From nobody Tue Dec 11 07:32:59 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 35CFF130DE8 for ; Tue, 11 Dec 2018 07:32:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sYxFA4HC6iFS for ; Tue, 11 Dec 2018 07:32:56 -0800 (PST) Received: from p130.piuha.net (p130.piuha.net [193.234.218.130]) by ietfa.amsl.com (Postfix) with ESMTP id BCC7C130DD8 for ; Tue, 11 Dec 2018 07:32:55 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id 11D216603CF; Tue, 11 Dec 2018 17:32:54 +0200 (EET) Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qldn2E1P4Z3S; Tue, 11 Dec 2018 17:32:53 +0200 (EET) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2001:14b8:1829::130]) by p130.piuha.net (Postfix) with ESMTPS id 0D0AE660254; Tue, 11 Dec 2018 17:32:53 +0200 (EET) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Jari Arkko In-Reply-To: <98AB9912-1110-47F8-A4B0-94CB2E6A302E@deployingradius.com> Date: Tue, 11 Dec 2018 17:32:52 +0200 Cc: "Dr. Pala" , emu@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <45e7325b-f5d1-c4b8-edb2-3e39d03989fe@openca.org> <39E1238A-2E39-4FF4-89C3-2B549C1EA84F@deployingradius.com> <932256A8-6381-4EE9-95B2-C56B4E7F52D5@piuha.net> <98AB9912-1110-47F8-A4B0-94CB2E6A302E@deployingradius.com> To: Alan DeKok X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [Emu] WG adoption call for draft-arkko-eap-aka-pfs X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2018 15:32:58 -0000 Alan, Circling back to this. I=E2=80=99ll first agree with your summary about the importance of the = tech, that there=E2=80=99s some risk but the risk is likely low but = non-zero, and that in an ideal situation you wouldn=E2=80=99t have to = deal with this. However, I would like to point out that * The draft is an *optional* extension to something bigger, and no one = is forced to implement it. * Regardless of that, even the base RFC had a similar IPR associated = with it back in =E2=80=9809, so any discussion about an extension=E2=80=99= s properties should be set in that context. A problem in the extension = cannot be bigger than a problem in what the extension builds on, no? Not = to mention the context of say, 5G phones. Neither me or you can change that context or even the situation with the = base. Perhaps the world should operate on other kinds of rules, but what = we have here is a tool that could have a real impact on billions of = users=E2=80=99 security, and I think we could make it do that. But we = need a standard. Can we have that? Jari From nobody Tue Dec 11 08:15:04 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8EF2A130E4D for ; Tue, 11 Dec 2018 08:15:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sLRDF3FTD8bJ for ; Tue, 11 Dec 2018 08:14:59 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 03A06130E57 for ; Tue, 11 Dec 2018 08:14:59 -0800 (PST) Received: from [192.168.20.203] (unknown [72.137.155.194]) by mail.networkradius.com (Postfix) with ESMTPSA id 822EC699; Tue, 11 Dec 2018 16:14:57 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: Date: Tue, 11 Dec 2018 11:14:55 -0500 Cc: "Dr. Pala" , emu@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <45e7325b-f5d1-c4b8-edb2-3e39d03989fe@openca.org> <39E1238A-2E39-4FF4-89C3-2B549C1EA84F@deployingradius.com> <932256A8-6381-4EE9-95B2-C56B4E7F52D5@piuha.net> <98AB9912-1110-47F8-A4B0-94CB2E6A302E@deployingradius.com> To: Arkko Jari X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] WG adoption call for draft-arkko-eap-aka-pfs X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2018 16:15:03 -0000 On Dec 11, 2018, at 10:32 AM, Jari Arkko wrote: > I=E2=80=99ll first agree with your summary about the importance of the = tech, that there=E2=80=99s some risk but the risk is likely low but = non-zero, and that in an ideal situation you wouldn=E2=80=99t have to = deal with this. >=20 > However, I would like to point out that >=20 > * The draft is an *optional* extension to something bigger, and no one = is forced to implement it. I don't quite understand that argument. It's superficially true, but = not really correct. If a product is to be at all competitive in a landscape where the "big = players" require this, then the product *must* implement