insta= ll WiFi cameras. Each business has their own SSID. Any new device will = randomly connect to one of the SSIDs. If the device is known (somehow) t= o the business, it will be provisioned and allowed onto the network. If = the device is not known, it will be rejected, and will try the other SSID= =2E This is a really good point.=C2=A0 I've added some text along these lines= =2E > > I think it would help future discussions to consistently refer to thi= s phase as "provisioning", and not "authentication". I'm sure we'll miss a few.=C2=A0 Please keep us on our toes. > i.e. "the device provisionally connects to the 802.1X network". Or "= the device connects to the 802.1X network for initial provisioning". Let's see how the next version reads.=C2=A0 We can continue to evolve thi= s text. > > Once the device is provisioned, it can "authenticate" to the 802.1X n= etwork as normal. i.e. from Section 3.1 again: > > Once step 5 is complete, the device has completed the BRSKI flow and= > has established trust with the network. > > I would add "the device can then perform normal 802.1X authentication= with it's provisioned credentials, and with the provisioned network info= rmation." Not quite yet, right?=C2=A0 It still needs an LDevID.=C2=A0 But yes, late= r. > > From section 4.1: > > If the client is bootstrapping and has > not yet completed a BRSKI flow, it will not have trust anchors > installed yet, and thus will not be able to validate the server's > certificate. > > It would help instead to use consistent terminology: > > If the client is in the provisioning phase and has > not yet completed a BRSKI flow, it will not have trust anchors > installed yet, and thus will not be able to validate the server's > certificate. Ok. > > And the same applies later: > > It is recommended that the client validate the certificate presented= > by the server in the server's Certificate message, but this may not > be possible for bootstrapping clients that do not have appropriate > trust anchors installed yet. Ok. > > to: > > It is recommended that the client validate the certificate presented= > by the server in the server's Certificate message, but this may not > be possible for clients which have not yet been provisioned with > the appropriate trust anchors. > > The referenced IDs use the term bootstrapping", (ietf-anima-bootstrap= ping-keyinfra). But RFC 7170 (TEAP) uses "bootstrapping" once, and "prov= isioning" many times. > > My $0.02 is that "provisioning" is clearer in this context than "boot= strapping". Thank you! Eliot > Alan DeKok. > > _______________________________________________ > Emu mailing list > Emu@ietf.org > https://www.ietf.org/mailman/listinfo/emu > --SqKSBqFlpZLjCNUshzqQLLBVstG2ODS4s-- --rNlhf0EU0zXacV6tFsNm12lRCPRgQNgci Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlu8g9YACgkQh7ZrRtnS ejO5EggAyeFlwO+SQ4pDibDnRm9KBys/xorXfsD4NZUFB8H3r5zAhBeGiF/Uz2BH FUsl1lTR6T9J3Qh0/MXABK0kGhezQ+8e7cEluwiwbqeKgzSMEuX7UKitiQp7gvVj A8e/dYKdK+OkmxlABpZXsKp0LguuYM/+3Lk2IJRmwU2uaycBsCEBBUl21ur0s9iP ZR/2CtugxEf9JDIFiVET2uVceJz63z/UWVRLgsJ01nGxAxmlN+rCy8Owe/j5guGb tCcxlg9Bup6qPBpFP6iPVdPSrmv77GAMOhDPBfiHFtDpjwKeaw9tR6PmYi/ZMqsy ybO9qS2+TFcA7Nn8TvkgINuIEtxFug== =Or7X -----END PGP SIGNATURE----- --rNlhf0EU0zXacV6tFsNm12lRCPRgQNgci-- From nobody Tue Oct 9 07:21:29 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 606C4130E96 for ; Tue, 9 Oct 2018 07:21:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.757 X-Spam-Level: X-Spam-Status: No, score=-4.757 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.456, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=f3FSGFlh; dkim=pass (1024-bit key) header.d=ericsson.com header.b=gIce4KFW Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4RcSZJf2x4_8 for ; Tue, 9 Oct 2018 07:21:27 -0700 (PDT) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 58634130EE9 for ; Tue, 9 Oct 2018 07:21:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/simple; q=dns/txt; i=@ericsson.com; t=1539094880; x=1541686880; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=PG6AFMXz/8g/mlry1qhp35Sxd2KE5J067uJfU1Vr0/8=; b=f3FSGFlhcQXuZczKhTXTIi9uF2PwcJ8gdOo3ru5FILKXGUVf4nKrs4csR8tNGtPz KmAxn3gqPBvvYP46Mry0Jp2Q38h9LQtATgESDPS0TG76iYki45nMnlM+qljIAPr6 lq8Awlg2Tr+ekHYb2qjbMYOdYNODsrs7pmLo+9qwrjo=; X-AuditID: c1b4fb3a-171ff700000012ff-dc-5bbcb96092f1 Received: from ESESSMB501.ericsson.se (Unknown_Domain [153.88.183.119]) by sessmg22.ericsson.net (Symantec Mail Security) with SMTP id 9E.7D.04863.069BCBB5; Tue, 9 Oct 2018 16:21:20 +0200 (CEST) Received: from ESESSMB504.ericsson.se (153.88.183.165) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Tue, 9 Oct 2018 16:21:20 +0200 Received: from EUR01-HE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB504.ericsson.se (153.88.183.165) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Tue, 9 Oct 2018 16:21:20 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PG6AFMXz/8g/mlry1qhp35Sxd2KE5J067uJfU1Vr0/8=; b=gIce4KFWk9AyMgv7dH0zXQ1Kycmf1c30a23aSwx5W7hwFAf34Sp59ae69Z7Vq5YXQ8wjJUysuBY6+FHbsj0Vcq7h8J4cY1mIPcbCTe5ZR0GzNgBvDD1rCQ9vf4Fx7z5uof84bei72ThdV7q3JDgz3UrTjO75w2VvoYei9w76axY= Received: from VI1PR07MB4717.eurprd07.prod.outlook.com (20.177.54.82) by VI1PR07MB3310.eurprd07.prod.outlook.com (10.175.243.156) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1228.10; Tue, 9 Oct 2018 14:21:19 +0000 Received: from VI1PR07MB4717.eurprd07.prod.outlook.com ([fe80::5c07:f4e9:8838:9392]) by VI1PR07MB4717.eurprd07.prod.outlook.com ([fe80::5c07:f4e9:8838:9392%5]) with mapi id 15.20.1228.020; Tue, 9 Oct 2018 14:21:19 +0000 From: Mohit Sethi M To: "emu@ietf.org" , "emu-chairs@ietf.org" Thread-Topic: Agenda Items for IETF 103 Thread-Index: AQHUX9tYX7bXomKWcEGMqmanujMOSA== Date: Tue, 9 Oct 2018 14:21:19 +0000 Message-ID: <9f0e6ef7-ff0c-190b-f400-1562d81d5468@ericsson.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 x-originating-ip: [89.166.49.243] x-clientproxiedby: HE1PR0401CA0053.eurprd04.prod.outlook.com (2603:10a6:3:19::21) To VI1PR07MB4717.eurprd07.prod.outlook.com (2603:10a6:803:69::18) authentication-results: spf=none (sender IP is ) smtp.mailfrom=mohit.m.sethi@ericsson.com; x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; VI1PR07MB3310; 6:5OJhIh4chIsX9vGbv02LY2cSc8xn9onYzBwgNUYodeMS4C2ZIjVO/9csXo+2QtQbwDFDbX55Y3m2u+dUAQaRwhPRVw9rOu5OO6OvH3FmT8wAUU14nq7s5uTnIwX8ahycwC2v8hNAGnGj7KYeEqyOkAid8dNrA7/1UD/o2UcZnMaGo5nYmBd9Oiuq0NDb6fn1jgUW9s9gotDiqN0DpooWdMswnZHCFDKLkC1C3zZ+vhBHXjltHCkF5PA7D9L9vpAssfKp/b+EGNtym/xV1ZXHtKprzVB1FIn8njr3Bt+zlRtceqCnnYUAzFaAKI1efgpETcqlke8vVYtcvF7b65K3zZEH2eHcFpKt6E5MXEZT3Vj/e2KHgWbG/hX5c/YDD8eiezhDCqi/L+bKZbWjOndCIyYiiYkn+7awKZ0a3B9+E1jZKGTyAi3NE1VyP6/9958f7/iNCmMxcBPdn0UUEC+p3w==; 5:DVJh/NONEHge2zW9ACarpJLO5Aol5/93Eu+x7amGi05jYsfsbByjtatTvPBm3jWMYYWI42cI4Mi/2ZwbL4AynXVNynzAoXkwKdZC59BndkP7h8w8qgYqwTjaLzNfbIf0assSktqpl3vIsjC2KuD0472cYgcEm2BvSIJak7sZfo4=; 7:cVUAqtNvQt8/XnUBH1vhqfCuthh4elMi3vY30I81g6WHOIPK+wx4BcwvH6NDdlqFE0+SIqTWlUVVUTJrozhMnsNj7xXH2QhyRjAYppR7A+vavZqfq6Yq0dKy6Vq2c7+nW84MnyjA7wWMVER5w5FIpXByFbxMqeRCQR/DrtMwc+Mmm3CgQuXnd4/ymTPipaIqm/JlmViGawceDqFmK1yX/9AKWY/2amI0H+gWSd7z8hR9Tm+ZN4fr3FLIIn5htFo5 x-ms-office365-filtering-correlation-id: 08bc220f-31c6-4e2b-a1a0-08d62df27a61 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(2017052603328)(7153060)(7193020); SRVR:VI1PR07MB3310; x-ms-traffictypediagnostic: VI1PR07MB3310: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(3231355)(944501410)(52105095)(3002001)(10201501046)(93006095)(93001095)(149066)(150057)(6041310)(20161123564045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123562045)(201708071742011)(7699051); SRVR:VI1PR07MB3310; BCL:0; PCL:0; RULEID:; SRVR:VI1PR07MB3310; x-forefront-prvs: 08200063E9 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(136003)(366004)(376002)(346002)(396003)(189003)(199004)(486006)(6116002)(86362001)(3846002)(478600001)(6506007)(31696002)(99286004)(64126003)(5250100002)(5660300001)(53936002)(256004)(52116002)(110136005)(36756003)(106356001)(305945005)(386003)(2900100001)(58126008)(450100002)(2501003)(25786009)(6512007)(65826007)(8936002)(7736002)(102836004)(97736004)(71190400001)(2616005)(14454004)(6486002)(105586002)(6436002)(31686004)(26005)(8676002)(2906002)(316002)(476003)(186003)(81166006)(81156014)(66066001)(65956001)(65806001)(71200400001)(68736007)(413944005); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR07MB3310; H:VI1PR07MB4717.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: OBIUt/1grVP0d0ibTxjQQAVnKgOpxeWsLrkKBsEKrD7P6CaeIj+g5UQ37M3UBlO4NK19vK1nhnsJKfMLGXAuFifIXWqJaehTWIG+OcZs7MDvzI+mdIRIqBRqPt4brQDA/GCmPx7cFUmufFzeip7GYjHF95KRxv28k0eeTfcs6oxIPp6906P7y4x4dhM+fueEEd3tTDeE0HMkyYLOSIKv62/IlpV8ubGmUEHFDAD4eEpa6Xfi9xW5nuRjjDK/lZfCbs+zrOLPykmj3oLwII0NNt/3aRIqEmG1NaYjphEF7OkDN8bK2oVWqbZhv4xgUVBe2MM9L16ZxlokvfWtQj85ZO/gzfT6i/+Sl+kd89E4OKI= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <1C8172D8356F364F8E5EFE4A5975C921@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 08bc220f-31c6-4e2b-a1a0-08d62df27a61 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Oct 2018 14:21:19.5550 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR07MB3310 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupjleLIzCtJLcpLzFFi42KZGbG9XDdh555og/7TRhZTW3czWxxbv5bF gcljyZKfTAGMUVw2Kak5mWWpRfp2CVwZD5+/Zyk4wVIx895algbGHSxdjJwcEgImElt+HmLu YuTiEBI4yijRc+8DO4TzlVFi7v9LUM5iJomfXe1sIA6LwARmie/n97NBZCYxSSyaf4IFwnnI KLFg9XpWkMlsAgYSk6esYAexRQT8JD73LmAEsYUFlCRmT9jHChFXl5j4/wIbhK0ncfjVWWYQ m0VARaJp0iqwel4Be4kjP96A1TAKiEl8P7WGCcRmFhCXuPVkPhPEFwISS/acZ4awRSVePv4H Nl9UIELiaMt2Voi4osTZdw+ZQA6VEJjOKHH7zA8miKGxEh/+90MN0pE4e/0JI4QtK3Fpfjcj RMM+doldt15DTfKVWHlkFtSk44wSbe+vQXVrSVycPQeqKFvi0L5PzDDxDrAGEFtOYlXvQ2jg b2WW2PTEYQKj4SwkH81i5ACyNSXW79KHCHtI7D38jRHCVpSY0v2QfRY4YAQlTs58wrKAkXUV o2hxanFxbrqRkV5qUWZycXF+nl5easkmRmAqObjlt9UOxoPPHQ8xCnAwKvHwJmzZEy3EmlhW XJl7iFGCg1lJhFd0+65oId6UxMqq1KL8+KLSnNTiQ4zSHCxK4rxOaRZRQgLpiSWp2ampBalF MFkmDk6pBkaP4H8bNITXeTwNspvCsy2ps9xPcb3KSSc+yZ3fb5ZemP5EUvTOpJ8Wqy2YnwiK 3C89NWOb02qPA5euvgy9dUNy5vNVFQvDz82+rZrDtzP+lfBCpW/9k35WnPNQ8AmQZMt7difm hWbMr+6Fx5kMfe0vrI0raBRU42RdtkVQbfYpzTVadaESBguUWIozEg21mIuKEwGMz19JIQMA AA== Archived-At: Subject: [Emu] Agenda Items for IETF 103 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Oct 2018 14:21:28 -0000 RGVhciBhbGwsDQoNClBsZWFzZSBzZW5kIEpvZSBhbmQgSSByZXF1ZXN0cyBmb3IgcHJlc2VudGF0 aW9uIHNsb3RzIGR1cmluZyBJRVRGIDEwMy4gDQpBY2NvcmRpbmcgdG8gdGhlIHByZWxpbWluYXJ5 IGFnZW5kYSwgd2UgaGF2ZSBhIDIgaG91ciBzZXNzaW9uIG9uIE1vbmRheSwgDQpOb3ZlbWJlciA1 LCBiZXR3ZWVuIDE2OjEwLTE4OjEwIGluIHJvb20gQm9yb21waGltYXJuIDEvMi4NCg0KRG9uJ3Qg Zm9yZ2V0IHRvIGluY2x1ZGUgdGhlIHRpdGxlIG9mIHlvdXIgcHJlc2VudGF0aW9uLCByZWxhdGVk IGRyYWZ0cywgDQphbmQgdGhlIGFwcHJveGltYXRlIGFtb3VudCBvZiB0aW1lIHRoYXQgeW91IG5l ZWQuDQoNClBsZWFzZSBhbHNvIGxldCB1cyBrbm93IGlmIHlvdSBwbGFuIHRvIHByZXNlbnQgcmVt b3RlbHkuDQoNCkpvZSBhbmQgTW9oaXQNCg0K From nobody Tue Oct 16 13:30:21 2018 Return-Path: X-Original-To: emu@ietf.org Delivered-To: emu@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F8EF130E18; Tue, 16 Oct 2018 13:30:20 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: emu@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.87.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: emu@ietf.org Message-ID: <153972182006.9413.6451375301144600381@ietfa.amsl.com> Date: Tue, 16 Oct 2018 13:30:20 -0700 Archived-At: Subject: [Emu] I-D Action: draft-ietf-emu-eap-tls13-02.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Oct 2018 20:30:20 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the EAP Method Update WG of the IETF. Title : Using EAP-TLS with TLS 1.3 Authors : John Mattsson Mohit Sethi Filename : draft-ietf-emu-eap-tls13-02.txt Pages : 20 Date : 2018-10-16 Abstract: This document specifies the use of EAP-TLS with TLS 1.3 while remaining backwards compatible with existing implementations of EAP- TLS. TLS 1.3 provides significantly improved security, privacy, and reduced latency when compared to earlier versions of TLS. This document updates RFC 5216. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-emu-eap-tls13/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-emu-eap-tls13-02 https://datatracker.ietf.org/doc/html/draft-ietf-emu-eap-tls13-02 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-emu-eap-tls13-02 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Oct 16 13:42:38 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 801D2130E35 for ; Tue, 16 Oct 2018 13:42:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.365 X-Spam-Level: X-Spam-Status: No, score=-4.365 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=gZ8YwxkX; dkim=pass (1024-bit key) header.d=ericsson.com header.b=d2S5IZoo Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XWH7FgDxbPkY for ; Tue, 16 Oct 2018 13:42:32 -0700 (PDT) Received: from sesbmg23.ericsson.net (sesbmg23.ericsson.net [193.180.251.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 83EA7130E18 for ; Tue, 16 Oct 2018 13:42:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/simple; q=dns/txt; i=@ericsson.com; t=1539722550; x=1542314550; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=LHl8VRQjPmCZNhGX6RQFE4Vv8GqRdl2M6fo33IMc50k=; b=gZ8YwxkXeeUkfzq7SmJjbw5blz1rUDXzZrPc1CKsy5cV4rCUGTgy9b3YvilQYNXr Ed1lbL8Iy2iHQeDEh93yJSyp4HJoGbY8uScplcMgelHvNdS6J1oH7BhCT0ND6O7U a2xX/xLtVj3fmvkMpNGugUlRXyEKBHgtO4D40tlJG6c=; X-AuditID: c1b4fb25-a0b8c9e0000018b4-af-5bc64d363b4f Received: from ESESSMB501.ericsson.se (Unknown_Domain [153.88.183.119]) by sesbmg23.ericsson.net (Symantec Mail Security) with SMTP id E8.59.06324.63D46CB5; Tue, 16 Oct 2018 22:42:30 +0200 (CEST) Received: from ESESSMB504.ericsson.se (153.88.183.165) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Tue, 16 Oct 2018 22:42:30 +0200 Received: from EUR01-VE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB504.ericsson.se (153.88.183.165) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Tue, 16 Oct 2018 22:42:30 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LHl8VRQjPmCZNhGX6RQFE4Vv8GqRdl2M6fo33IMc50k=; b=d2S5IZooubNE+Ran665ipEXVjqnMiO5YH9wJoxKC+vGsJ16z73pd35gxuO4lm3S9362r1xBiJ36frPzGAz8LLMwi5W224uwgufgOfCnD0+yxedHC9Sd55HW6e4eigtgp4IlYWHSttPa7QeVHp7ayv3fX7mpqBddhQnN9ZeeLs6Y= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB1369.eurprd07.prod.outlook.com (10.164.52.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1250.13; Tue, 16 Oct 2018 20:42:28 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::fcb5:ca45:9e56:1910]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::fcb5:ca45:9e56:1910%2]) with mapi id 15.20.1250.019; Tue, 16 Oct 2018 20:42:28 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: New Version Notification for draft-ietf-emu-eap-tls13-02.txt Thread-Index: AQHUZY8WG1wR+PFKH0CpSKYeaEzRVqUid+iA Date: Tue, 16 Oct 2018 20:42:27 +0000 Message-ID: <68CCEF20-ABE9-4EF5-960F-F979224745A6@ericsson.com> References: <153972182026.9413.13067274643005820591.idtracker@ietfa.amsl.com> In-Reply-To: <153972182026.9413.13067274643005820591.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.11.0.180909 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR07MB1369; 6:/KXaRIElsPW9Ky777paJveie4wxQ+fJBkKT9c8rEeX/gwhe75uf9TpQwnnC+6tOyjnbco82Ibz9fJFU9xoYF9yFO5Hvqe3Le0zZ1WeMJ1N6F0O3PQl2vy8dtuiKr3g6GKhmGZjMsXW8jYyR7giIEoBPuuvsVpdo3X2GFJ8P+XIoE6rlu22gjEVZM/oQWHffpOhFvtRRSG6bfS7D78bhoyj9NrBpKkyn0ABR+5SzpDLBHcLi81wmle1u/zbdASA1SIiLwRqFS8kTf04r3hGJshVNTbul1FtImr7mFg3jWXiXsS2N8KLJvi4rldLYoSGh7lHiZJaNwo1xqVLlgoJLpa6Ux4T2d9XAMsaHVPYVW6eD3fY72RmF2O0qpO00f5SBK1fyVYVdQeYcVyAj4FKkWkRbP5c8wyb5LPzfDj7CHy2CHqt74TTaXXY2BPTbCtrjqhXLXDF26C0ZyD28IOrjA7A==; 5:lopECVL45yhkMFTVDp8OGdtVEa5sVwD4WLgfz/bn2Lzpi/WswmNq47+MLzcv5WlfyJVVv0L4i18i4Z3UBttIEC/8ima/ByQhDS5Xz5vUWK5V92lJO9Gu/7gcMLVGn6Nezl0s4FKKasWV8CNpIRjg8E98+S5JLIrCnWSZ9SoyvPs=; 7:tdEr/LOEjsSh6vNcgMnoinYdRu8xBCQoTcVKZ5mpwti+ofXobiH06iqIq4UgiHYWgFwB47pUqb0kL/sWvRwvXnC6GTzHrpi+InB0A42SGL9NnAMZJMhpsgaQ1TrfHQzTXF3IcUpxK7HU/Ann28Y+ZFv3pum9gm02O2KxBKQfoHWhgFYGw8za0pFHthmOLzkZdUk0iEPd4PWDFUcKF2sE1pynzfvEQI88gyrVTEo0aQA72uy2/ng1TCRNnIEWNUPH x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 4c78f327-8a18-41be-a04e-08d633a7e2f9 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB1369; x-ms-traffictypediagnostic: HE1PR07MB1369: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(72170088055959)(120809045254105)(192374486261705)(37575265505322)(248295561703944); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(3231355)(944501410)(52105095)(3002001)(10201501046)(93006095)(93001095)(149066)(150057)(6041310)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123562045)(20161123558120)(201708071742011)(7699051); SRVR:HE1PR07MB1369; BCL:0; PCL:0; RULEID:; SRVR:HE1PR07MB1369; x-forefront-prvs: 0827D7ACB9 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(396003)(376002)(39860400002)(136003)(366004)(189003)(199004)(13464003)(44832011)(11346002)(76176011)(14444005)(25786009)(256004)(316002)(82746002)(478600001)(3846002)(33656002)(97736004)(8936002)(66066001)(102836004)(6116002)(2900100001)(81156014)(53546011)(81166006)(8676002)(5250100002)(2906002)(106356001)(2351001)(4001150100001)(6506007)(186003)(2501003)(6512007)(26005)(1730700003)(99286004)(14454004)(2473003)(966005)(305945005)(6306002)(446003)(105586002)(486006)(6486002)(36756003)(5640700003)(2616005)(6916009)(83716004)(58126008)(476003)(5660300001)(86362001)(71200400001)(53936002)(7736002)(229853002)(15650500001)(68736007)(71190400001)(6436002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB1369; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: YqYYFIp///xLcahP/vKObL77w4+bfSYQRZzinTEPH1NCMOpFB69IL0VRLIA3+I9ZzpBlMy1oEvyZf1W488VpfyTxzHBcY9kOPeU86ZrM1Vf2E6nhFRIOVcWq7o36NRGHaGTrvxvMEHNRIN/qxIMd7C5lgz9spKOBbAYId8kiFh+lnFMl80ydfT+p2hoL2qitlOmqLVcr7S3c13XIN0kqMREhX8xrUa8Fi/qg6X+CttQ+HmQBabzrweuL6eSK33ow1dpHtFDFJ4FOCvh832H3YDutd4VwbCI1Qr/cFx+wb8eyXxYUFSrllGTo7H4z6tWGB0fTkDgebl9LZaj/DNbnwZzKmAJFRrDLuexBphHuBAA= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 4c78f327-8a18-41be-a04e-08d633a7e2f9 X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Oct 2018 20:42:27.8662 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB1369 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmphleLIzCtJLcpLzFFi42KZGbG9XNfM91i0wedFWhbH1q9lcWD0WLLk J1MAYxSXTUpqTmZZapG+XQJXxpf529gKtghXHJu1lamB8YtQFyMnh4SAicSbnxvYuhi5OIQE jjJKtGyexQLhfGOUuP3iATOEs4RJ4sbeP6wgDovABGaJmw9WsoH0CwlMYpLon+wHUfWIUaJh wTZWkASbgIHE3D0NYEUiAooSPy61MYPYwgKeEn0T9zBBxL0k1ndtYexi5ACyjSQOzQcrYRFQ lbiw5C+YzStgL3HpzlJWiF2+Eu+un2QHKecU8JM48lIfJMwoICbx/dQasInMAuISt57MZ4J4 TUBiyZ7zzBC2qMTLx//AxogK6EvMf9DBCtEbK9HaOp0VokZR4vS+FVD1shKX5nczgrwlIbCP XWJOwxVGiISuxIepU6GKfCV2vd/IAmEfB4bdOyhbS+LIrnNQ9dkSs942QtXXSjxbcRbKlpNY 1fuQZQKj0Swkd88Ceo1ZQFNi/S59iLCHxMtfn1kgbEWJKd0P2WeBQ0VQ4uTMJywLGFlXMYoW pxYn5aYbGeulFmUmFxfn5+nlpZZsYgSmjYNbfqvuYLz8xvEQowAHoxIPb5XrsWgh1sSy4src Q4wSHMxKIrzpl45GC/GmJFZWpRblxxeV5qQWH2KU5mBREud9aL45SkggPbEkNTs1tSC1CCbL xMEp1cDo1BerKsd3/nRR9+fJru9/GRe0/neOa1a6uO+1xHKX6T9iNm1u4LOtry4K2vPA+f/y p4sa6td9T3/06uf6swUaBQI2O5O3SBVPaXRrNd24TanscojMe7Zbu3um1AjNbK0QPp7mrVg1 QSShKdfh/b+zpis5JW8E6vdUnvpvu1rnTschZ+M1filKLMUZiYZazEXFiQCAN/c3FwMAAA== Archived-At: Subject: [Emu] FW: New Version Notification for draft-ietf-emu-eap-tls13-02.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Oct 2018 20:42:37 -0000 SGksDQoNCldlIGhhdmUgc3VibWl0dGVkIGEgbmV3IHZlcnNpb24gb2YgdGhlIGRyYWZ0LiBUaGUg Y2hhbmdlcyBjb25jZXJuIHRoZSBuZXcgIlByaXZhY3kgQ29uc2lkZXJhdGlvbnMiIGFuZCAiUGVy dmFzaXZlIE1vbml0b3JpbmciIHNlY3Rpb25zLg0KDQpDb21tZW50cyBvbiB0aGUgbmV3ICgtMDEs IC0wMikgdmVyc2lvbnMgYXMgd2VsbCBhcyByZXZpZXdzIG9mIHRoZSB3aG9sZSBkb2N1bWVudCBh cmUgdmVyeSB3ZWxjb21lLg0KDQpDaGVlcnMsDQpKb2huDQoNCu+7vy0tLS0tT3JpZ2luYWwgTWVz c2FnZS0tLS0tDQpGcm9tOiAiaW50ZXJuZXQtZHJhZnRzQGlldGYub3JnIiA8aW50ZXJuZXQtZHJh ZnRzQGlldGYub3JnPg0KRGF0ZTogVHVlc2RheSwgMTYgT2N0b2JlciAyMDE4IGF0IDIyOjMwDQpU bzogTW9oaXQgU2V0aGkgPG1vaGl0QHBpdWhhLm5ldD4sIEpvaG4gTWF0dHNzb24gPGpvaG4ubWF0 dHNzb25AZXJpY3Nzb24uY29tPg0KU3ViamVjdDogTmV3IFZlcnNpb24gTm90aWZpY2F0aW9uIGZv ciBkcmFmdC1pZXRmLWVtdS1lYXAtdGxzMTMtMDIudHh0DQoNCg0KQSBuZXcgdmVyc2lvbiBvZiBJ LUQsIGRyYWZ0LWlldGYtZW11LWVhcC10bHMxMy0wMi50eHQNCmhhcyBiZWVuIHN1Y2Nlc3NmdWxs eSBzdWJtaXR0ZWQgYnkgSm9obiBNYXR0c3NvbiBhbmQgcG9zdGVkIHRvIHRoZQ0KSUVURiByZXBv c2l0b3J5Lg0KDQpOYW1lOgkJZHJhZnQtaWV0Zi1lbXUtZWFwLXRsczEzDQpSZXZpc2lvbjoJMDIN ClRpdGxlOgkJVXNpbmcgRUFQLVRMUyB3aXRoIFRMUyAxLjMNCkRvY3VtZW50IGRhdGU6CTIwMTgt MTAtMTYNCkdyb3VwOgkJZW11DQpQYWdlczoJCTIwDQpVUkw6ICAgICAgICAgICAgaHR0cHM6Ly93 d3cuaWV0Zi5vcmcvaW50ZXJuZXQtZHJhZnRzL2RyYWZ0LWlldGYtZW11LWVhcC10bHMxMy0wMi50 eHQNClN0YXR1czogICAgICAgICBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFm dC1pZXRmLWVtdS1lYXAtdGxzMTMvDQpIdG1saXplZDogICAgICAgaHR0cHM6Ly90b29scy5pZXRm Lm9yZy9odG1sL2RyYWZ0LWlldGYtZW11LWVhcC10bHMxMy0wMg0KSHRtbGl6ZWQ6ICAgICAgIGh0 dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2h0bWwvZHJhZnQtaWV0Zi1lbXUtZWFwLXRs czEzDQpEaWZmOiAgICAgICAgICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvcmZjZGlmZj91cmwyPWRy YWZ0LWlldGYtZW11LWVhcC10bHMxMy0wMg0KDQpBYnN0cmFjdDoNCiAgIFRoaXMgZG9jdW1lbnQg c3BlY2lmaWVzIHRoZSB1c2Ugb2YgRUFQLVRMUyB3aXRoIFRMUyAxLjMgd2hpbGUNCiAgIHJlbWFp bmluZyBiYWNrd2FyZHMgY29tcGF0aWJsZSB3aXRoIGV4aXN0aW5nIGltcGxlbWVudGF0aW9ucyBv ZiBFQVAtDQogICBUTFMuICBUTFMgMS4zIHByb3ZpZGVzIHNpZ25pZmljYW50bHkgaW1wcm92ZWQg c2VjdXJpdHksIHByaXZhY3ksIGFuZA0KICAgcmVkdWNlZCBsYXRlbmN5IHdoZW4gY29tcGFyZWQg dG8gZWFybGllciB2ZXJzaW9ucyBvZiBUTFMuICBUaGlzDQogICBkb2N1bWVudCB1cGRhdGVzIFJG QyA1MjE2Lg0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgDQoNCg0KUGxlYXNlIG5vdGUgdGhh dCBpdCBtYXkgdGFrZSBhIGNvdXBsZSBvZiBtaW51dGVzIGZyb20gdGhlIHRpbWUgb2Ygc3VibWlz c2lvbg0KdW50aWwgdGhlIGh0bWxpemVkIHZlcnNpb24gYW5kIGRpZmYgYXJlIGF2YWlsYWJsZSBh dCB0b29scy5pZXRmLm9yZy4NCg0KVGhlIElFVEYgU2VjcmV0YXJpYXQNCg0KDQo= From nobody Fri Oct 19 03:32:34 2018 Return-Path: X-Original-To: emu@ietf.org Delivered-To: emu@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 05944130DC5; Fri, 19 Oct 2018 03:32:32 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: emu@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.87.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: emu@ietf.org Message-ID: <153994515282.31835.13831461056867724809@ietfa.amsl.com> Date: Fri, 19 Oct 2018 03:32:32 -0700 Archived-At: Subject: [Emu] I-D Action: draft-ietf-emu-rfc5448bis-03.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 10:32:33 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the EAP Method Update WG of the IETF. Title : Improved Extensible Authentication Protocol Method for 3rd Generation Authentication and Key Agreement (EAP-AKA') Authors : Jari Arkko Vesa Lehtovirta Vesa Torvinen Pasi Eronen Filename : draft-ietf-emu-rfc5448bis-03.txt Pages : 44 Date : 2018-10-19 Abstract: This specification defines an EAP method, EAP-AKA', a small revision of the EAP-AKA method. EAP-AKA' provides a key derivation function that binds the keys derived within the method to the name of the access network. The key derivation mechanism has been defined in the 3rd Generation Partnership Project (3GPP). This specification allows its use in EAP in an interoperable manner. In addition, EAP-AKA' employs SHA-256 instead of SHA-1. This specification also updates RFC 4187 EAP-AKA to prevent bidding down attacks from EAP-AKA'. This version of the EAP-AKA' specification provides updates to specify the protocol behaviour for 5G deployments as well. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-emu-rfc5448bis/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-emu-rfc5448bis-03 https://datatracker.ietf.org/doc/html/draft-ietf-emu-rfc5448bis-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-emu-rfc5448bis-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Oct 19 03:34:34 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53047130EBC for ; Fri, 19 Oct 2018 03:34:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VgDCtJFcvSIT for ; Fri, 19 Oct 2018 03:34:29 -0700 (PDT) Received: from p130.piuha.net (p130.piuha.net [193.234.218.130]) by ietfa.amsl.com (Postfix) with ESMTP id CF0F2128BAC for ; Fri, 19 Oct 2018 03:34:28 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id D90786601FE for ; Fri, 19 Oct 2018 13:34:27 +0300 (EEST) Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E5RpUwBlmhGz for ; Fri, 19 Oct 2018 13:34:25 +0300 (EEST) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2001:14b8:1829::130]) by p130.piuha.net (Postfix) with ESMTPS id E06CC6600CD for ; Fri, 19 Oct 2018 13:34:25 +0300 (EEST) From: Jari Arkko Content-Type: multipart/alternative; boundary="Apple-Mail=_64F4DFE0-4B5C-4791-8A72-CC77253F1F72" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Message-Id: <8D9994B6-89F7-406B-A09A-2ABD81B9220E@piuha.net> References: <153994515316.31835.12174180371391998960.idtracker@ietfa.amsl.com> To: emu@ietf.org Date: Fri, 19 Oct 2018 13:34:24 +0300 X-Mailer: Apple Mail (2.3273) Archived-At: Subject: [Emu] Fwd: New Version Notification for draft-ietf-emu-rfc5448bis-03.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 10:34:33 -0000 --Apple-Mail=_64F4DFE0-4B5C-4791-8A72-CC77253F1F72 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 FYI This version is better in sync with current 3GPP =E2=80=98CT=E2=80=99 = group specifications. Jari > From: internet-drafts@ietf.org > Subject: New Version Notification for draft-ietf-emu-rfc5448bis-03.txt > Date: 19 October 2018 at 13.32.33 GMT+3 >=20 > A new version of I-D, draft-ietf-emu-rfc5448bis-03.txt > has been successfully submitted by Jari Arkko and posted to the > IETF repository. >=20 > Name: draft-ietf-emu-rfc5448bis > Revision: 03 > Title: Improved Extensible Authentication Protocol = Method for 3rd Generation Authentication and Key Agreement (EAP-AKA') > Document date: 2018-10-19 > Group: emu > Pages: 44 > URL: = https://www.ietf.org/internet-drafts/draft-ietf-emu-rfc5448bis-03.txt > Status: = https://datatracker.ietf.org/doc/draft-ietf-emu-rfc5448bis/ > Htmlized: = https://tools.ietf.org/html/draft-ietf-emu-rfc5448bis-03 > Htmlized: = https://datatracker.ietf.org/doc/html/draft-ietf-emu-rfc5448bis > Diff: = https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-emu-rfc5448bis-03 >=20 > Abstract: > This specification defines an EAP method, EAP-AKA', a small revision > of the EAP-AKA method. EAP-AKA' provides a key derivation function > that binds the keys derived within the method to the name of the > access network. The key derivation mechanism has been defined in = the > 3rd Generation Partnership Project (3GPP). This specification = allows > its use in EAP in an interoperable manner. In addition, EAP-AKA' > employs SHA-256 instead of SHA-1. >=20 > This specification also updates RFC 4187 EAP-AKA to prevent bidding > down attacks from EAP-AKA'. >=20 > This version of the EAP-AKA' specification provides updates to > specify the protocol behaviour for 5G deployments as well. >=20 >=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > The IETF Secretariat >=20 --Apple-Mail=_64F4DFE0-4B5C-4791-8A72-CC77253F1F72 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 FYI