it. The = alternative is to cede market share, revenue, etc. Standards do live in a larger environment than just the standards = bodies. They affect all kinds of things. > * Regardless of that, even the base RFC had a similar IPR associated = with it back in =E2=80=9809, so any discussion about an extension=E2=80=99= s properties should be set in that context. A problem in the extension = cannot be bigger than a problem in what the extension builds on, no? Not = to mention the context of say, 5G phones. If the IPR is new (I haven't checked), then it could potentially add = to the problem, yes. > Neither me or you can change that context or even the situation with = the base. Perhaps the world should operate on other kinds of rules, but = what we have here is a tool that could have a real impact on billions of = users=E2=80=99 security, and I think we could make it do that. But we = need a standard. Can we have that? I agree absolutely that this is needed and useful. I've said that = before. The underlying issue here is that a company has gained control over = part of the standard space. And we rely only on their good will for = continued use of an open standard. That tends to make me nervous. Alan DeKok. From nobody Tue Dec 11 08:23:30 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91F1B130E37 for ; Tue, 11 Dec 2018 08:23:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9BcL9xMoLVLW for ; Tue, 11 Dec 2018 08:23:25 -0800 (PST) Received: from p130.piuha.net (p130.piuha.net [IPv6:2001:14b8:1829::130]) by ietfa.amsl.com (Postfix) with ESMTP id B359D130E3C for ; Tue, 11 Dec 2018 08:23:25 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id 7A9266603CF; Tue, 11 Dec 2018 18:23:23 +0200 (EET) Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iCyrpInOyLMJ; Tue, 11 Dec 2018 18:23:21 +0200 (EET) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2001:14b8:1829::130]) by p130.piuha.net (Postfix) with ESMTPS id C23A4660254; Tue, 11 Dec 2018 18:23:21 +0200 (EET) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Jari Arkko In-Reply-To: Date: Tue, 11 Dec 2018 18:23:21 +0200 Cc: "Dr. Pala" , emu@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <49776C8A-00C6-4595-B947-5A45F4D61F38@piuha.net> References: <45e7325b-f5d1-c4b8-edb2-3e39d03989fe@openca.org> <39E1238A-2E39-4FF4-89C3-2B549C1EA84F@deployingradius.com> <932256A8-6381-4EE9-95B2-C56B4E7F52D5@piuha.net> <98AB9912-1110-47F8-A4B0-94CB2E6A302E@deployingradius.com> To: Alan DeKok X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [Emu] WG adoption call for draft-arkko-eap-aka-pfs X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2018 16:23:29 -0000 Re: optional but everyone requiring a feature. =20 I think in this case the =E2=80=9Ccan require everyone to do it=E2=80=9D = is probably far away in the future, in practice. Given that Release 15 = does not require this extension, it only requires RFC 5448 EAP-AKA=E2=80=99= (or the bis), this means that there will be lots of phones and networks = that only do the base=E2=80=A6 if you mandated an extension you=E2=80=99d = have lots of users having a problem connecting.=20 It is not completely unthinkable that at some point you=E2=80=99d be in = a situation where there=E2=80=99s enough deployment to start requiring = something, but that would certainly be many years away. Plus some = portion of 5G deployment happens in so called Option 3 model, which = means no new core, no new protocols (incl. EAP) between the network and = the UE. Before you can progress away from that and the RFC 5448-only = modes, much time will pass. Jari From nobody Tue Dec 11 08:38:08 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5361130E4E for ; Tue, 11 Dec 2018 08:38:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z9kTmSM4YS6Y for ; Tue, 11 Dec 2018 08:38:04 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 45BF7130E48 for ; Tue, 11 Dec 2018 08:38:04 -0800 (PST) Received: from [192.168.20.203] (unknown [72.137.155.194]) by mail.networkradius.com (Postfix) with ESMTPSA id DAE13699; Tue, 11 Dec 2018 16:38:02 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: <49776C8A-00C6-4595-B947-5A45F4D61F38@piuha.net> Date: Tue, 11 