This = version is better in sync with current 3GPP =E2=80=98CT=E2=80=99 group = specifications.

Jari

From: = internet-drafts@ietf.org
Subject: = New Version = Notification for draft-ietf-emu-rfc5448bis-03.txt
Date: = 19 October 2018 at 13.32.33 = GMT+3

A new version of I-D, = draft-ietf-emu-rfc5448bis-03.txt
has been successfully = submitted by Jari Arkko and posted to the
IETF = repository.

Name: = draft-ietf-emu-rfc5448bis
Revision: 03
Title:= = Improved Extensible Authentication Protocol Method for 3rd = Generation Authentication and Key Agreement (EAP-AKA')
Document date: 2018-10-19
Group:= = emu
Pages: 44
URL: =            https://www.ietf.org/internet-drafts/draft-ietf-emu-rfc5448bis-= 03.txt
Status: =         https://datatracker.ietf.org/doc/draft-ietf-emu-rfc5448bis/=
Htmlized:       https://tools.ietf.org/html/draft-ietf-emu-rfc5448bis-03Htmlized:       https://datatracker.ietf.org/doc/html/draft-ietf-emu-rfc5448bis=
Diff: =           https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-emu-rfc5448bis-0= 3

Abstract:
=   This specification defines an EAP method, EAP-AKA', a small = revision
  of the EAP-AKA method. =  EAP-AKA' provides a key derivation function
=   that binds the keys derived within the method to the name of = the
  access network.  The key derivation = mechanism has been defined in the
  3rd = Generation Partnership Project (3GPP).  This specification = allows
  its use in EAP in an interoperable = manner.  In addition, EAP-AKA'
  employs = SHA-256 instead of SHA-1.

  This = specification also updates RFC 4187 EAP-AKA to prevent bidding
  down attacks from EAP-AKA'.

  This version of the EAP-AKA' specification = provides updates to
  specify the protocol = behaviour for 5G deployments as well.




Please note that it may take a = couple of minutes from the time of submission
until the = htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat


= --Apple-Mail=_64F4DFE0-4B5C-4791-8A72-CC77253F1F72-- From nobody Fri Oct 19 11:59:23 2018 Return-Path: X-Original-To: emu@ietf.org Delivered-To: emu@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CADD13103F; Fri, 19 Oct 2018 11:56:30 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , Cc: ekr@rtfm.com, emu@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.87.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153997539004.6592.10389709587194556990.idtracker@ietfa.amsl.com> Date: Fri, 19 Oct 2018 11:56:30 -0700 Archived-At: Subject: [Emu] emu - Requested session has been scheduled for IETF 103 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 18:56:37 -0000 Dear Mohit Sethi, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. emu Session 1 (2:00 requested) Monday, 5 November 2018, Afternoon Session II 1610-1810 Room Name: Boromphimarn 1/2 size: 75 --------------------------------------------- iCalendar: https://datatracker.ietf.org/meeting/103/sessions/emu.ics Request Information: --------------------------------------------------------- Working Group Name: EAP Method Update Area Name: Security Area Session Requester: Mohit Sethi Number of Sessions: 1 Length of Session(s): 2 Hours Number of Attendees: 50 Conflicts to Avoid: First Priority: saag tls cfrg lwig Second Priority: curdle uta secdispatch oauth Third Priority: sacm quic kitten bier acme People who must be present: Eric Rescorla Jari Arkko Joseph A. Salowey John Mattsson Mohit Sethi Resources Requested: Special Requests: --------------------------------------------------------- From nobody Sat Oct 20 07:42:42 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A71BE12F1A5; Sat, 20 Oct 2018 07:42:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nvanginBRqsk; Sat, 20 Oct 2018 07:42:29 -0700 (PDT) Received: from aer-iport-1.cisco.com (aer-iport-1.cisco.com [173.38.203.51]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B4881200D7; Sat, 20 Oct 2018 07:42:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=16136; q=dns/txt; s=iport; t=1540046548; x=1541256148; h=references:subject:to:cc:from:message-id:date: mime-version:in-reply-to; bh=+IhH208hXb19gtVshE88fSycbu42xXGwOHp5J0XN80g=; b=a5TQOp/i/ul4nHgBjuP3cx3jJWC3HZDwbe0IN6+LXtthR60RMClDONGw 87t4FhVAS3v3ZNNmBdRyeep0ZSMckmZKXlt/JSBBT5+Syc/PUccQPM1hO 9SuDmzI3sUT1vA9rJPJu05hDb64X3M7hrAO/RhQ/XYtPnF/X4eLfRg+ij 4=; X-Files: signature.asc : 488 X-IronPort-AV: E=Sophos;i="5.54,404,1534809600"; d="asc'?eml'208?scan'208,208,217";a="7392481" Received: from aer-iport-nat.cisco.com (HELO aer-core-2.cisco.com) ([173.38.203.22]) by aer-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 20 Oct 2018 14:42:26 +0000 Received: from [10.61.201.80] ([10.61.201.80]) by aer-core-2.cisco.com (8.15.2/8.15.2) with ESMTP id w9KEgPbt017261; Sat, 20 Oct 2018 14:42:25 GMT References: <154004580158.13697.488879931982830841.idtracker@ietfa.amsl.com> To: "opsawg@ietf.org" Cc: Michael Richardson , "Owen Friel (ofriel)" , Anima WG , Christian Huitema , Kent Watsen , emu@ietf.org From: Eliot Lear Openpgp: preference=signencrypt Autocrypt: addr=lear@cisco.com; prefer-encrypt=mutual; keydata= xsBNBFMe1UQBCADdYOS5APDpIpF2ohAxB+nxg1GpAYr8iKwGIb86Wp9NkK5+QwbW9H035clT lpVLciExtN8E3MCTPOIm7aITPlruixAVwlBY3g7U9eRppSw9O2H/7bie2GOnYxqmsw4v1yNZ 9NcMLlD8raY0UcQ5r698c8JD4xUTLqybZXaK2sPeJkxzT+IwupRSQ+vXEvFFGhERQ88zo5Ca Sa1Gw/Rv54oH0Dq2XYkO41rhxQ60BKZLZuQK1d9+1y3I+An3AJeD3AA31fJZD3H8YRKOBgqe ILPILbw1mM7gCtCjfvFCt6AFCwEsjITGx55ceoQ+t5B5XGYJEppMWsIFrwZsfbL+gP31ABEB AAHNJUVsaW90IExlYXIgPGxlYXJAb2Zjb3Vyc2VpbXJpZ2h0LmNvbT7CwJEEEwECADsCGwMC HgECF4ACGQEWIQSY0L2QRh2wkqeyYR2HtmtG2dJ6MwUCWxJwMwULCQgHAgYVCAkKCwIEFgID AQAKCRCHtmtG2dJ6MyMyCACXvtFjAYGMtOkD9MD4nI3ifFpkrj8xTMbXjrv5hdqmzRmQ0wqA 1U/OlZux+P/NaVMiZNZc8zw0nsx/INAqDOVd4/tLWF+ywTkeRFR0VnaUxLwCReZAZOaRS+md +52u/6ddoFja2RnjZ43qbbuvVUARQVIyMJz+GbR6mEZQHR0psD7dDYZDyrpivCxm8zHQwmB6 AZUlO7OJgljDvVPVDCabg/ZnJw1qS0OzSiNb0MySk1D5A7FdwDgeKxuMYUOOoVVTTMWNWcME UkRX9LxElswEt0PQWiz/j3FYXTxiFfl/1vKcHx4pM+E5C5mhTbrdFUFLJC3Y5fLID7stK/Ch aEaBzsBNBFMe1UQBCAC0WV7Ydbv95xYGPhthTdChBIpPtl7JPCV/c6/3iEmvjpfGuFNaK4Ma cj9le20EA5A1BH7PgLGoHOiPM65NysRpZ96RRVX3TNfLmhGMFr5hPOGNdq+xcGHVutmwPV9U 7bKeUNRiPFx3YdEkExddqV2E8FltT0x2FSKe2xszPPHB6gVtMckX5buI9p1K3fbVhXdvEkcY Y/jB0JEJGyhS5aEbct5cHUvDAkT81/YFK5Jfg8RRwu1q1t1YuIJSOWAZQ9J9oUsg6D9RpClU +tIFBoe3iTp1AUfJcypucGKgLYKtpu/aygcpQONHYkYW5003mPsrajFhReVF5veycMbHs4u5 ABEBAAHCwF8EGAECAAkFAlMe1UQCGwwACgkQh7ZrRtnSejOSuQgA27p2rYB7Kh20dym6V8c6 2pWpBHHTgxr/32zevxHSiXl6xvUCg5T8WUwfUk8OvgDcBErK/blDAMXQzSg3sp450JhR8RnX HXF5Zz2T04X7HnlIVJGwf2CjnwyEAJCqMzaCmI+g3Imvg/8L4nyBFvhlFHDv+kIvMiujyycj PAu7xxKplBs1/IEwmDoAMjneFmawvfeQnwdMhSKK8PjKSuzGU5uUmxj3GBfRqvTM0qpmhMPF OmDhJSmH55HLAky2MlmqJYXJPt/9EfSEhFiua1M6gLiuNEuPkp+8jcnHQqKr0IeHt8UqcwLt 2mGfIyl0FVdF9hvWPjNRzGbgqoT1Di03RQ== X-Forwarded-Message-Id: <154004580158.13697.488879931982830841.idtracker@ietfa.amsl.com> Message-ID: Date: Sat, 20 Oct 2018 16:42:24 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <154004580158.13697.488879931982830841.idtracker@ietfa.amsl.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="n5ODYPsUfcbDS7BGKzW0ipxdg72zW7aXN" X-Outbound-SMTP-Client: 10.61.201.80, [10.61.201.80] X-Outbound-Node: aer-core-2.cisco.com Archived-At: Subject: [Emu] Fwd: New Version Notification for draft-lear-brski-pop-00.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Oct 2018 14:42:33 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --n5ODYPsUfcbDS7BGKzW0ipxdg72zW7aXN Content-Type: multipart/mixed; boundary="QWZ1bjlDIfz4Y2j90TYZiyYdP5kytCM4l"; protected-headers="v1" From: Eliot Lear To: "opsawg@ietf.org" Cc: Michael Richardson , "Owen Friel (ofriel)" , Anima WG , Christian Huitema , Kent Watsen , emu@ietf.org Message-ID: Subject: Fwd: New Version Notification for draft-lear-brski-pop-00.txt References: <154004580158.13697.488879931982830841.idtracker@ietfa.amsl.com> In-Reply-To: <154004580158.13697.488879931982830841.idtracker@ietfa.amsl.com> --QWZ1bjlDIfz4Y2j90TYZiyYdP5kytCM4l Content-Type: multipart/mixed; boundary="------------949FFF619DBD569EFBD81152" Content-Language: en-US This is a multi-part message in MIME format. --------------949FFF619DBD569EFBD81152 Content-Type: multipart/alternative; boundary="------------E4BD44975B6F3CA35D46834B" --------------E4BD44975B6F3CA35D46834B Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable As promised, here is a draft that attempts to wangle BRSKI to allow for proof of possession tests.=C2=A0 This is very early work and intended for= discussion at this point during OPSAWG and at the side meeting we have scheduled for Tuesday night.=C2=A0 If people like what they see, we can discuss in more detail in Prague. This draft includes three specific test types, one of which may come out Real Soon: 1. The registrar has obtained proof of possession and provides that proof to the MASA.=C2=A0 This solves a wireless case. 2. The registrar has obtained proof of possession and, rather than providing proof to the MASA, provides proof to the pledge (two-party instead of three). 3. The registrar tells the MASA, =E2=80=9CTrust Me!=C2=A0 Really!=E2=80=9D= in its best Joe Isuzu voice*.=C2=A0 (This may be redundant, which is why it may come = out.) Discussion points: * The basis of all of this work is really that Max, Michael, and Kent did a bang up job by coming up with the voucher concept, and so let's all agree PLEASE that no matter how we slice it, a voucher request needs to be generated, and a voucher response needs to be delivered.=C2=A0 The means for proof, and even the identity returned,= can be stretched. * Should we stretch further, and include different keying material objects?=C2=A0 I'm CCing EAP folk because that is a big fat question = for them. Eliot * See https://www.youtube.com/watch?v=3DmR361ASrMew --------------E4BD44975B6F3CA35D46834B Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

As promised, here is a draft that attempts to wangle BRSKI to allow for proof of possession tests.=C2=A0 This is very early work = and intended for discussion at this point during OPSAWG and at the side meeting we have scheduled for Tuesday night.=C2=A0 If people l= ike what they see, we can discuss in more detail in Prague.

This draft includes three specific test types, one of which may come out Real Soon:

  1. The registrar has obtained proof of possession and provides that proof to the MASA.=C2=A0 This solves a wireless case.
  2. The registrar has obtained proof of possession and, rather than providing proof to the MASA, provides proof to the pledge (two-party instead of three).
  3. The registrar tells the MASA, =E2=80=9CTrust Me!=C2=A0 Really!=E2= =80=9D in its best Joe Isuzu voice*.=C2=A0 (This may be redundant, which is why it m= ay come out.)

Discussion points:

  • The basis of all of this work is really that Max, Michael, and Kent did a bang up job by coming up with the voucher concept, and so let's all agree PLEASE that no matter how we slice it, a voucher request needs to be generated, and a voucher response needs to be delivered.=C2=A0 The means for proof, and even the identity returned, can be stretched.
  • Should we stretch further, and include different keying material objects?=C2=A0 I'm CCing EAP folk because that is a big = fat question for them.