Dec 2018 11:38:00 -0500 Cc: "Dr. Pala" , emu@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <45e7325b-f5d1-c4b8-edb2-3e39d03989fe@openca.org> <39E1238A-2E39-4FF4-89C3-2B549C1EA84F@deployingradius.com> <932256A8-6381-4EE9-95B2-C56B4E7F52D5@piuha.net> <98AB9912-1110-47F8-A4B0-94CB2E6A302E@deployingradius.com> <49776C8A-00C6-4595-B947-5A45F4D61F38@piuha.net> To: Arkko Jari X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] WG adoption call for draft-arkko-eap-aka-pfs X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2018 16:38:06 -0000 On Dec 11, 2018, at 11:23 AM, Jari Arkko wrote: >=20 > Re: optional but everyone requiring a feature. >=20 > I think in this case the =E2=80=9Ccan require everyone to do it=E2=80=9D= is probably far away in the future, in practice. Given that Release 15 = does not require this extension, it only requires RFC 5448 EAP-AKA=E2=80=99= (or the bis), this means that there will be lots of phones and networks = that only do the base=E2=80=A6 if you mandated an extension you=E2=80=99d = have lots of users having a problem connecting.=20 Sure. > It is not completely unthinkable that at some point you=E2=80=99d be = in a situation where there=E2=80=99s enough deployment to start = requiring something, but that would certainly be many years away. Plus = some portion of 5G deployment happens in so called Option 3 model, which = means no new core, no new protocols (incl. EAP) between the network and = the UE. Before you can progress away from that and the RFC 5448-only = modes, much time will pass. I've been doing my thing for 20 years. I'm not going anywhere, so I'm = thinking about the long term. Anyways, I think this is necessary. Alan DeKok. From nobody Fri Dec 21 07:35:15 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF7BF129AA0 for ; Fri, 21 Dec 2018 07:35:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.965 X-Spam-Level: X-Spam-Status: No, score=-1.965 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.065, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nokia.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GQ6cpVJ5baui for ; Fri, 21 Dec 2018 07:35:11 -0800 (PST) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-ve1eur01on0719.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe1f::719]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B82312E04D for ; Fri, 21 Dec 2018 07:35:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.onmicrosoft.com; s=selector1-nokia-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=O/aRxQqQW/YCXAIu6w11R5DNqNhmdlnmWf7Gh7IeLSQ=; b=OezGxdjJU8pl7t2izb80eMdf8/PuYcjOSl78AZ9Gv55pouJFHMHapNzWc5S4mUEekj9DPUnDjPtzHV0LRWgSG0mLtxnc2MLdn6OlI4Sod46NRxPrzy/qNLS8tbrfpPdyAYlFCZw72MsOqd5TeSzh16kd/SM1ouV5K3S9Y8zwI+8= Received: from DB6PR07MB3464.eurprd07.prod.outlook.com (10.170.219.153) by DB6PR07MB4406.eurprd07.prod.outlook.com (10.168.24.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1471.13; Fri, 21 Dec 2018 15:35:00 +0000 Received: from DB6PR07MB3464.eurprd07.prod.outlook.com ([fe80::2044:e80a:a163:a7ff]) by DB6PR07MB3464.eurprd07.prod.outlook.com ([fe80::2044:e80a:a163:a7ff%2]) with mapi id 15.20.1471.012; Fri, 21 Dec 2018 15:35:00 +0000 From: "Maisonneuve, Julien (Nokia - FR/Paris-Saclay)" To: "emu@ietfa.amsl.com" Thread-Topic: [Emu] WG adoption call for draft-arkko-eap-aka-pfs Thread-Index: AQHUmUK8/Vwiq+oeeUyjkrK+OOq0yA== Date: Fri, 21 Dec 2018 15:35:00 +0000 Message-ID: References: In-Reply-To: Accept-Language: fr-FR, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=julien.maisonneuve@nokia.com; x-originating-ip: [82.66.246.158] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DB6PR07MB4406; 6:0zkMSpD+u8OsvEtTCHmoMRGoDOFeiJDZDzTNW6lGhhGMVipfKieh/0FtAsAfI8LdVkTarKgB/3VD/rURnWt8pmRm+TfBJL7kAyQ/13vhZNHdxsijW51pD9MUE5CrnVq1NvRAfFOInYKViCOL1giRNckT7PyG9u5dep5OoIYM1DH371BCGy46HXQAW9uk/uIwpbp+20TO0t3FBlWXxcsscw79pnDPybFGp7cx65ejb7SrQOMpi+wRE0smrfjsJ0uDOccyXZeL3ymMxnz5dcOonazlngH3ivrgWU8AqXBHBkzlUbo9dyf8BxJyVgl5qgICdXMbxtcKckxfriKgSBKJ+hgO/HnT+lcTjzG7ZANlcW3dRu2Ia31jN5osCLn+wjHA/62Hc7ToiBLd6GLpLvHAC9E3EhBfPPbO6xutovhoMQdqf5C0ihLkyV3Tx/9ZvQ600wM2ERfogtlqsLSjEZ+IGQ==; 