Eliot

* See https://www.youtube.com/watch?v=3DmR361ASrM= ew


--------------E4BD44975B6F3CA35D46834B-- --------------949FFF619DBD569EFBD81152 Content-Type: message/rfc822; name="New Version Notification for draft-lear-brski-pop-00_txt.eml" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename*0="New Version Notification for draft-lear-brski-pop-00_txt.eml" X-Mozilla-Keys: Received: from xch-rtp-005.cisco.com (64.101.220.145) by xch-aln-005.cisco.com (173.36.7.15) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Mailbox Transport; Sat, 20 Oct 2018 09:30:10 -0500 Received: from xch-rtp-015.cisco.com (64.101.220.155) by XCH-RTP-005.cisco.com (64.101.220.145) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sat, 20 Oct 2018 10:30:10 -0400 Received: from xch-rtp-010.cisco.com (64.101.220.150) by XCH-RTP-015.cisco.com (64.101.220.155) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sat, 20 Oct 2018 10:30:09 -0400 Received: from rcdn-iport-2.cisco.com (173.37.86.73) by mail.cisco.com (64.101.220.150) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Sat, 20 Oct 2018 10:30:09 -0400 Received: from rcdn-core-9.cisco.com ([173.37.93.145]) by rcdn-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 20 Oct 2018 14:30:07 +0000 Received: from alln-inbound-a.cisco.com (alln-inbound-a.cisco.com [173.37.147.231]) by rcdn-core-9.cisco.com (8.15.2/8.15.2) with ESMTPS id w9KEU2Oi016011 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 20 Oct 2018 14:30:07 GMT Received-SPF: Pass (alln-inbound-a.cisco.com: domain of internet-drafts@ietf.org designates 2001:1900:3001:11::2c as permitted sender) identity=mailfrom; client-ip=2001:1900:3001:11::2c; receiver=alln-inbound-a.cisco.com; envelope-from="internet-drafts@ietf.org"; x-sender="internet-drafts@ietf.org"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:4.31.198.32/27 ip6:2001:1900:3001:0011::0/64 ip4:66.70.182.38 ip4:158.69.166.16/29 ip6:2607:5300:203:1b26::0/64 ip4:158.69.229.207 ip4:192.95.54.40/29 ip6:2607:5300:0060:9ccf::0/64 -all" Received-SPF: None (alln-inbound-a.cisco.com: no sender authenticity information available from domain of postmaster@mail.ietf.org) identity=helo; client-ip=2001:1900:3001:11::2c; receiver=alln-inbound-a.cisco.com; envelope-from="internet-drafts@ietf.org"; x-sender="postmaster@mail.ietf.org"; x-conformance=spf_only Authentication-Results: alln-inbound-a.cisco.com; dkim=none (message not signed) header.i=none; spf=Pass smtp.mailfrom=internet-drafts@ietf.org; spf=None smtp.helo=postmaster@mail.ietf.org; dmarc=pass (p=none dis=none) d=ietf.org X-from-outside-Cisco: 2001:1900:3001:11::2c IronPort-PHdr: =?us-ascii?q?9a23=3A3currhfTZbkiTntkB675MpEOlGMj4u6mDksu8p?= =?us-ascii?q?Mizoh2WeGdxcS4Yh7h7PlgxGXEQZ/co6odzbaO7Oa4ASQp2tWoiDg6aptCVh?= =?us-ascii?q?sI2409vjcLJ4q7M3D9N+PgdCcgHc5PBxdP9nC/NlVJSo6lPwWB6nK94iQPFR?= =?us-ascii?q?rhKAF7Ovr6GpLIj8Swyuu+54Dfbx9HiTahY75+Ngm6oRnMvcQKnIVuLbo8xA?= =?us-ascii?q?HUqXVSYeRWwm1oJVOXnxni48q74YBu/SdNtf8/7sBMSar1cbg2QrxeFzQmLn?= =?us-ascii?q?s65Nb3uhnZTAuA/WUTX2MLmRdVGQfF7RX6XpDssivms+d2xSeXMdHqQb0yRD?= =?us-ascii?q?+v9LlgRgP2hygbNj456GDXhdJ2jKJHuxKquhhzz5fJbI2JKPZye6XQds4YS2?= =?us-ascii?q?VcRMZcTyNODZ+zYYUPEeQPIP5YopLhp1YMsReyGRWgCP/txzJOm3T43bc60+?= =?us-ascii?q?MkEQze3QwgGc4Ov2rOrNXzKqgSTfm5w7TSzTrZYfNWxSz95ZPJch8/vfGMU6?= =?us-ascii?q?h8cc3LyUkgEQ7Ok1ueqYvgPzyP1+QNtXCW7+t+WuKzhW4rsQZxoiKgxsoql4?= =?us-ascii?q?LHhZoVx0ja+Sll3Io5ONi1RFN/bNK4DJddsi+XO5dqTs8/RmxkpTs2x7gDtJ?= =?us-ascii?q?KlYCcHzoksyQTFZPydaYeI5wruVOaPLjd8g3JoYLe/iAyz8Uik0OH8V9e70E?= =?us-ascii?q?pEriZfldnMrH8N2wTS6siBVPR94l+s1SiT2wzP9+1JJF04mK7HJ5I9x7M9mI?= =?us-ascii?q?YfvVjeEiLzhUn6kaqbe0A69ue08+jnZ6/ppp6YN496kAH+NaEul9S+AeQ+Lg?= =?us-ascii?q?gBQXKb+eKi273/5EH2Xa9Kgec4kqnFq5DXPsUbqbClAw9byIoj7Ay/Dzi+3N?= =?us-ascii?q?QCgXYHNE5FeA6Aj4XxP1HBPur3De2kjluwkTdr3OzJPrr7DprRKXjDla/rfa?= =?us-ascii?q?xh5E5E1Aoz0ddf6opTCrEPOvLzW1H+tNjDAxAlMgy02ProCNJn2owCXmKPB/?= =?us-ascii?q?zRDKSH+3KM5+Uza82BbZVf8GL5JvE/z/XvlnQ+31QaeP/tldEwd32+Vtp8Ik?= =?us-ascii?q?idKzK4hdkbEGoOlgE/V+ftzlaFVGgASWy1Wvc94C02EoSrEcLPXImjnKep3S?= =?us-ascii?q?qnENtRfG8VWRi3DX70etDcCL83YyWIL5oky2RcCOqNbqYb/kj16l2ij5ZiJ/?= =?us-ascii?q?DfwCATsojvhpBtsuvUkxx2vSR/E5HEiznJB3psyydATjM13aUquwg1w0yb3/?= =?us-ascii?q?1ix7RCCNUG1LMGXgIzL5XrxuN1I877XgOHc9KASVLpBp3/WW1hE41vm55KKw?= =?us-ascii?q?YyF9CrlBuGxSeyBKUJv72GGJJy9bjTkDy5fp4hmyuZivFguh0gRc1Cbzf0r7?= =?us-ascii?q?Nj9wXVG4/CmlmYkKDvT6kHwSrR7z3bkDiHuEVeFQ92W6LYW3xabw3drM/y4Q?= =?us-ascii?q?XJSLr9QbgkMw4Uz8mEJ+MKb9DyllxJSb/lP8iWeGO+nWq8RF6Iy7qAYZCsej?= =?us-ascii?q?Ab2yPQWwAfiw5GxX+dLkAlAzu55WfXDThgD1XqNkLq7eRkrn6nC0Muxg+WdG?= =?us-ascii?q?Vg2qa7vBkPiq/UUOsdi5QDvippsDBoBBC90tbRXsKHvBZkdb5AbMkV5V5G0S?= =?us-ascii?q?TYuhBzeJu6IPMqilsXaQ8ip0r1zF03EtBGls4n5H8r1190LqSVkRtNIjKVwZ?= =?us-ascii?q?62PafYczOgxh2kZq/I112b6+64p/dXuswxsE6r/AitEkxn8nNt1MRT3z6VoJ?= =?us-ascii?q?7LFwEVF5n2VxR/+x9/rrDcKi4zguGcnXxqLaSutDLent4zDeU50T6hcstRdq?= =?us-ascii?q?SeG0f+HtYbCM6nNOEx0wLxNktWZbEKrPxvZ5v/JaLfivzxN65ph1fExSxf7Z?= =?us-ascii?q?p4016Q+iY0UePO05sfgrmZ0gaBSzbgnQKku8Hzl5pDYGJ3fCL3wizlCYhNI6?= =?us-ascii?q?xqKNxTUT78epzvnocl38a0CScBpgz5DABjuofhYxeZYl3j0BcF3EATpzmmny?= =?us-ascii?q?G/0jp41jhvpauE1yuIyOPnJ39lciZGQndviVD0LM26ldcfCQKpaRQkjh2o+Q?= =?us-ascii?q?P23aFVuL9XLmTPTwFPZSe8fAQAGuOg86GPZcJC8sZisCNLXf66bEzfRqT0rQ?= =?us-ascii?q?cB+yLuA2UYwyo0PWLiqtDymBp0j3iYJXB4oS/CYc9HwhHb9Y+5J7YZzn8cSS?= =?us-ascii?q?J/kzWSGkmkMozj44CPj5ma+LP2Rye7W5ZUayWu0Y6QqH7x+zhxGRPm+pL70t?= =?us-ascii?q?z/TVpml3SikYA7BWOT9lGmPcHqz/roa7o/JxsxVQekuZEiQtgsytNp3cNCgT?= =?us-ascii?q?9E2vD3tTIGiTuhb4sdhvq4NSpXA2Vbi9/NvFq8hR0lcCPPntynECzDhZEwAr?= =?us-ascii?q?vyKmIOhHBnsZgVWvrPtOQWx3Mu8AOy91yDM6A6wGtVyONyuidH06dX6Ux3lH?= =?us-ascii?q?TbWOhNeCsQdS30y0bRvor4/fgROTrpLeD3jhs2nMj/Xuvc+l4OBS2hIsV6RX?= =?us-ascii?q?EovJR0O1yegiW0tN2sPdDUaZhK7E+unhzNjvZYJNcKrtRR33I1H2X7sDVlwu?= =?us-ascii?q?o/i1lv25u9oY6Lbmwr96OiCRkePTrwNYsV/Xn2gKBSk9zzvcjnF4h9GjgNQJ?= =?us-ascii?q?rjTO65WDMUu/P9Mg+SETo64n6FELvbFAWb5Q9otXXKW5ysMniWIjEew7AADF?= =?us-ascii?q?GFI1dDhQkPQDggtpswFwTsxcH9fgF+/D9Qrl/0px1Qy/55YhnyVmCMwWXgIj?= =?us-ascii?q?wwSZWZMF9X9lQYvx+MY5XPtrohRHkAp8/49V7fcGfIAmYARXsEUUGFGV35a7?= =?us-ascii?q?Cq4d+F8u6SAfe4I77HJ76PsudZEfyPwMHKsMMu8jCSO8GIJnQnAec83x8JXH?= =?us-ascii?q?ZlFt7flilKRzYemT7WR8+WuBn6/Td45JPakryjSEf06I2DBqEHe81o4AyziL?= =?us-ascii?q?yfOvS4gS94LXBZ248Cg3jSx/JMlE5XgCZoeT63FL0GviOYV7rerahRCw9COn?= =?us-ascii?q?FDcfBQ5qd55TFjfMvSi9f7zLl916ZnClpZWxrmgM77PJVXcVH4D0vOAQOwDJ?= =?us-ascii?q?rDJTDPxJiqM6a1SLkWjehIuVu3oznJS0I=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A8FTAACUOstbfQAZASCDgISAEQAsZB4?= =?us-ascii?q?BBgcGgVEJCwGBMAFQaXAECyiDdYh3izyFTJNWgXoNExAJAoQ+hQsZBwE0DQ0?= =?us-ascii?q?BAwEBAQEBAQEBAQECEAEBCRYITAyCNiQBDy8cPgEBAQEBAScBAQEBAQEjAkQ?= =?us-ascii?q?2IFQRJgImAgIDRBYBF4MdgSBiBAqlYIEuhDACDECDc4ErgQuIA4JEgheBEYM?= =?us-ascii?q?SgxsBAQIBAYF6gmaCVwKJAoVIQjKPCgmGYooQF4FSTIQniWmMWIoFgUOCDn0?= =?us-ascii?q?igw0JixCFXk8BgQaKZAEB?= X-IPAS-Result: =?us-ascii?q?A8FTAACUOstbfQAZASCDgISAEQAsZB4BBgcGgVEJCwGBM?= =?us-ascii?q?AFQaXAECyiDdYh3izyFTJNWgXoNExAJAoQ+hQsZBwE0DQ0BAwEBAQEBAQEBA?= =?us-ascii?q?QECEAEBCRYITAyCNiQBDy8cPgEBAQEBAScBAQEBAQEjAkQ2IFQRJgImAgIDR?= =?us-ascii?q?BYBF4MdgSBiBAqlYIEuhDACDECDc4ErgQuIA4JEgheBEYMSgxsBAQIBAYF6g?= =?us-ascii?q?maCVwKJAoVIQjKPCgmGYooQF4FSTIQniWmMWIoFgUOCDn0igw0JixCFXk8Bg?= =?us-ascii?q?QaKZAEB?= X-IronPort-AV: E=Sophos;i="5.54,404,1534809600"; d="scan'208";a="117908310" X-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown Received: from mail.ietf.org ([IPv6:2001:1900:3001:11::2c]) by alln-inbound-a.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 20 Oct 2018 14:30:02 +0000 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 904C712F1A5; Sat, 20 Oct 2018 07:30:01 -0700 (PDT) Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: To: Eliot Lear , Owen Friel Subject: New Version Notification for draft-lear-brski-pop-00.txt X-Test-IDTracker: no X-IETF-IDTracker: 6.87.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <154004580158.13697.488879931982830841.idtracker@ietfa.amsl.com> Date: Sat, 20 Oct 2018 07:30:01 -0700 X-Outbound-SMTP-Client: 173.37.147.231, alln-inbound-a.cisco.com X-Outbound-Node: rcdn-core-9.cisco.com Return-Path: internet-drafts@ietf.org X-MS-Exchange-Organization-AuthSource: XCH-RTP-010.cisco.com X-MS-Exchange-Organization-AuthAs: Internal X-MS-Exchange-Organization-AuthMechanism: 10 X-MS-Exchange-Organization-Network-Message-Id: 845ea357-f2a2-4c9c-ccc0-08d6369889d6 X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0 MIME-Version: 1.0 A new version of I-D, draft-lear-brski-pop-00.txt has been successfully submitted by Eliot Lear and posted to the IETF repository. Name: draft-lear-brski-pop Revision: 00 Title: Proof of Possession to Devices for Onboarding Document date: 2018-10-20 Group: Individual Submission Pages: 7 URL: https://www.ietf.org/internet-drafts/draft-lear-brski-pop-00.txt Status: https://datatracker.ietf.org/doc/draft-lear-brski-pop/ Htmlized: https://tools.ietf.org/html/draft-lear-brski-pop-00 Htmlized: https://datatracker.ietf.org/doc/html/draft-lear-brski-pop Abstract: This memo specifies a RESTful interface for local deployments to demonstrate proof of possession to a device or to a manufacturer authorized signing authority (MASA). This covers the case where a MASA would not otherwise have knowledge of where a device is deployed, or when a MASA may not be required. Such knowledge is important to onboard certain classes of devices, such as those on IEEE 802.11 networks. Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --------------949FFF619DBD569EFBD81152-- --QWZ1bjlDIfz4Y2j90TYZiyYdP5kytCM4l-- --n5ODYPsUfcbDS7BGKzW0ipxdg72zW7aXN Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlvLPtAACgkQh7ZrRtnS ejMD2QgAlqz2nPodc6IGVzLGmLBzH6hAUkb45JZb3DZpVDwUtb2YQVaIO5mxUOWk pW6uHT5q6RkxdF3GmAFxnj+txCNKhY6E5qpjBTE5wXtdQUY2/TSNuSHuPVcvd/qw ZcGnz9JrwN9klpG225TCyQjnDoJnT9ynR4pjXzM4q7KQ1U5RDwgekEBwsv8wkxo1 UgPWTlKQAkxoyZlnIrWEL7YEDTysB9dqKKlB67bNA3Was6A4iAuNYKFG48hg/4FS q2mtQhfxImudmPxszBVykDKzmme4uxvqO489zpRhh7WxQs0Het8pNQgK3COlOcBL 77JH31mHIV40eK2TRixUpWxEFyqZvA== =IyCJ -----END PGP SIGNATURE----- --n5ODYPsUfcbDS7BGKzW0ipxdg72zW7aXN-- From nobody Mon Oct 22 03:30:30 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE6B6130EF6 for ; Mon, 22 Oct 2018 03:30:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.365 X-Spam-Level: X-Spam-Status: No, score=-4.365 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=GKve0+mN; dkim=pass (1024-bit key) header.d=ericsson.com header.b=NjC9SQzP Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZVFxGmccctMb for ; Mon, 22 Oct 2018 03:30:25 -0700 (PDT) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 26B73130E1B for ; Mon, 22 Oct 2018 03:30:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/simple; q=dns/txt; i=@ericsson.com; t=1540204222; x=1542796222; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=eBJyChQJOCx/J7FmlrRFkK0+uu1126rf8AdV0plwjUk=; b=GKve0+mNFwChmrkRkOU0npGUEaEdMhe9NEho2HIunoaupnCysVhgYdilFWpIPWBF 4YCQXyfiuKsgD2QFbkhFjl6RL66yQItpi2WqFoy7ORefxQBwiQ1tZoJIWtZmy5HD WAnlf+bZAmbN11FH8hmrMDnJUWhsQL+DBRIugw3Rto0=; X-AuditID: c1b4fb2d-fb3d09e000003a27-2c-5bcda6be883b Received: from ESESSMB501.ericsson.se (Unknown_Domain [153.88.183.119]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id 9D.DD.14887.EB6ADCB5; Mon, 22 Oct 2018 12:30:22 +0200 (CEST) Received: from ESESBMB503.ericsson.se (153.88.183.170) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Mon, 22 Oct 2018 12:30:20 +0200 Received: from EUR01-VE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB503.ericsson.se (153.88.183.170) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Mon, 22 Oct 2018 12:30:20 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=eBJyChQJOCx/J7FmlrRFkK0+uu1126rf8AdV0plwjUk=; b=NjC9SQzPn0r1M1V7KYGSxdPbmqI75wEThlTedE8x3Zd3jhf2KM0sXB5FfAWAbuwRFM5d3vliwUTjJ/57+7wcdk/FcxoKZpGs9/PG5b0WsFSKPFShEob/ykTWi8XGiOE81jfvKYP38/sCQKFVFNk5aoXLPbrbD87qzJEMm1AdybM= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB1323.eurprd07.prod.outlook.com (10.164.52.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1273.13; Mon, 22 Oct 2018 10:30:16 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::fcb5:ca45:9e56:1910]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::fcb5:ca45:9e56:1910%2]) with mapi id 15.20.1273.014; Mon, 22 Oct 2018 10:30:16 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: New Version Notification for draft-ms-emu-eaptlscert-01.txt Thread-Index: AQHUafGpWK6hm593/k2fEzDJ2UEXf6UrMhSA Date: Mon, 22 Oct 2018 10:30:16 +0000 Message-ID: <9A389897-56F9-4B86-9E5E-2BFDDA730720@ericsson.com> References: <154020395409.15357.15616392638515918101.idtracker@ietfa.amsl.com> In-Reply-To: <154020395409.15357.15616392638515918101.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.11.0.180909 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR07MB1323; 6:+G0Mq9EMBetzMVCpCqwShLSLgjZb2nwGjVyySKvZUmNKS/J+AcRNG1DVAg7UBZrU1XNF+OkdYgolLKuhSW7HTosP/BIiEX55UHIun8jWegLvVsBaSr9wNH4HUDcLp1xJC/EdRV4ssZGmRO3mj/tOtYmIx8T9KvBMYiz/Yr6Z/5itXti3jbALQdjYP9j4XMVp8aiLsQJ8qdP2OMN9rmLg+q8wFs4n3z+FzayUwu65PwFrII+9rfBFUrrH5awUPVvTdsRkCtEB/BJ3CXg9q2IUqiguI+vxD2JMoVd2HbA49bSUwFKHR214fn1wRu9cPJyFvTYbxwpfwC7Ja7LVORx3fYPrxPN5ARAXAL+VnnYj7Nol3/gf2g1WvNRv232vLm6EOhuVFE5qCN+ph7EmQ+rFiYIfLi073TWcXUQNxzJj+WQNTC+xZqsyh4JeT8NtPKps8Ceq67DDEQUxNU7WTG1/uQ==; 5:/oXRtD1AAR0DxEjYLr7azkXT5g65bpc3Ge3xaL5MXB8cxyl15u1Gw4Kq6gU7dhFzeqTaPXE2icuXGjwKsRtlBKyrkeU8GulZ91Rbw69/JBuzTuh2VgJTcOteTXDkVkwVBckIxcYj/K9RdiWY23Q8l6yoCedYdfgZXWHdk4mKDI0=; 7:PtiG+Lrm2RQaW10aYcakRqBq/0jq5vx7QM3WBc07aKal5yJx8n4OCODcfKwA7L7X8a29Ys3RMewPOgrWMCIU0QyjY+q1JQGTzdLyOA/Q0b17JOPG2RnL77cAK38tuj2V+MFl9crSEYhsVNwk9Sv16A== x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 9fb096d8-b51f-4b81-7fc6-08d638095bd8 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989299)(5600074)(711020)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB1323; x-ms-traffictypediagnostic: HE1PR07MB1323: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(120809045254105)(192374486261705)(37575265505322)(248295561703944); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(3002001)(10201501046)(3231355)(944501410)(52105095)(93006095)(93001095)(148016)(149066)(150057)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(20161123562045)(20161123564045)(20161123560045)(201708071742011)(7699051)(76991095); SRVR:HE1PR07MB1323; BCL:0; PCL:0; RULEID:; SRVR:HE1PR07MB1323; x-forefront-prvs: 08331F819E x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(346002)(376002)(136003)(366004)(396003)(199004)(189003)(13464003)(229853002)(25786009)(53546011)(6506007)(76176011)(2906002)(97736004)(102836004)(4001150100001)(186003)(86362001)(26005)(53936002)(6916009)(99286004)(2351001)(106356001)(5250100002)(105586002)(66066001)(15650500001)(305945005)(5660300001)(6306002)(6116002)(3846002)(7736002)(33656002)(2501003)(476003)(2900100001)(82746002)(14454004)(14444005)(256004)(486006)(58126008)(2616005)(11346002)(478600001)(83716004)(71200400001)(71190400001)(44832011)(68736007)(966005)(6486002)(81156014)(8676002)(8936002)(81166006)(6512007)(446003)(5640700003)(1730700003)(2473003)(36756003)(6436002)(316002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB1323; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: T6lv+R/tASj8tCPJSWm/2xYYoD1noLqcKZGmbFLD0CqTVRTw5l6d49/8Zcd6ipm1er55WkenG3xot84wEeLV6rQe9pG9sze5grVaUuB+78X12VvWu46OJc2vdyZHS68ICGanFQJLeW+89PUDyN/FicO7ntDRAzUDGHw+ERoOO5bTbmdOIxTFgJTRTPyATyc3sdEgzsGBMsNFoNtTnUdU5Y7vQWFgIt2RN3WYFLj+yqQhiDHuiMFB8yrAecAVV6+e1hZ4eMrbFOItIt0sQW5NEr2u6yCruhC+In0hjW6MrYYNoooIGTxawoKHCY2WTkMaDxAdTYu+298hxANoUkLIRl5rE9wD10xjJt9rS0s0H0M= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <36096348FD3DC64395D61840A3E9F9A4@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 9fb096d8-b51f-4b81-7fc6-08d638095bd8 X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Oct 2018 10:30:16.5539 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB1323 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA02SXUhTYRjHfXfOmWfLwevUfLCUNtBy4GbahVD4cVMT/LrwIhWpoQcdzik7 U1sXMTE/UATJmSjpuhjhZ5aZlg2pVZqGGEqlg8AvELWlRtrSzHY8C7r7P//f/+F5npeXJqS3 qRBaqzcyBr1GJxeKybarIxVRYw+mc6LHXJFx4wP9ZCJS22y/BBkoW3wpn9FpyxmDKv66uHBg dwOVLofdeN5RRZrR79B6JKIBX4DdHSdVj8S0FL9FsP/1hy8HpHgPwdS8iQc2AXx+tyHkChI3 EWA5+C7kyR0BzO2bvcUyglX3E4LrF+Jo6LBzQEQHYhm4Z2uO/QCshsrGIc9A2uMnw3TnRV7G wHBDKpcgcThsvT5CnJbgBJh94RBwESlOA/NIOGeLcDo0fxk/jiB8En5O9Qk4TeBgcK5aBfxl GGz2GYLXQbC+8ofidBBWgXWxjuJ7c6G6upXiMzJ4P9blzYfCrLUBcVcB/iSErvFDkgdRsN3S 4g2lwtrUpIAPTSCY2Gr1AgV0LdkRr4tg8e6C1y+G+v5a77Qw6GlcIptQTPt/i7d77iRwJAyM qnhbDQfdRxSvZWBpWPJtP34Wf5hsWyXvI6oHBbEMyxYXxMQqGYM2j2VL9Eo9YxxEnr/xaugg 6hnq3UxyIEwjuZ9ku3k6R0ppyllTsQMBTcgDJd02jyXJ15huMoaSa4YyHcM60CmalAdLlD32 bCku0BiZIoYpZQz/qIAWhZhR5vyOUZmiHTwdsTK3GSAr/+bvEx8emh5x+YOr4gRqy6pS1348 o0haCxzepsWxqrUB95WwYR+XO7ek2Zg146zcf7rYSe31GUWZPspJ64Lk5UOr4laC7tH6RF7L 47rCnbNliSZnbmOE35uEe0nJYkuvZTQn7nBZkmFynUtJU9XISbZQc15BGFjNX3g0EdAXAwAA Archived-At: Subject: [Emu] FW: New Version Notification for draft-ms-emu-eaptlscert-01.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Oct 2018 10:30:29 -0000 SGksDQoNCldlIGhhdmUgc3VibWl0dGVkIGEgbmV3IHZlcnNpb24gb2YgdGhlIGRyYWZ0LiBUaGUg Y2hhbmdlcyBjb25jZXJuIHJlLW9yZ2FuaXphdGlvbiBvZiB0aGUgdGV4dCB0byBkaXN0aW5ndWlz aCB3aGljaCByZWNvbW1lbmRhdGlvbnMgcmVxdWlyZSBjaGFuZ2luZyBjZXJ0aWZpY2F0ZXMsIGFu ZCB3aGljaCByZXF1aXJlIGNoYW5naW5nIGNvZGUuIFdlIGFyZSBzb2xpY2l0aW5nIHRleHQgb24g Z3VpZGVsaW5lcyBmb3IgY2VydGlmaWNhdGVzIHVzZWQgaW4gRUFQLVRMUy4NCg0KQ29tbWVudHMg b24gdGhlIGNoYW5nZXMgYXMgd2VsbCBhcyByZXZpZXdzIG9mIHRoZSB3aG9sZSBkb2N1bWVudCBh cmUgdmVyeSB3ZWxjb21lLg0KDQpDaGVlcnMsDQpKb2huDQoNCu+7vy0tLS0tT3JpZ2luYWwgTWVz c2FnZS0tLS0tDQpGcm9tOiAiaW50ZXJuZXQtZHJhZnRzQGlldGYub3JnIiA8aW50ZXJuZXQtZHJh ZnRzQGlldGYub3JnPg0KRGF0ZTogTW9uZGF5LCAyMiBPY3RvYmVyIDIwMTggYXQgMTI6MjYNClRv OiBNb2hpdCBTZXRoaSA8bW9oaXRAcGl1aGEubmV0PiwgSm9obiBNYXR0c3NvbiA8am9obi5tYXR0 c3NvbkBlcmljc3Nvbi5jb20+DQpTdWJqZWN0OiBOZXcgVmVyc2lvbiBOb3RpZmljYXRpb24gZm9y IGRyYWZ0LW1zLWVtdS1lYXB0bHNjZXJ0LTAxLnR4dA0KDQoNCkEgbmV3IHZlcnNpb24gb2YgSS1E LCBkcmFmdC1tcy1lbXUtZWFwdGxzY2VydC0wMS50eHQNCmhhcyBiZWVuIHN1Y2Nlc3NmdWxseSBz dWJtaXR0ZWQgYnkgSm9obiBNYXR0c3NvbiBhbmQgcG9zdGVkIHRvIHRoZQ0KSUVURiByZXBvc2l0 b3J5Lg0KDQpOYW1lOgkJZHJhZnQtbXMtZW11LWVhcHRsc2NlcnQNClJldmlzaW9uOgkwMQ0KVGl0 bGU6CQlIYW5kbGluZyBMYXJnZSBDZXJ0aWZpY2F0ZXMgYW5kIExvbmcgQ2VydGlmaWNhdGUgQ2hh aW5zIGluIEVBUC1UTFMNCkRvY3VtZW50IGRhdGU6CTIwMTgtMTAtMjINCkdyb3VwOgkJSW5kaXZp ZHVhbCBTdWJtaXNzaW9uDQpQYWdlczoJCTcNClVSTDogICAgICAgICAgICBodHRwczovL3d3dy5p ZXRmLm9yZy9pbnRlcm5ldC1kcmFmdHMvZHJhZnQtbXMtZW11LWVhcHRsc2NlcnQtMDEudHh0DQpT dGF0dXM6ICAgICAgICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtbXMt ZW11LWVhcHRsc2NlcnQvDQpIdG1saXplZDogICAgICAgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9o dG1sL2RyYWZ0LW1zLWVtdS1lYXB0bHNjZXJ0LTAxDQpIdG1saXplZDogICAgICAgaHR0cHM6Ly9k YXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFmdC1tcy1lbXUtZWFwdGxzY2VydA0KRGlm ZjogICAgICAgICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1tcy1l bXUtZWFwdGxzY2VydC0wMQ0KDQpBYnN0cmFjdDoNCiAgIEV4dGVuc2libGUgQXV0aGVudGljYXRp b24gUHJvdG9jb2wgKEVBUCkgcHJvdmlkZXMgc3VwcG9ydCBmb3INCiAgIG11bHRpcGxlIGF1dGhl bnRpY2F0aW9uIG1ldGhvZHMuICBFQVAtVHJhbnNwb3J0IExheWVyIFNlY3VyaXR5IChFQVAtDQog ICBUTFMpIHByb3ZpZGVzIG1lYW5zIGZvciBrZXkgZGVyaXZhdGlvbiBhbmQgc3Ryb25nIG11dHVh bA0KICAgYXV0aGVudGljYXRpb24gd2l0aCBjZXJ0aWZpY2F0ZXMuICBIb3dldmVyLCBjZXJ0aWZp Y2F0ZXMgY2FuIG9mdGVuIGJlDQogICByZWxhdGl2ZWx5IGxhcmdlIGluIHNpemUuICBUaGUgY2Vy dGlmaWNhdGUgY2hhaW4gdG8gdGhlIHJvb3Qtb2YtdHJ1c3QNCiAgIGNhbiBhbHNvIGJlIGxvbmcg d2hlbiBtdWx0aXBsZSBpbnRlcm1lZGlhdGUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdGllcw0KICAg KENBcykgYXJlIGludm9sdmVkLiAgVGhpcyBpbXBsaWVzIHRoYXQgRUFQLVRMUyBhdXRoZW50aWNh dGlvbiBuZWVkcw0KICAgdG8gYmUgZnJhZ21lbnRlZCBpbnRvIG1hbnkgc21hbGxlciBwYWNrZXRz IGZvciB0cmFuc3BvcnRhdGlvbiBvdmVyDQogICB0aGUgbG93ZXItbGF5ZXIuICBTdWNoIGZyYWdt ZW50YXRpb24gY2FuIG5vdCBvbmx5IG5lZ2F0aXZlbHkgYWZmZWN0DQogICB0aGUgbGF0ZW5jeSwg YnV0IGFsc28gcmVzdWx0cyBpbiBpbXBsZW1lbnRhdGlvbiBjaGFsbGVuZ2VzLiAgRm9yDQogICBl eGFtcGxlLCBtYW55IGF1dGhlbnRpY2F0b3IgKGFjY2VzcyBwb2ludCkgaW1wbGVtZW50YXRpb25z IHdpbGwgZHJvcA0KICAgYW4gRUFQIHNlc3Npb24gaWYgaXQgaGFzbid0IGZpbmlzaGVkIGFmdGVy IDQwIC0gNTAgcGFja2V0cy4gIFRoaXMgY2FuDQogICByZXN1bHQgaW4gZmFpbGVkIGF1dGhlbnRp Y2F0aW9uIGV2ZW4gd2hlbiB0aGUgdHdvIGNvbW11bmljYXRpbmcNCiAgIHBhcnRpZXMgaGF2ZSB0 aGUgY29ycmVjdCBjcmVkZW50aWFscyBmb3IgbXV0dWFsIGF1dGhlbnRpY2F0aW9uLg0KICAgTW9y ZW92ZXIsIHRoZXJlIGFyZSBubyBtZWNoYW5pc21zIGF2YWlsYWJsZSB0byBlYXNpbHkgcmVjb3Zl ciBmcm9tDQogICBzdWNoIHNpdHVhdGlvbnMuICBUaGlzIG1lbW8gbG9va3MgYXQgdGhlIHByb2Js ZW0gaW4gZGV0YWlsIGFuZA0KICAgZGlzY3Vzc2VzIHRoZSBzb2x1dGlvbnMgYXZhaWxhYmxlIHRv IG92ZXJjb21lIHRoZXNlIGRlcGxveW1lbnQNCiAgIGNoYWxsZW5nZXMuDQoNCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICANCg0KDQpQbGVhc2Ugbm90ZSB0aGF0IGl0IG1heSB0YWtlIGEgY291cGxl IG9mIG1pbnV0ZXMgZnJvbSB0aGUgdGltZSBvZiBzdWJtaXNzaW9uDQp1bnRpbCB0aGUgaHRtbGl6 ZWQgdmVyc2lvbiBhbmQgZGlmZiBhcmUgYXZhaWxhYmxlIGF0IHRvb2xzLmlldGYub3JnLg0KDQpU aGUgSUVURiBTZWNyZXRhcmlhdA0KDQoNCg== From nobody Mon Oct 22 11:15:18 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A5FBB128CB7; Mon, 22 Oct 2018 11:15:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6ofjEEQI9ooT; Mon, 22 Oct 2018 11:15:08 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C21A7128B14; Mon, 22 Oct 2018 11:15:07 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 3F12F20008; Mon, 22 Oct 2018 14:15:02 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 891142363; Mon, 22 Oct 2018 14:15:04 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 87464235A; Mon, 22 Oct 2018 14:15:04 -0400 (EDT) From: Michael Richardson To: "opsawg\@ietf.org" , Anima WG reply-to: "opsawg\@ietf.org" , Anima WG , emu@ietf.org cc: Eliot Lear , "Owen Friel \(ofriel\)" , Christian Huitema , Kent Watsen , emu@ietf.org In-Reply-To: References: <154004580158.13697.488879931982830841.idtracker@ietfa.amsl.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Emu] Fwd: New Version Notification for draft-lear-brski-pop-00.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Oct 2018 18:15:11 -0000 --=-=-= Content-Type: text/plain Eliot, thanks for this document. If nothing else, it means that we BRSKI authors can deal with some review comments by pointing to "future work" :-) (A)"request-voucher-with-possession" <-- what about intent to traffic? :-) (for those that don't get the joke: https://criminal.findlaw.com/criminal-charges/possession-with-the-intent-to-distribute.html ) if leaf out-of-band-claim to be set by the PLEDGE? I think it is set by the Registar? The document sadly ends too soon... You say it is trying to do a few things. 1) deal with middle value pledge, (and low-value pledges in very congested places) where an out-of-band supply-chain integration is unavailable, and the MASA has a any-registar policy for the device. 2) provide a ship-and-forget mechanism. It seems that the cryptographic POP mechanism is an ends to accomplish a means, rather than a core goal of the protocol. The Pledge already can sign it's voucher-request, and since it includes the Registrar's key when it does a proximity assertion, it's pretty good proof of possession for the *Registrar*, but it might provide inadequate assurance to the MASA of it's freshness. If the MASA could provide a nonce for the pledge to sign (requiring another round trip, and even more online assurance), that would provide even more proof. Given that you pushed this out before today's cutoff, I am not upset that there is so few details. I am suspecting that in your thinking that you created the three objects, and realized that could accomplish "ship-and-forget" using a combination of them? I also wonder if cryptographic-POP is being confused with "proof of ownership", which I think is what you really want to accomplish. If one assumes some machine readable (QR) code that comes with the product, then there are a few things one can do to differently. One of the things that I have thought a lot about is that one uses the printed code in the Registrar to establish a relationship with the MASA. That is, one creates the supply-chain-integration by using the QR code with some zero-knowledge proof (I think that PAKE is the latest one) to establish that one is the legitimate Registrar for the product. One can do this as *any time* (some mumble about the lifetime of the CA of the Registrar's key), and the product will be enrolled correctly at any future time. About my joke (A) above, I think that ship-and-forget is an interesting goal, and in particular, if also may enable desireable "traffic"ing. That is, if the manufacturer can transfer the product to my ownership without any online interaction, then presumably, I can also *resell* the device to you using the same lack-of-interaction? ==== > In addition, some manufacturers may prefer not to require the > existence of a MASA. In these circumstances proof of possession to > the device is required. I would prefer that we split this into a different draft. I am very concerned that ship-and-forget is not a desireable property in the IoT space. It essentially means that the manufacturer has no further interest in providing any kind of updates for the device. I have serious cybersecurity concerns about such devices being out there (sitting unpatched and untracked in a warehouse somewhere), as well as significant environmental concerns about devices designed to die like this. I am trying to think of devices where this makes sense. I come up with a few things: single-use medical devices (like bandages, syringes, etc.), prophylactics and other single-use sex toys, things you eat, and some variety of devices that might be called "spy craft". In each case, I'm having difficulty knowing what the "smart" aspect of the product is, other than simply tracking it's existence and current stocking location. A smart package containing a dumb device is a good idea, but it seems like something that would be better recycled, and in any case, it's not ship-and-forget for the packaging. So this is why I think that splitting ship-and-forget mechanism into another document would let us treat it better. In particular, I want to know who is going to deploy using such mechanisms, and if they are at the table now. I guess I shall add a slide to my ANIMA BRSKI stack about this in an attempt to get feedback. I suspect that there is a category of devices that some think of being ship-and-forget which might actually be ship-to-holding-company. Holding company leases to end user for period of time. End user identity is never communicated back, and might be very much pseudonymous. I'm thinking about car-rentals, hotel rooms (full of devices), ... -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | network architect [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails [ -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAlvOE6gACgkQgItw+93Q 3WXBjwf/YCDdfvND1FAd/hb0dNClPGvFJPj6ykf4fKZK57Scyc86FXqP0j+OAzkp w9GCY/BCqnTja3i7L8fKiPfQ909Qz/bh+CSkMQsXdfBotjf38ZwUqT8VikRmG/Pu KmFxwq+EmXyt9UFRJl+qqpsebXoQbEeSGZ0pdqwZTpGXXkl5SOwCipUU/Ctw4iNd LGaPODL27gKhVn7QdCnXt0Wjy8zWZjiE6jnmUbmm7Sr5o7DgvZIVoJVj3PTufqY5 R4vMv+Yp/QafaiKCX6v9NdtC/Yet+tF7Kc2wtNEQEY6n8nBgIiKjRZDD5ZwWKdDT dVtGhHFKfuao+Wj0KzH0fyXUp+Jtfg== =mkhd -----END PGP SIGNATURE----- --=-=-=-- From nobody Mon Oct 22 11:44:28 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDDB4128766; Mon, 22 Oct 2018 11:44:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.971 X-Spam-Level: X-Spam-Status: No, score=-14.971 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.47, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SiExWrM_NdU0; Mon, 22 Oct 2018 11:44:24 -0700 (PDT) Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 74E5B1277C8; Mon, 22 Oct 2018 11:44:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=8900; q=dns/txt; s=iport; t=1540233864; x=1541443464; h=subject:to:cc:references:from:message-id:date: mime-version:in-reply-to; bh=iJgq7fQNNQ2HEHWSKNdePs+h7c/2Q3LF0l3EGjlOr+E=; b=FxfAuZ40zBxVA8W4ZM2amp6KzSPQz1c1bBDl7By4u9o4fZWglxBh3avE c3d67GpPNvkWQUoShswLPKndoIaujM/j7hH09nGs5BTBTMtB6n2EitHAB ZrlamQZf5fKWWcRMOMC/+n64FBE70CgrnytP0wtjkn7L9vEbjdNBp0CVF w=; X-Files: signature.asc : 488 X-IronPort-AV: E=Sophos; i="5.54,413,1534809600"; d="asc'?scan'208"; a="7389458" Received: from aer-iport-nat.cisco.com (HELO aer-core-1.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 Oct 2018 18:44:21 +0000 Received: from [10.61.232.53] ([10.61.232.53]) by aer-core-1.cisco.com (8.15.2/8.15.2) with ESMTP id w9MIiKMn020362; Mon, 22 Oct 2018 18:44:20 GMT To: "opsawg@ietf.org" , Anima WG , emu@ietf.org Cc: "Owen Friel (ofriel)" , Christian Huitema , Kent Watsen References: <154004580158.13697.488879931982830841.idtracker@ietfa.amsl.com> <30525.1540232104@localhost> From: Eliot Lear Openpgp: preference=signencrypt Autocrypt: addr=lear@cisco.com; prefer-encrypt=mutual; keydata= xsBNBFMe1UQBCADdYOS5APDpIpF2ohAxB+nxg1GpAYr8iKwGIb86Wp9NkK5+QwbW9H035clT lpVLciExtN8E3MCTPOIm7aITPlruixAVwlBY3g7U9eRppSw9O2H/7bie2GOnYxqmsw4v1yNZ 9NcMLlD8raY0UcQ5r698c8JD4xUTLqybZXaK2sPeJkxzT+IwupRSQ+vXEvFFGhERQ88zo5Ca Sa1Gw/Rv54oH0Dq2XYkO41rhxQ60BKZLZuQK1d9+1y3I+An3AJeD3AA31fJZD3H8YRKOBgqe ILPILbw1mM7gCtCjfvFCt6AFCwEsjITGx55ceoQ+t5B5XGYJEppMWsIFrwZsfbL+gP31ABEB AAHNJUVsaW90IExlYXIgPGxlYXJAb2Zjb3Vyc2VpbXJpZ2h0LmNvbT7CwJEEEwECADsCGwMC HgECF4ACGQEWIQSY0L2QRh2wkqeyYR2HtmtG2dJ6MwUCWxJwMwULCQgHAgYVCAkKCwIEFgID AQAKCRCHtmtG2dJ6MyMyCACXvtFjAYGMtOkD9MD4nI3ifFpkrj8xTMbXjrv5hdqmzRmQ0wqA 1U/OlZux+P/NaVMiZNZc8zw0nsx/INAqDOVd4/tLWF+ywTkeRFR0VnaUxLwCReZAZOaRS+md +52u/6ddoFja2RnjZ43qbbuvVUARQVIyMJz+GbR6mEZQHR0psD7dDYZDyrpivCxm8zHQwmB6 AZUlO7OJgljDvVPVDCabg/ZnJw1qS0OzSiNb0MySk1D5A7FdwDgeKxuMYUOOoVVTTMWNWcME UkRX9LxElswEt0PQWiz/j3FYXTxiFfl/1vKcHx4pM+E5C5mhTbrdFUFLJC3Y5fLID7stK/Ch aEaBzsBNBFMe1UQBCAC0WV7Ydbv95xYGPhthTdChBIpPtl7JPCV/c6/3iEmvjpfGuFNaK4Ma cj9le20EA5A1BH7PgLGoHOiPM65NysRpZ96RRVX3TNfLmhGMFr5hPOGNdq+xcGHVutmwPV9U 7bKeUNRiPFx3YdEkExddqV2E8FltT0x2FSKe2xszPPHB6gVtMckX5buI9p1K3fbVhXdvEkcY Y/jB0JEJGyhS5aEbct5cHUvDAkT81/YFK5Jfg8RRwu1q1t1YuIJSOWAZQ9J9oUsg6D9RpClU +tIFBoe3iTp1AUfJcypucGKgLYKtpu/aygcpQONHYkYW5003mPsrajFhReVF5veycMbHs4u5 ABEBAAHCwF8EGAECAAkFAlMe1UQCGwwACgkQh7ZrRtnSejOSuQgA27p2rYB7Kh20dym6V8c6 2pWpBHHTgxr/32zevxHSiXl6xvUCg5T8WUwfUk8OvgDcBErK/blDAMXQzSg3sp450JhR8RnX HXF5Zz2T04X7HnlIVJGwf2CjnwyEAJCqMzaCmI+g3Imvg/8L4nyBFvhlFHDv+kIvMiujyycj PAu7xxKplBs1/IEwmDoAMjneFmawvfeQnwdMhSKK8PjKSuzGU5uUmxj3GBfRqvTM0qpmhMPF OmDhJSmH55HLAky2MlmqJYXJPt/9EfSEhFiua1M6gLiuNEuPkp+8jcnHQqKr0IeHt8UqcwLt 2mGfIyl0FVdF9hvWPjNRzGbgqoT1Di03RQ== Message-ID: Date: Mon, 22 Oct 2018 20:44:19 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <30525.1540232104@localhost> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="3XfHbHt1YNlkwRUxtg0nipQqO6lLC1mnL" X-Outbound-SMTP-Client: 10.61.232.53, [10.61.232.53] X-Outbound-Node: aer-core-1.cisco.com Archived-At: Subject: Re: [Emu] Fwd: New Version Notification for draft-lear-brski-pop-00.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Oct 2018 18:44:27 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --3XfHbHt1YNlkwRUxtg0nipQqO6lLC1mnL Content-Type: multipart/mixed; boundary="FnB28d6ALuHMH1tMIQwLdizjMEJDC78JK"; protected-headers="v1" From: Eliot Lear To: "opsawg@ietf.org" , Anima WG , emu@ietf.org Cc: "Owen Friel (ofriel)" , Christian Huitema , Kent Watsen Message-ID: Subject: Re: Fwd: New Version Notification for draft-lear-brski-pop-00.txt References: <154004580158.13697.488879931982830841.idtracker@ietfa.amsl.com> <30525.1540232104@localhost> In-Reply-To: <30525.1540232104@localhost> --FnB28d6ALuHMH1tMIQwLdizjMEJDC78JK Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US [Christian, read down a ways] On 22.10.18 20:15, Michael Richardson wrote: > Eliot, thanks for this document. If nothing else, it means that > we BRSKI authors can deal with some review comments by pointing to "fut= ure > work" :-) > > (A)"request-voucher-with-possession" <-- what about intent to traffic? = :-) > (for those that don't get the joke: > https://criminal.findlaw.com/criminal-charges/possession-with-the-int= ent-to-distribute.html ) > > if leaf out-of-band-claim to be set by the PLEDGE? > I think it is set by the Registar? In all cases, any out of band claim has to be collected by the Registrar.=C2=A0 It is possible that having received such a claim from th= e Registrar, the pledge forwards it along to the MASA. > > The document sadly ends too soon... Gosh.=C2=A0 You want it all at once, don' you?!=C2=A0 Become an editor ;-= ) > > You say it is trying to do a few things. > 1) deal with middle value pledge, > (and low-value pledges in very congested places) > where an out-of-band supply-chain integration is unavailable, > and the MASA has a any-registar policy for the device. Yes. > > 2) provide a ship-and-forget mechanism. Yes. > > It seems that the cryptographic POP mechanism is an ends to accomplish = a > means, rather than a core goal of the protocol. I never employ hashes just for fun ;-) > The Pledge already can > sign it's voucher-request, and since it includes the Registrar's key wh= en it > does a proximity assertion, it's pretty good proof of possession for th= e > *Registrar*, but it might provide inadequate assurance to the MASA of i= t's > freshness. I think this covers the Joe Isuzu case that can fall out of the draft, and maybe one other.=C2=A0 The fundamental issue with the others is that = the Pledge needs some reason to believe that it is really on the correct network.=C2=A0 Proof of possession can come in several forms, depending o= n the device, but we're assuming that there's no user input to the device available (e.g., no buttons, to touch screen, etc).=C2=A0 It could also b= e that the Pledge really doesn't want to validate proof of possession by itself.=C2=A0 In that case, there's no reason for the pledge to even know= the proof of possession. > If the MASA could provide a nonce for the pledge to sign > (requiring another round trip, and even more online assurance), that wo= uld > provide even more proof. > > Given that you pushed this out before today's cutoff, I am not upset > that there is so few details. I am suspecting that in your thinking th= at you > created the three objects, and realized that could accomplish > "ship-and-forget" using a combination of them? That's part of the thinking, yes. > > I also wonder if cryptographic-POP is being confused with "proof of > ownership", which I think is what you really want to accomplish. We can have that discussion . > > If one assumes some machine readable (QR) code that comes with the prod= uct, > then there are a few things one can do to differently. One of the thin= gs > that I have thought a lot about is that one uses the printed code in th= e > Registrar to establish a relationship with the MASA. That is, one crea= tes > the supply-chain-integration by using the QR code with some zero-knowle= dge > proof (I think that PAKE is the latest one) to establish that one is th= e > legitimate Registrar for the product. One can do this as *any time* > (some mumble about the lifetime of the CA of the Registrar's key), and > the product will be enrolled correctly at any future time. Good point.=C2=A0 One possible thought in terms of the evolution of this = work would be =E2=80=9CMore stuff you can do with vouchers=E2=80=9D with a ple= thora of documented uses.=C2=A0 Or we might want to spawn a few more drafts.=C2=A0= Again, worth discussion. > > About my joke (A) above, I think that ship-and-forget is an interesting= > goal, and in particular, if also may enable desireable "traffic"ing. T= hat > is, if the manufacturer can transfer the product to my ownership withou= t any > online interaction, then presumably, I can also *resell* the device to > you using the same lack-of-interaction? Yes.=C2=A0 In fact that is a goal that I think both Christian and Randy h= ave motivated.=C2=A0 I would want to explore a bit whether or not to split ou= t ship and forget, but I would rather we tried to solve for that problem because it really is here (see below). > > =3D=3D=3D=3D > > > In addition, some manufacturers may prefer not to require the > > existence of a MASA. In these circumstances proof of possession t= o > > the device is required. > > I would prefer that we split this into a different draft. > > I am very concerned that ship-and-forget is not a desireable property > in the IoT space. It essentially means that the manufacturer has no fu= rther > interest in providing any kind of updates for the device. I have ser= ious > cybersecurity concerns about such devices being out there (sitting unpa= tched > and untracked in a warehouse somewhere), as well as significant environ= mental > concerns about devices designed to die like this. It could also be the case that the device is intended to be deployed in disconnected environments.=C2=A0 I also think it's going to be a little w= hile before certain classes of manufacturers will seriously be able to run an online MASA.=C2=A0 And I would like them to at least be able to consume a= voucher, even if we need different sorts of transfer approaches. > > I am trying to think of devices where this makes sense. I come up with= a few > things: single-use medical devices (like bandages, syringes, etc.), > prophylactics and other single-use sex toys, things you eat, and some > variety of devices that might be called "spy craft". In each case, I'm= > having difficulty knowing what the "smart" aspect of the product is, ot= her > than simply tracking it's existence and current stocking location. A sm= art > package containing a dumb device is a good idea, but it seems like some= thing > that would be better recycled, and in any case, it's not ship-and-forge= t > for the packaging. > > So this is why I think that splitting ship-and-forget mechanism into an= other > document would let us treat it better. In particular, I want to know w= ho is > going to deploy using such mechanisms, and if they are at the table now= =2E > I guess I shall add a slide to my ANIMA BRSKI stack about this in an at= tempt > to get feedback. > > I suspect that there is a category of devices that some think of being > ship-and-forget which might actually be ship-to-holding-company. > Holding company leases to end user for period of time. End user identi= ty > is never communicated back, and might be very much pseudonymous. > I'm thinking about car-rentals, hotel rooms (full of devices), ... > > Let's discuss further.=C2=A0 Looking forward to the Tuesday 6:00pm Side m= eeting. Eliot --FnB28d6ALuHMH1tMIQwLdizjMEJDC78JK-- --3XfHbHt1YNlkwRUxtg0nipQqO6lLC1mnL Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlvOGoQACgkQh7ZrRtnS ejOPqggAliIjC7O1pU7l1LtZQpqNkcODmS//RlLCLyKeK+UYfTUF3ycADNN7v6MD xUgLsgCgs7xFBsEFxgh4075K3kuTjVVSCgNgwS/s38hYq2ZqCZ9hA+/k8C2CsvJM z7jY3n1+msQ+SRCiTJKs5CzRTyXrrrEMMuQmaCPIUMmeTaeRKgcarcl0GuRks9zu jkFrw/8ruxeNWOYYyRf8mdSxU3CDv51f1gcerBnXR/qB3RRtLCqUAEE6JBbmkes0 umCyCfNf9HdBLvtDeqCqnBIZc5Do8U4/3WqFKr52SWb3x5om+Y+pCwsSaOX6P5EL XuPy5kyUjcRJdEsawFbzXqap0uZSiQ== =hSN/ -----END PGP SIGNATURE----- --3XfHbHt1YNlkwRUxtg0nipQqO6lLC1mnL-- From nobody Mon Oct 22 12:54:52 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47DE212D7EA; Mon, 22 Oct 2018 12:54:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aV5_R-ekTcSL; Mon, 22 Oct 2018 12:54:35 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF97E1294D7; Mon, 22 Oct 2018 12:54:35 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 6EF8220008; Mon, 22 Oct 2018 15:54:32 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id B7F662363; Mon, 22 Oct 2018 15:54:34 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id B62AE22D5; Mon, 22 Oct 2018 15:54:34 -0400 (EDT) From: Michael Richardson To: "opsawg\@ietf.org" , Anima WG , emu@ietf.org In-Reply-To: References: <154004580158.13697.488879931982830841.idtracker@ietfa.amsl.com> <30525.1540232104@localhost> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: [Emu] ship and forget use cases for onboarding X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Oct 2018 19:54:39 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable {cutting CC of people, and we need to pick a WG list to discuss this on?} Eliot Lear wrote: >> The Pledge already can >> sign it's voucher-request, and since it includes the Registrar's key= when it >> does a proximity assertion, it's pretty good proof of possession for= the >> *Registrar*, but it might provide inadequate assurance to the MASA o= f it's >> freshness. > I think this covers the Joe Isuzu case that can fall out of the draft, > and maybe one other.=C2=A0 The fundamental issue with the others is t= hat the > Pledge needs some reason to believe that it is really on the correct > network.=C2=A0 Proof of possession can come in several forms, dependi= ng on > the device, but we're assuming that there's no user input to the devi= ce > available (e.g., no buttons, to touch screen, etc).=C2=A0 It could al= so be > that the Pledge really doesn't want to validate proof of possession by > itself.=C2=A0 In that case, there's no reason for the pledge to even = know the > proof of possession. https://en.wikipedia.org/wiki/Joe_Isuzu ... I asked google, and I'm not quite sure I get the connection. >> I would prefer that we split this into a different draft. >> >> I am very concerned that ship-and-forget is not a desireable property >> in the IoT space. It essentially means that the manufacturer has no >> further >> interest in providing any kind of updates for the device. I have >> serious >> cybersecurity concerns about such devices being out there (sitting >> unpatched >> and untracked in a warehouse somewhere), as well as significant >> environmental >> concerns about devices designed to die like this. > It could also be the case that the device is intended to be deployed = in > disconnected environments.=C2=A0 I also think it's going to be a litt= le while > before certain classes of manufacturers will seriously be able to run= an > online MASA.=C2=A0 And I would like them to at least be able to consu= me a > voucher, even if we need different sorts of transfer approaches. It's not enough to say that they are going to be deployed in disconnected environments. It's that they one wants to drop-ship them from the *manufacturers* warehouse to the disconnected location. When one thinks about drop-ship to a disconnected location, one tends to think about containers of humanitarian AID going out the back of a aircraft (C-2, Hercules, etc.) with a parachute. If anything, that situation is probably *NOT* the case we are thinking about, because in that case the kit would have already gone through the owner's warehouse (whether the owner is a UN aid agency, some FEMA equivalent). The entire kit could have been onboarded (wirelessly) as it went *onto* the aircraft, or could even occur as late as when it's on the aircraft. And you said, "online MASA", when it could well be that it's an offline MASA. If you buy enough product, the manufacturer could well just put a custom trust anchor in and give you the private key. That's essentially what happens in Industrial 4.0 802.15.4 deployments today. So I'm saying, let's not invent a problem before we understand who actually has the problem.... and make sure that the people who can solve the problem are at our table. =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAlvOKvoACgkQgItw+93Q 3WVjrQf+LDsORDMpORT2WEtvCoWJzvdEcAQYW+Vt96GtxJfg/np/ludSEcV53CDO I2vBJLZrW5hpJbzfRzHO2H+boA4cMDPX562IjUc0kW6BkeGLtGTlu70Qw47faZBJ xfPMLNvuhdYQKJ3LCwItY3u3ceU7CV1OBFPmzpW7bgfZn8vCLtpzzXa6Ral/Lvf+ TAZ/klWr4TEfJQj6CoeLklzIUx/tMh6TPD1P/9T/WQsEt+SmqpdzzCtK6XiNKkEy i8FBLpV/uSumF7obkwV8itGG9nUQVtUt8oV7cJa4h02nUgMQwOfWUtyygn3ZjB7O PFdChHVMKaAqGB9FTI0xGp7GNl+QsQ== =osBo -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Oct 23 04:26:50 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C1B54130E02; Tue, 23 Oct 2018 04:26:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LlvrzvxbHK2v; Tue, 23 Oct 2018 04:26:46 -0700 (PDT) Received: from aer-iport-3.cisco.com (aer-iport-3.cisco.com [173.38.203.53]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4E24D1271FF; Tue, 23 Oct 2018 04:26:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=9615; q=dns/txt; s=iport; t=1540294005; x=1541503605; h=subject:to:references:from:message-id:date:mime-version: in-reply-to; bh=Z0AcZQzyyyv2iSw1Yx7oputw1qi7l9T3bxFTkEY8yJo=; b=CQqyZdbV36N7VE9ve1IC0D46mbhRmqv3p0xdVxpQVi9lfncp+zbn+ZqB BY/uiHscVLH1GDpbgy+7PT0Ss4cXCMXlyBg875cyKETeTR1qFarLh4HuH c08HCWOerZp5+cEQXHfLqDMG8fdhyz+Vi6YUzcvhv1ewcc2/awd133+yA A=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BVAABaBM9b/xbLJq1jGgEBAQEBAgE?= =?us-ascii?q?BAQEHAgEBAQGBZYJrbRIog3WId41MkU2HQggFGAEKgVSCdQKFSTgWAQMBAQI?= =?us-ascii?q?BAQJtHAyFOgEBAQECAQEBIUsEDAsJAhgqAgInMAYBDAYCAQGDHQGBeQgPij2?= =?us-ascii?q?bTYEuH4l2CgWCbYkLggCBESeCPS6DGwEBA4EqDYMqglcCiQMCFpU1CYQQgW5?= =?us-ascii?q?lgx2GbgYXiTSGfIxcig+BWiE0gSEzGggbFTuCbIImF4hchUA9MIsugk0BAQ?= X-IronPort-AV: E=Sophos;i="5.54,416,1534809600"; d="asc'?scan'208,217";a="7407734" Received: from aer-iport-nat.cisco.com (HELO aer-core-3.cisco.com) ([173.38.203.22]) by aer-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 23 Oct 2018 11:26:42 +0000 Received: from [10.61.70.182] (ams3-vpn-dhcp1718.cisco.com [10.61.70.182]) by aer-core-3.cisco.com (8.15.2/8.15.2) with ESMTP id w9NBQf88024714; Tue, 23 Oct 2018 11:26:41 GMT To: Michael Richardson , "opsawg@ietf.org" , Anima WG , emu@ietf.org References: <154004580158.13697.488879931982830841.idtracker@ietfa.amsl.com> <30525.1540232104@localhost> <22917.1540238074@localhost> From: Eliot Lear Openpgp: preference=signencrypt Autocrypt: addr=lear@cisco.com; prefer-encrypt=mutual; keydata= xsBNBFMe1UQBCADdYOS5APDpIpF2ohAxB+nxg1GpAYr8iKwGIb86Wp9NkK5+QwbW9H035clT lpVLciExtN8E3MCTPOIm7aITPlruixAVwlBY3g7U9eRppSw9O2H/7bie2GOnYxqmsw4v1yNZ 9NcMLlD8raY0UcQ5r698c8JD4xUTLqybZXaK2sPeJkxzT+IwupRSQ+vXEvFFGhERQ88zo5Ca Sa1Gw/Rv54oH0Dq2XYkO41rhxQ60BKZLZuQK1d9+1y3I+An3AJeD3AA31fJZD3H8YRKOBgqe ILPILbw1mM7gCtCjfvFCt6AFCwEsjITGx55ceoQ+t5B5XGYJEppMWsIFrwZsfbL+gP31ABEB AAHNJUVsaW90IExlYXIgPGxlYXJAb2Zjb3Vyc2VpbXJpZ2h0LmNvbT7CwJEEEwECADsCGwMC HgECF4ACGQEWIQSY0L2QRh2wkqeyYR2HtmtG2dJ6MwUCWxJwMwULCQgHAgYVCAkKCwIEFgID AQAKCRCHtmtG2dJ6MyMyCACXvtFjAYGMtOkD9MD4nI3ifFpkrj8xTMbXjrv5hdqmzRmQ0wqA 1U/OlZux+P/NaVMiZNZc8zw0nsx/INAqDOVd4/tLWF+ywTkeRFR0VnaUxLwCReZAZOaRS+md +52u/6ddoFja2RnjZ43qbbuvVUARQVIyMJz+GbR6mEZQHR0psD7dDYZDyrpivCxm8zHQwmB6 AZUlO7OJgljDvVPVDCabg/ZnJw1qS0OzSiNb0MySk1D5A7FdwDgeKxuMYUOOoVVTTMWNWcME UkRX9LxElswEt0PQWiz/j3FYXTxiFfl/1vKcHx4pM+E5C5mhTbrdFUFLJC3Y5fLID7stK/Ch aEaBzsBNBFMe1UQBCAC0WV7Ydbv95xYGPhthTdChBIpPtl7JPCV/c6/3iEmvjpfGuFNaK4Ma cj9le20EA5A1BH7PgLGoHOiPM65NysRpZ96RRVX3TNfLmhGMFr5hPOGNdq+xcGHVutmwPV9U 7bKeUNRiPFx3YdEkExddqV2E8FltT0x2FSKe2xszPPHB6gVtMckX5buI9p1K3fbVhXdvEkcY Y/jB0JEJGyhS5aEbct5cHUvDAkT81/YFK5Jfg8RRwu1q1t1YuIJSOWAZQ9J9oUsg6D9RpClU +tIFBoe3iTp1AUfJcypucGKgLYKtpu/aygcpQONHYkYW5003mPsrajFhReVF5veycMbHs4u5 ABEBAAHCwF8EGAECAAkFAlMe1UQCGwwACgkQh7ZrRtnSejOSuQgA27p2rYB7Kh20dym6V8c6 2pWpBHHTgxr/32zevxHSiXl6xvUCg5T8WUwfUk8OvgDcBErK/blDAMXQzSg3sp450JhR8RnX HXF5Zz2T04X7HnlIVJGwf2CjnwyEAJCqMzaCmI+g3Imvg/8L4nyBFvhlFHDv+kIvMiujyycj PAu7xxKplBs1/IEwmDoAMjneFmawvfeQnwdMhSKK8PjKSuzGU5uUmxj3GBfRqvTM0qpmhMPF OmDhJSmH55HLAky2MlmqJYXJPt/9EfSEhFiua1M6gLiuNEuPkp+8jcnHQqKr0IeHt8UqcwLt 2mGfIyl0FVdF9hvWPjNRzGbgqoT1Di03RQ== Message-ID: <09c86b2f-bcf3-0c9a-1b62-abc7e28cb124@cisco.com> Date: Tue, 23 Oct 2018 13:26:40 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <22917.1540238074@localhost> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="dI5Bv6QVLZ34pY6NpE4ZJ1HGLA3fb2EPE" X-Outbound-SMTP-Client: 10.61.70.182, ams3-vpn-dhcp1718.cisco.com X-Outbound-Node: aer-core-3.cisco.com Archived-At: Subject: Re: [Emu] [Anima] ship and forget use cases for onboarding X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Oct 2018 11:26:49 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --dI5Bv6QVLZ34pY6NpE4ZJ1HGLA3fb2EPE Content-Type: multipart/mixed; boundary="KSE8TpCTKkRX1QHrFp7Eb5RDARPVgIeLD"; protected-headers="v1" From: Eliot Lear To: Michael Richardson , "opsawg@ietf.org" , Anima WG , emu@ietf.org Message-ID: <09c86b2f-bcf3-0c9a-1b62-abc7e28cb124@cisco.com> Subject: Re: [Anima] ship and forget use cases for onboarding References: <154004580158.13697.488879931982830841.idtracker@ietfa.amsl.com> <30525.1540232104@localhost> <22917.1540238074@localhost> In-Reply-To: <22917.1540238074@localhost> --KSE8TpCTKkRX1QHrFp7Eb5RDARPVgIeLD Content-Type: multipart/alternative; boundary="------------6A665F1E44E0036EF06D7914" Content-Language: en-US This is a multi-part message in MIME format. --------------6A665F1E44E0036EF06D7914 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Michael, On 22.10.18 21:54, Michael Richardson wrote: > > > https://en.wikipedia.org/wiki/Joe_Isuzu ... I asked google, and I'm no= t > quite sure I get the connection. Sorry- this was a reference to an earlier message.=C2=A0 There is a mode = in which the MASA is acting based on its relationship with the registrar.=C2= =A0 The punch line with Joe Isuzu was =E2=80=9CTrust me!=E2=80=9D > It's not enough to say that they are going to be deployed in disconnect= ed > environments. It's that they one wants to drop-ship them from the > *manufacturers* warehouse to the disconnected location. There are quite a number of use cases where connectivity may be an issue:= * A secure building, where Internet access is limited, and even carrying in a USB stick is problematic.=C2=A0 This can range from a military installation to a pharmaceutical laboratory, to certain departments of financial institutions. * It could simply be an order of operations matter, where the device has arrived in advance of Internet connectivity but still wants to function (think fire suppression systems). You may say, =E2=80=9Cbut onboard them advance of their deployment=E2=80=9D= =2E=C2=A0 That may or may not be practicable. > When one thinks about drop-ship to a disconnected location, one tends t= o > think about containers of humanitarian AID going out the back of a airc= raft > (C-2, Hercules, etc.) with a parachute. If anything, that situation i= s > probably *NOT* the case we are thinking about, because in that case the= kit > would have already gone through the owner's warehouse (whether the owne= r is > a UN aid agency, some FEMA equivalent). The entire kit could have been= > onboarded (wirelessly) as it went *onto* the aircraft, or could even oc= cur > as late as when it's on the aircraft. I think we're get a better feel for some of this as time goes on, but one could imagine components sitting in a drawer for five years.=C2=A0 > > And you said, "online MASA", when it could well be that it's an offline= > MASA. If you buy enough product, the manufacturer could well just put > a custom trust anchor in and give you the private key. That's essentia= lly > what happens in Industrial 4.0 802.15.4 deployments today. I certainly know manufacturers who do that, and they mostly hate it, because it requires custom builds. > > So I'm saying, let's not invent a problem before we understand who actu= ally > has the problem.... and make sure that the people who can solve the pro= blem > are at our table. This sounds like an EXCELLENT conversation for the next few weeks. Eliot > > -- > Michael Richardson , Sandelman Software Works > -=3D IPv6 IoT consulting =3D- > > > > > > _______________________________________________ > Anima mailing list > Anima@ietf.org > https://www.ietf.org/mailman/listinfo/anima --------------6A665F1E44E0036EF06D7914 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Hi Michael,


On 22.10.18 21:54, Michael Richardson wrote:


https://en.wikipedia.org/wiki/Joe_Isuzu  ... I asked googl=
e, and I'm not
quite sure I get the connection.

Sorry- this was a reference to an earlier message.=C2=A0 There is a m= ode in which the MASA is acting based on its relationship with the registrar.=C2=A0 The punch line with Joe Isuzu was =E2=80=9CTrust me!= =E2=80=9D
It's not enough to say that they are going to be deployed in disconnected=

environments.  It's that they one wants to drop-ship them from the
*manufacturers* warehouse to the disconnected location.

There are quite a number of use cases where connectivity may be an issue:
  • A secure building, where Internet access is limited, and even carrying in a USB stick is problematic.=C2=A0 This can range from= a military installation to a pharmaceutical laboratory, to certain departments of financial institutions.
  • It could simply be an order of operations matter, where the device has arrived in advance of Internet connectivity but still wants to function (think fire suppression systems).

You may say, =E2=80=9Cbut onboard them advance of their deploymen= t=E2=80=9D.=C2=A0 That may or may not be practicable.

When one thinks about drop-ship to a disconnected location, one tends to
think about containers of humanitarian AID going out the back of a aircra=
ft
(C-2, Hercules, etc.) with a parachute.   If anything, that situation is
probably *NOT* the case we are thinking about, because in that case the k=
it
would have already gone through the owner's warehouse (whether the owner =
is
a UN aid agency, some FEMA equivalent).  The entire kit could have been
onboarded (wirelessly) as it went *onto* the aircraft, or could even occu=
r
as late as when it's on the aircraft.

I think we're get a better feel for some of this as time goes on, but one could imagine components sitting in a drawer for five years.=C2=A0 

And you said, "online MASA", when it could well be that it's an offline
MASA.  If you buy enough product, the manufacturer could well just put
a custom trust anchor in and give you the private key.  That's essentiall=
y
what happens in Industrial 4.0 802.15.4 deployments today.

I certainly know manufacturers who do that, and they mostly hate it, because it requires custom builds.


So I'm saying, let's not invent a problem before we understand who actual=
ly
has the problem.... and make sure that the people who can solve the probl=
em
are at our table.

This sounds like an EXCELLENT conversation for the next few weeks.
Eliot


--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software =
Works
 -=3D IPv6 IoT consulting =3D-






_______________________________________________
Anima mailing list
Anim=
a@ietf.org
https://www.ietf.org/mailman/listinfo/anima

--------------6A665F1E44E0036EF06D7914-- --KSE8TpCTKkRX1QHrFp7Eb5RDARPVgIeLD-- --dI5Bv6QVLZ34pY6NpE4ZJ1HGLA3fb2EPE Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlvPBXAACgkQh7ZrRtnS ejNVWggAs2lKXmBTJ2ZiIcwt0/a4/+eo/pUHKPX8vEm223O+nK3KBLuc8uklDFGv wlRIiaVFoRr2NqwvlZmgJdj0dUynowb7p2oHGslKDixN3/gMBhhiN2J5KGD7qjSP zgWicJKt+4LpJIoS1AF1pGvubkdIrHvu4YG62w8LfHBtvl0qNMYL3hHLj9D7gkq3 ge3tctQ2I22Fsx9oQ5uLvZeGoso0hI/L3C9sREgbPMkmEfbxzhmdemxaSIxNJxBf uSVQGoXHeyOaOGE9Y8LCULYInxafKk8cTM+Kd3eVBF8SRRUOborhwJYH9ou218eo OIf3kwUU3cweHSFm9OS4v7HDwWc8Sg== =CVDm -----END PGP SIGNATURE----- --dI5Bv6QVLZ34pY6NpE4ZJ1HGLA3fb2EPE-- From nobody Wed Oct 24 10:47:47 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AEC4F129619 for ; Wed, 24 Oct 2018 10:47:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R7loX8r4qT8j for ; Wed, 24 Oct 2018 10:47:40 -0700 (PDT) Received: from smtp-out-01.aalto.fi (smtp-out-01.aalto.fi [130.233.228.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC6FE12777C for ; Wed, 24 Oct 2018 10:47:39 -0700 (PDT) Received: from smtp-out-01.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id A8739115468_BD0AF97B for ; Wed, 24 Oct 2018 17:44:55 +0000 (GMT) Received: from exng2.org.aalto.fi (exng2.org.aalto.fi [130.233.223.21]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng2.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-01.aalto.fi (Sophos Email Appliance) with ESMTPS id 416B2115465_BD0AF97F for ; Wed, 24 Oct 2018 17:44:55 +0000 (GMT) Received: from exng6.org.aalto.fi (130.233.223.25) by exng2.org.aalto.fi (130.233.223.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Wed, 24 Oct 2018 20:47:36 +0300 Received: from exng8.org.aalto.fi (130.233.223.27) by exng6.org.aalto.fi (130.233.223.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Wed, 24 Oct 2018 20:47:36 +0300 Received: from exng8.org.aalto.fi ([fe80::edd7:7397:1f7f:cd7]) by exng8.org.aalto.fi ([fe80::edd7:7397:1f7f:cd7%17]) with mapi id 15.01.1466.012; Wed, 24 Oct 2018 20:47:36 +0300 From: Aura Tuomas To: "emu@ietf.org" Thread-Topic: New Version Notification for draft-aura-eap-noob-04.txt Thread-Index: AQHUai+nWUrAyaDLQk6VbJGeatSlO6Uri4hw Date: Wed, 24 Oct 2018 17:47:36 +0000 Message-ID: <83378e995d7145dfb68e9522f9fd7770@aalto.fi> References: <154023059902.6906.1358448870756107229.idtracker@ietfa.amsl.com> In-Reply-To: <154023059902.6906.1358448870756107229.idtracker@ietfa.amsl.com> Accept-Language: fi-FI, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.233.0.5] Content-Type: multipart/alternative; boundary="_000_83378e995d7145dfb68e9522f9fd7770aaltofi_" MIME-Version: 1.0 X-SASI-RCODE: 200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=from:to:subject:date:message-id:references:in-reply-to:content-type:mime-version; s=its18; bh=sdjv8OwGU/DD6/Wo2WSmbGIHVTjqZR6Q+tNxkWfw8L0=; b=ktbmy7ejMTdCI9cm472Bmphaakryq4Cfw3qfo4Y6dqHcnLzeezqnEDNwjSPZc8i5mazLPHhaDAYiqGZhL2XpKSI9K+6ZgPkdP2OGIB2N0U2P5vtFFjnB5f+VHuxExLWn0pO3rkUd2253+zGg8OxL28pjxN8FhxGQLJpJSVIt5rVp7H9LYBax7FSgDpZ6ywMBQC9SBrLDU0Ye4iKiMPnhoyS++iKzLz3iohgkya6YySbayQX5R5XDYutyuxoMVcgzLT9MUrmgm5Iagz8lht51wsHWX0iuW0w5A7tfjbL/HJjBbmi6V5dVOWedVYjobxl7BHWhbbz0NQ9fjredAld5Qg== Archived-At: Subject: [Emu] FW: New Version Notification for draft-aura-eap-noob-04.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Oct 2018 17:47:45 -0000 --_000_83378e995d7145dfb68e9522f9fd7770aaltofi_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Dear all, We have submitted a new version of our draft titled "Nimble out-of-band aut= hentication for EAP (EAP-NOOB)": https://tools.ietf.org/html/draft-aura-eap-noob-04 The draft defines an EAP method where the authentication is based on a user= -assisted out-of-band (OOB) channel between the server and peer. It is inte= nded as a generic bootstrapping solution for Internet-of-Things devices whi= ch have no pre-configured authentication credentials and which are not yet = registered on the authentication server. What is new in version -04? Since the previous version, we have done extens= ive modeling and verification of the protocol and worked to resolve some di= scovered issues. We especially looked for denial-of-service conditions that= may arise from dropped messages and other protocol failures, which both co= uld be caused a network attacker. Based on this analysis, we have rethought= the recovery from dropped final messages. The error handling still needs s= ome attention. In any case, the specification is a pretty good shape and re= ady for anyone to review. The open-source implementation and the mCRL2 formal model are still based o= n the previous version but work is ongoing to update them: https://github.com/tuomaura/eap-noob Emu is the working group that closest matches our spec. Thus, we look forwa= rd to your feedback and comments here or in the wg meeting in a couple of w= eeks. Regards, Tuomas -----Original Message----- From: internet-drafts@ietf.org Sent: Monday, 22 October, 2018 20:50 To: Mohit Sethi ; Aura Tuomas Subject: New Version Notification for draft-aura-eap-noob-04.txt A new version of I-D, draft-aura-eap-noob-04.txt has been successfully subm= itted by Tuomas Aura and posted to the IETF repository. Name: draft-aura-eap-noob Revision: 04 Title: Nimble out-of-band authentication for EAP (EAP-NOOB) Document date: 2018-10-22 Group: Individual Submission Pages: 58 URL: https://www.ietf.org/internet-drafts/draft-aura-eap-noob-04= .txt Status: https://datatracker.ietf.org/doc/draft-aura-eap-noob/ Htmlized: https://tools.ietf.org/html/draft-aura-eap-noob-04 Htmlized: https://datatracker.ietf.org/doc/html/draft-aura-eap-noob Diff: https://www.ietf.org/rfcdiff?url2=3Ddraft-aura-eap-noob-04 Abstract: Extensible Authentication Protocol (EAP) provides support for multiple authentication methods. This document defines the EAP-NOOB authentication method for nimble out-of-band (OOB) authentication and key derivation. This EAP method is intended for bootstrapping all kinds of Internet-of-Things (IoT) devices that have a minimal user interface and no pre-configured authentication credentials. The method makes use of a user-assisted one-directional OOB channel between the peer device and authentication server. Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --_000_83378e995d7145dfb68e9522f9fd7770aaltofi_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Dear all,

 

We have submitted a new version of our draft titl= ed “Nimble out-of-band authentication for EAP (EAP-NOOB)”:=

 

https://to= ols.ietf.org/html/draft-aura-eap-noob-04

 

The draft defines an EAP method where the authent= ication is based on a user-assisted out-of-band (OOB) channel between the s= erver and peer. It is intended as a generic bootstrapping solution for Inte= rnet-of-Things devices which have no pre-configured authentication credentials and which are not yet registe= red on the authentication server.

 

What is new in version -04? Since the previous ve= rsion, we have done extensive modeling and verification of the protocol and= worked to resolve some discovered issues. We especially looked for denial-= of-service conditions that may arise from dropped messages and other protocol failures, which both could be cau= sed a network attacker. Based on this analysis, we have rethought the recov= ery from dropped final messages. The error handling still needs some attent= ion. In any case, the specification is a pretty good shape and ready for anyone to review.

 

The open-source implementation and the mCRL2 form= al model are still based on the previous version but work is ongoing to upd= ate them:

= https://github.com/tuomaura/eap-noob

 

Emu is the working group that closest matches our= spec. Thus, we look forward to your feedback and comments here or in the w= g meeting in a couple of weeks.

 

Regards,

Tuomas

 



-----Original Message-----
From: internet-drafts@ietf.org <internet-drafts@ietf.org>
Sent: Monday, 22 October, 2018 20:50
To: Mohit Sethi <mohit@piuha.net>; Aura Tuomas <tuomas.aura@aalto.= fi>
Subject: New Version Notification for draft-aura-eap-noob-04.txt


A new version of I-D, draft-aura-eap-noob-04.txt has been successfully subm= itted by Tuomas Aura and posted to the IETF repository.

Name:           draft-aur= a-eap-noob
Revision:       04
Title:          Nimble out-of-= band authentication for EAP (EAP-NOOB)
Document date:  2018-10-22
Group:          Individual Sub= mission
Pages:          58
URL:            https://www.ietf.org/internet-drafts/draft-aura-eap-noob-04.txt
Status:         https://datatracker.ietf.org/doc/draft-aura-eap-noob/
Htmlized:       https://tools.ietf.org/html/draft-aura-eap-noob-04
Htmlized:       https://datatracker.ietf.org/doc/html/draft-aura-eap-noob
Diff:           https://www.ietf.org/rfcdiff?url2=3Ddraft-aura-eap-noob-04

Abstract:
   Extensible Authentication Protocol (EAP) provides support for<= br>    multiple authentication methods.  This document defines t= he EAP-NOOB
   authentication method for nimble out-of-band (OOB) authenticat= ion and
   key derivation.  This EAP method is intended for bootstra= pping all
   kinds of Internet-of-Things (IoT) devices that have a minimal = user
   interface and no pre-configured authentication credentials.&nb= sp; The
   method makes use of a user-assisted one-directional OOB channe= l
   between the peer device and authentication server.

            &nb= sp;            =             &nb= sp;            =             &nb= sp;            =       


Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

--_000_83378e995d7145dfb68e9522f9fd7770aaltofi_-- From nobody Wed Oct 31 02:02:04 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86930129619 for ; Wed, 31 Oct 2018 02:02:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id shQVHzSgw04p for ; Wed, 31 Oct 2018 02:01:59 -0700 (PDT) Received: from xenon42.um.es (xenon42.um.es [IPv6:2001:720:1710:601::42]) by ietfa.amsl.com (Postfix) with ESMTP id 19F20128CE4 for ; Wed, 31 Oct 2018 02:01:59 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by xenon42.um.es (Postfix) with ESMTP id 19996210D7; Wed, 31 Oct 2018 10:01:57 +0100 (CET) X-Virus-Scanned: by antispam in UMU at xenon42.um.es Received: from xenon42.um.es ([127.0.0.1]) by localhost (xenon42.um.es [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 896gBdN-6sh4; Wed, 31 Oct 2018 10:01:56 +0100 (CET) Received: from eduroam_alu-72-150.inf.um.es (unknown [155.54.213.146]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: dan.garcia@um.es) by xenon42.um.es (Postfix) with ESMTPSA id DB10E2044B; Wed, 31 Oct 2018 10:01:51 +0100 (CET) From: =?utf-8?Q?Dan_Garc=C3=ADa_Carrillo?= Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_F928134E-F16D-448B-A3A6-7310699C9460" Mime-Version: 1.0 (Mac OS X Mail 12.1 \(3445.101.1\)) Date: Wed, 31 Oct 2018 10:01:51 +0100 In-Reply-To: <83378e995d7145dfb68e9522f9fd7770@aalto.fi> Cc: "emu@ietf.org" To: Aura Tuomas References: <154023059902.6906.1358448870756107229.idtracker@ietfa.amsl.com> <83378e995d7145dfb68e9522f9fd7770@aalto.fi> X-Mailer: Apple Mail (2.3445.101.1) Archived-At: Subject: Re: [Emu] New Version Notification for draft-aura-eap-noob-04.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Oct 2018 09:02:03 -0000 --Apple-Mail=_F928134E-F16D-448B-A3A6-7310699C9460 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Tuomas,=20 This is an interesting work. We have been investigating how to send EAP over the CoAP protocol = specifically thinking of IoT devices = (https://tools.ietf.org/html/draft-marin-ace-wg-coap-eap-06 = ). Being an = EAP lower layer, CoAP-EAP is agnostic to any EAP method. =46rom what I = see, EAP-NOOB seems to be an interesting proposal for authentication of = IoT devices, since there is no pre-provisioning or credentials or = identities. Because EAP-NOOB does not require large messages, causing = fragmentation, it could be integrated in a real scenario using CoAP-EAP = as EAP lower layer.=20 Best Regards,=20 Dan.=20 that goes hand-in-hand with an EAP Lower Layer that we have proposed in=20= > El 24 oct 2018, a las 19:47, Aura Tuomas = escribi=C3=B3: >=20 > Dear all, > =20 > We have submitted a new version of our draft titled =E2=80=9CNimble = out-of-band authentication for EAP (EAP-NOOB)=E2=80=9D: > =20 > https://tools.ietf.org/html/draft-aura-eap-noob-04 = > =20 > The draft defines an EAP method where the authentication is based on a = user-assisted out-of-band (OOB) channel between the server and peer. It = is intended as a generic bootstrapping solution for Internet-of-Things = devices which have no pre-configured authentication credentials and = which are not yet registered on the authentication server. > =20 > What is new in version -04? Since the previous version, we have done = extensive modeling and verification of the protocol and worked to = resolve some discovered issues. We especially looked for = denial-of-service conditions that may arise from dropped messages and = other protocol failures, which both could be caused a network attacker. = Based on this analysis, we have rethought the recovery from dropped = final messages. The error handling still needs some attention. In any = case, the specification is a pretty good shape and ready for anyone to = review.=20 > =20 > The open-source implementation and the mCRL2 formal model are still = based on the previous version but work is ongoing to update them: > https://github.com/tuomaura/eap-noob = > =20 > Emu is the working group that closest matches our spec. Thus, we look = forward to your feedback and comments here or in the wg meeting in a = couple of weeks. > =20 > Regards, > Tuomas > =20 >=20 >=20 > -----Original Message----- > From: internet-drafts@ietf.org = >=20 > Sent: Monday, 22 October, 2018 20:50 > To: Mohit Sethi >; Aura = Tuomas > > Subject: New Version Notification for draft-aura-eap-noob-04.txt >=20 >=20 > A new version of I-D, draft-aura-eap-noob-04.txt has been successfully = submitted by Tuomas Aura and posted to the IETF repository. >=20 > Name: draft-aura-eap-noob > Revision: 04 > Title: Nimble out-of-band authentication for EAP (EAP-NOOB) > Document date: 2018-10-22 > Group: Individual Submission > Pages: 58 > URL: = https://www.ietf.org/internet-drafts/draft-aura-eap-noob-04.txt = > Status: https://datatracker.ietf.org/doc/draft-aura-eap-noob/ = > Htmlized: https://tools.ietf.org/html/draft-aura-eap-noob-04 = > Htmlized: = https://datatracker.ietf.org/doc/html/draft-aura-eap-noob = > Diff: = https://www.ietf.org/rfcdiff?url2=3Ddraft-aura-eap-noob-04 = >=20 > Abstract: > Extensible Authentication Protocol (EAP) provides support for > multiple authentication methods. This document defines the = EAP-NOOB > authentication method for nimble out-of-band (OOB) authentication = and > key derivation. This EAP method is intended for bootstrapping all > kinds of Internet-of-Things (IoT) devices that have a minimal user > interface and no pre-configured authentication credentials. The > method makes use of a user-assisted one-directional OOB channel > between the peer device and authentication server. >=20 > = =20 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission until the htmlized version and diff are available at = tools.ietf.org . >=20 > The IETF Secretariat >=20 > _______________________________________________ > Emu mailing list > Emu@ietf.org > https://www.ietf.org/mailman/listinfo/emu = --Apple-Mail=_F928134E-F16D-448B-A3A6-7310699C9460 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Tuomas, 

This = is an interesting work.

We have been investigating how to send EAP over the CoAP = protocol specifically thinking of IoT devices (https://tools.ietf.org/html/draft-marin-ace-wg-coap-eap-06)= . Being an EAP lower layer, CoAP-EAP is agnostic to any EAP method. =46rom= what I see, EAP-NOOB seems to be an interesting proposal for = authentication of IoT devices, since there is no pre-provisioning or = credentials or identities. Because EAP-NOOB does not require large = messages, causing fragmentation, it could be integrated in a real = scenario using CoAP-EAP as EAP lower layer. 
Best Regards, 
Dan. 


 that goes = hand-in-hand with an EAP Lower Layer that we have proposed = in 


El 24 = oct 2018, a las 19:47, Aura Tuomas <tuomas.aura@aalto.fi> escribi=C3=B3:

Dear = all,
 
We have = submitted a new version of our draft titled =E2=80=9CNimble out-of-band = authentication for EAP (EAP-NOOB)=E2=80=9D:
 
https://tools.ietf.org/html/draft-aura-eap-noob-04
 
The draft = defines an EAP method where the authentication is based on a = user-assisted out-of-band (OOB) channel between the server and peer. It = is intended as a generic bootstrapping solution for Internet-of-Things = devices which have no pre-configured authentication credentials and = which are not yet registered on the authentication server.
 
What is = new in version -04? Since the previous version, we have done extensive = modeling and verification of the protocol and worked to resolve some = discovered issues. We especially looked for denial-of-service conditions = that may arise from dropped messages and other protocol failures, which = both could be caused a network attacker. Based on this analysis, we have = rethought the recovery from dropped final messages. The error handling = still needs some attention. In any case, the specification is a pretty = good shape and ready for anyone to review. 
 
The = open-source implementation and the mCRL2 formal model are still based on = the previous version but work is ongoing to update them:
https://github.com/tuomaura/eap-noob
 
Emu is = the working group that closest matches our spec. Thus, we look forward = to your feedback and comments here or in the wg meeting in a couple of = weeks.
 
Regards,
Tuomas
 



-----Original Message-----
From: internet-drafts@ietf.org <internet-drafts@ietf.org> 
Sent: = Monday, 22 October, 2018 20:50
To: Mohit Sethi <mohit@piuha.net>; Aura Tuomas <tuomas.aura@aalto.fi>
Subject: New Version Notification for = draft-aura-eap-noob-04.txt


A = new version of I-D, draft-aura-eap-noob-04.txt has been successfully = submitted by Tuomas Aura and posted to the IETF repository.

Name:         &nbs= p; draft-aura-eap-noob
Revision:       04
Title:          = Nimble out-of-band authentication for EAP (EAP-NOOB)
Document date:  2018-10-22
Group:          = Individual Submission
Pages:          = 58
URL:          = ;  https://www.ietf.org/internet-drafts/draft-aura-eap-noob-04.txt=
Status:         https://datatracker.ietf.org/doc/draft-aura-eap-noob/
Htmlized:       https://tools.ietf.org/html/draft-aura-eap-noob-04
Htmlized:       https://datatracker.ietf.org/doc/html/draft-aura-eap-noobDiff:         &nbs= p; https://www.ietf.org/rfcdiff?url2=3Ddraft-aura-eap-noob-04<= br class=3D"">
Abstract:
   = Extensible Authentication Protocol (EAP) provides support for
   multiple authentication methods.  This = document defines the EAP-NOOB
   authentication = method for nimble out-of-band (OOB) authentication and
   key derivation.  This EAP method is = intended for bootstrapping all
   kinds of = Internet-of-Things (IoT) devices that have a minimal user
   interface and no pre-configured authentication = credentials.  The
   method makes use of a = user-assisted one-directional OOB channel
   = between the peer device and authentication server.

          &nb= sp;            = ;            &= nbsp;           &nb= sp;            = ;            &= nbsp;         


Please note that it may take a couple of = minutes from the time of submission until the htmlized version and diff = are available at tools.ietf.org.

The IETF Secretariat

_______________________________________________
Emu mailing list
Emu@ietf.org
https://www.ietf.org/mailman/listinfo/emu

= --Apple-Mail=_F928134E-F16D-448B-A3A6-7310699C9460-- From nobody Wed Oct 31 02:54:36 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF30912958B for ; Wed, 31 Oct 2018 02:54:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XD9Aslay7bRD for ; Wed, 31 Oct 2018 02:54:32 -0700 (PDT) Received: from xenon43.um.es (xenon43.um.es [IPv6:2001:720:1710:601::43]) by ietfa.amsl.com (Postfix) with ESMTP id 9409F128A6E for ; Wed, 31 Oct 2018 02:54:31 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by xenon43.um.es (Postfix) with ESMTP id A0FE9204DC; Wed, 31 Oct 2018 10:54:28 +0100 (CET) X-Virus-Scanned: by antispam in UMU at xenon43.um.es Received: from xenon43.um.es ([127.0.0.1]) by localhost (xenon43.um.es [127.0.0.1]) (amavisd-new, port 10024) with LMTP id Ci53ArZmTiJ2; Wed, 31 Oct 2018 10:54:28 +0100 (CET) Received: from [172.22.73.86] (unknown [155.54.213.146]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: dan.garcia@um.es) by xenon43.um.es (Postfix) with ESMTPSA id 6B3AE20545; Wed, 31 Oct 2018 10:54:28 +0100 (CET) Content-Type: multipart/alternative; boundary=Apple-Mail-82755FCC-2F49-485E-B306-071397921B84 Mime-Version: 1.0 (1.0) From: Dan Garcia X-Mailer: iPhone Mail (16B92) In-Reply-To: Date: Wed, 31 Oct 2018 10:54:27 +0100 Cc: "emu@ietf.org" Content-Transfer-Encoding: 7bit Message-Id: <605C7E2F-862F-43FB-8578-0BFC77A27D1A@um.es> References: <154023059902.6906.1358448870756107229.idtracker@ietfa.amsl.com> <83378e995d7145dfb68e9522f9fd7770@aalto.fi> To: Aura Tuomas Archived-At: Subject: Re: [Emu] New Version Notification for draft-aura-eap-noob-04.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Oct 2018 09:54:35 -0000 --Apple-Mail-82755FCC-2F49-485E-B306-071397921B84 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sorry about the notes left at the bottom. Enviado desde mi iPhone > El 31 oct 2018, a las 10:01, Dan Garc=C3=ADa Carrillo e= scribi=C3=B3: >=20 > Hi Tuomas,=20 >=20 > This is an interesting work. >=20 > We have been investigating how to send EAP over the CoAP protocol specific= ally thinking of IoT devices (https://tools.ietf.org/html/draft-marin-ace-wg= -coap-eap-06).. Being an EAP lower layer, CoAP-EAP is agnostic to any EAP me= thod. =46rom what I see, EAP-NOOB seems to be an interesting proposal for au= thentication of IoT devices, since there is no pre-provisioning or credentia= ls or identities. Because EAP-NOOB does not require large messages, causing f= ragmentation, it could be integrated in a real scenario using CoAP-EAP as EA= P lower layer.=20 >=20 > Best Regards,=20 > Dan.=20 >=20 >=20 > that goes hand-in-hand with an EAP Lower Layer that we have proposed in=20= >=20 >=20 >> El 24 oct 2018, a las 19:47, Aura Tuomas escribi=C3= =B3: >>=20 >> Dear all, >> =20 >> We have submitted a new version of our draft titled =E2=80=9CNimble out-o= f-band authentication for EAP (EAP-NOOB)=E2=80=9D: >> =20 >> https://tools.ietf.org/html/draft-aura-eap-noob-04 >> =20 >> The draft defines an EAP method where the authentication is based on a us= er-assisted out-of-band (OOB) channel between the server and peer. It is int= ended as a generic bootstrapping solution for Internet-of-Things devices whi= ch have no pre-configured authentication credentials and which are not yet r= egistered on the authentication server. >> =20 >> What is new in version -04? Since the previous version, we have done exte= nsive modeling and verification of the protocol and worked to resolve some d= iscovered issues. We especially looked for denial-of-service conditions that= may arise from dropped messages and other protocol failures, which both cou= ld be caused a network attacker. Based on this analysis, we have rethought t= he recovery from dropped final messages. The error handling still needs some= attention. In any case, the specification is a pretty good shape and ready f= or anyone to review.=20 >> =20 >> The open-source implementation and the mCRL2 formal model are still based= on the previous version but work is ongoing to update them: >> https://github.com/tuomaura/eap-noob >> =20 >> Emu is the working group that closest matches our spec. Thus, we look for= ward to your feedback and comments here or in the wg meeting in a couple of w= eeks. >> =20 >> Regards, >> Tuomas >> =20 >>=20 >>=20 >> -----Original Message----- >> From: internet-drafts@ietf.org =20 >> Sent: Monday, 22 October, 2018 20:50 >> To: Mohit Sethi ; Aura Tuomas >> Subject: New Version Notification for draft-aura-eap-noob-04.txt >>=20 >>=20 >> A new version of I-D, draft-aura-eap-noob-04.txt has been successfully su= bmitted by Tuomas Aura and posted to the IETF repository. >>=20 >> Name: draft-aura-eap-noob >> Revision: 04 >> Title: Nimble out-of-band authentication for EAP (EAP-NOOB) >> Document date: 2018-10-22 >> Group: Individual Submission >> Pages: 58 >> URL: https://www.ietf.org/internet-drafts/draft-aura-eap-noob-= 04.txt >> Status: https://datatracker.ietf.org/doc/draft-aura-eap-noob/ >> Htmlized: https://tools.ietf.org/html/draft-aura-eap-noob-04 >> Htmlized: https://datatracker.ietf.org/doc/html/draft-aura-eap-noob= >> Diff: https://www.ietf.org/rfcdiff?url2=3Ddraft-aura-eap-noob-0= 4 >>=20 >> Abstract: >> Extensible Authentication Protocol (EAP) provides support for >> multiple authentication methods. This document defines the EAP-NOOB >> authentication method for nimble out-of-band (OOB) authentication and >> key derivation. This EAP method is intended for bootstrapping all >> kinds of Internet-of-Things (IoT) devices that have a minimal user >> interface and no pre-configured authentication credentials. The >> method makes use of a user-assisted one-directional OOB channel >> between the peer device and authentication server. >>=20 >> = =20 >>=20 >>=20 >> Please note that it may take a couple of minutes from the time of submiss= ion until the htmlized version and diff are available at tools.ietf.org. >>=20 >> The IETF Secretariat >>=20 >> _______________________________________________ >> Emu mailing list >> Emu@ietf.org >> https://www.ietf.org/mailman/listinfo/emu >=20 > _______________________________________________ > Emu mailing list > Emu@ietf.org > https://www.ietf.org/mailman/listinfo/emu --Apple-Mail-82755FCC-2F49-485E-B306-071397921B84 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sorry about the notes left at the bottom.
Enviado desde mi iPhone

El 31 oct 2018, a las 10:01, Dan Garc=C3=ADa Carrillo= <dan.garcia@um.es> escribi=C3= =B3:

Hi Tuomas, 
This is an interesting wo= rk.

We have been i= nvestigating how to send EAP over the CoAP protocol specifically thinking of= IoT devices (https://tools.ietf.org/html/draft-marin-ace-wg-coap-eap-= 06).. Being an EAP lower layer, CoAP-EAP is agnostic to any EAP method. = =46rom what I see, EAP-NOOB seems to be an interesting proposal for authenti= cation of IoT devices, since there is no pre-provisioning or credentials or i= dentities. Because EAP-NOOB does not require large messages, causing fragmen= tation, it could be integrated in a real scenario using CoAP-EAP as EAP lowe= r layer. 

Bes= t Regards, 
Dan. 


 th= at goes hand-in-hand with an EAP Lower Layer that we have proposed in <= /div>


El 24 oct 2018, a las 19:47, Aura Tuomas &l= t;tuomas.aura@aalto.fi> escribi=C3=B3:

Dear all,
 
We ha= ve submitted a new version of our draft titled =E2=80=9CNimble out-of-band a= uthentication for EAP (EAP-NOOB)=E2=80=9D:
 
https://tools.ietf.org/html/draft= -aura-eap-noob-04
 
The draf= t defines an EAP method where the authentication is based on a user-assisted= out-of-band (OOB) channel between the server and peer. It is intended as a g= eneric bootstrapping solution for Internet-of-Things devices which have no p= re-configured authentication credentials and which are not yet registered on= the authentication server.
 
What is n= ew in version -04? Since the previous version, we have done extensive modeli= ng and verification of the protocol and worked to resolve some discovered is= sues. We especially looked for denial-of-service conditions that may arise f= rom dropped messages and other protocol failures, which both could be caused= a network attacker. Based on this analysis, we have rethought the recovery f= rom dropped final messages. The error handling still needs some attention. I= n any case, the specification is a pretty good shape and ready for anyone to= review. <= /o:p>
 
The open-source implementation and the mCRL2 formal m= odel are still based on the previous version but work is ongoing to update t= hem:
https://github.com/tuomaura/eap-noob=
 
Emu is the working group that closest matches our spe= c. Thus, we look forward to your feedback and comments here or in the wg mee= ting in a couple of weeks.
 
Regards,
Tuomas
 



-----Original Message-----
From: i= nternet-drafts@ietf.org <internet-drafts@ietf.org> 
Sent: Monday, 22 O= ctober, 2018 20:50
To: Mohit Sethi <= mohit@piuha.net>; Aura Tuomas <tuomas.= aura@aalto.fi>
Subject: New Version Notification for dr= aft-aura-eap-noob-04.txt


A new v= ersion of I-D, draft-aura-eap-noob-04.txt has been successfully submitted by= Tuomas Aura and posted to the IETF repository.

Name:           draft-aur= a-eap-noob
Revision:       04Title:          Nim= ble out-of-band authentication for EAP (EAP-NOOB)
Document dat= e:  2018-10-22
Group:      =     Individual Submission
Pages:  &nb= sp;       58
URL:  &nb= sp;         https://www.ietf.org/internet-drafts/draft-a= ura-eap-noob-04.txt
Status:     &= nbsp;   https://datatr= acker.ietf.org/doc/draft-aura-eap-noob/
Htmlized: &nb= sp;     http= s://tools.ietf.org/html/draft-aura-eap-noob-04
Htmlized:&n= bsp;     &nbs= p;https://datatracker.ietf.org/doc/html/draft-aura-eap-noob
Diff:           https://www.ietf.org/rfcdi= ff?url2=3Ddraft-aura-eap-noob-04

Abstract:<= br class=3D"">   Extensible Authentication Protocol (EAP) provides= support for
   multiple authentication methods.&nbs= p; This document defines the EAP-NOOB
   authenticat= ion method for nimble out-of-band (OOB) authentication and
&nb= sp;  key derivation.  This EAP method is intended for bootstrappin= g all
   kinds of Internet-of-Things (IoT) devices t= hat have a minimal user
   interface and no pre-conf= igured authentication credentials.  The
   meth= od makes use of a user-assisted one-directional OOB channel
&n= bsp;  between the peer device and authentication server.
=
          &= nbsp;            = ;            &nb= sp;            &= nbsp;            = ;            &nb= sp;        


Please note= that it may take a couple of minutes from the time of submission until the h= tmlized version and diff are available at tools.ietf.org.
The IETF Secretariat

___= ____________________________________________
Emu mailing list
Emu@ietf.org
https://w= ww.ietf.org/mailman/listinfo/emu

=
__= _____________________________________________
Emu mailing li= st
Emu@ietf.orghttps://www.ie= tf.org/mailman/listinfo/emu
= --Apple-Mail-82755FCC-2F49-485E-B306-071397921B84--