5:+bqICGaudjLGAAHZbuPxXBqscri8wijcI8cCqEu2XuoQW5waucGnOBHXCur/Vtw9AQpo79Za0pviSQgUlmf3q2j7osFaxuPL7hNgEK1cRHGbEWprrNAd+DyUmxnvjISHrB6xtBNN2jmjFgrGAVE84QJcIxiDHllOLaggkOKmV6g=; 7:zz6vNur6ac6CMtYntuxwNNqOJx/Mm7LuJltXihCga4e7Kb2lfIcpW3xxphpDIjzSFCQYCBeDLg9ZcN9HRgBqHz6N7AHTBVNeUnK26Vr8L4w/PXdE3QfDoNfbcEHNFP4Bq4ZsGSl5NHNAdk5MJ4FYPw== x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 6f758086-9704-4b9d-1f4b-08d66759deda x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(4618075)(2017052603328)(7193020); SRVR:DB6PR07MB4406; x-ms-traffictypediagnostic: DB6PR07MB4406: x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(3230021)(999002)(11241501185)(806100)(5005026)(6040522)(2401047)(8121501046)(3231475)(944501520)(52105112)(93006095)(93001095)(3002001)(10201501046)(6055026)(149066)(150057)(6041310)(20161123558120)(20161123562045)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(201708071742011)(7699051)(76991095); SRVR:DB6PR07MB4406; BCL:0; PCL:0; RULEID:; SRVR:DB6PR07MB4406; x-forefront-prvs: 0893636978 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(136003)(346002)(396003)(376002)(39860400002)(189003)(199004)(8936002)(7736002)(7696005)(5660300001)(6246003)(76176011)(8676002)(478600001)(55016002)(102836004)(790700001)(6116002)(33656002)(14444005)(446003)(66066001)(11346002)(2501003)(3846002)(316002)(5640700003)(476003)(97736004)(2940100002)(6916009)(26005)(53936002)(93156006)(71200400001)(25786009)(81156014)(6506007)(6306002)(1730700003)(236005)(54896002)(81166006)(71190400001)(9686003)(186003)(68736007)(86362001)(99286004)(14454004)(6436002)(106356001)(2351001)(105586002)(256004)(74316002)(2906002)(229853002)(486006); DIR:OUT; SFP:1102; SCL:1; SRVR:DB6PR07MB4406; H:DB6PR07MB3464.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: nokia.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: T1GJ2zyD2UfLoB6rh0rn/89P/5ySDLqdE78sD0JcPsSMO4CO2alwkR3yFvzE7pfxl4tVYN2+7MC8o8PnXVq/fhWNK9yHyFTkZPlBEERXud3QlsZtlp/P3nb4sY1Rzzhdu61xkQBs/A3zpn9L1qt9X5D5YNLWSxE7WAwuYLM4IIC6hxaUtoKqGSjGbjSclmA3834iV7diF8LuSXWZ5Hw8KkdgHd0BS0d4EuXRt9ZOVd34XclXoXH3i8og8C1pTYrnsZ4NeLEvOK0OXXdJ1HjeTg7EtpHDfkojUVyD8VRLnoDuaorFNpTRQDa6JuaU+X81 spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DB6PR07MB3464A066DD8E8C968D42777A92B80DB6PR07MB3464eurp_" MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6f758086-9704-4b9d-1f4b-08d66759deda X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Dec 2018 15:35:00.7465 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR07MB4406 Archived-At: Subject: Re: [Emu] WG adoption call for draft-arkko-eap-aka-pfs X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Dec 2018 15:35:14 -0000 --_000_DB6PR07MB3464A066DD8E8C968D42777A92B80DB6PR07MB3464eurp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hello, Nevertheless this looks like a useful extension which can enhance security = in 3GPP. As an option this at least this opens the possibility to gradually= move towards PFS. Best regards, Julien Maisonneuve, Nokia Corporate Standards. Jari Arkko > Tue, 11 Dece= mber 2018 16:23 UTC Re: optional but everyone requiring a feature. I think in this case the "can require everyone to do it" is probably far aw= ay in the future, in practice. Given that Release 15 does not require this = extension, it only requires RFC 5448 EAP-AKA' (or the bis), this means that= there will be lots of phones and networks that only do the base... if you = mandated an extension you'd have lots of users having a problem connecting. It is not completely unthinkable that at some point you'd be in a situation= where there's enough deployment to start requiring something, but that wou= ld certainly be many years away. Plus some portion of 5G deployment happens= in so called Option 3 model, which means no new core, no new protocols (in= cl. EAP) between the network and the UE. Before you can progress away from = that and the RFC 5448-only modes, much time will pass. Jari --_000_DB6PR07MB3464A066DD8E8C968D42777A92B80DB6PR07MB3464eurp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hello,

Nevertheless this looks like a useful extension which = can enhance security in 3GPP. As an option this at least this opens the pos= sibility to gradually move towards PFS.

Best regards= ,

Julien Maiso= nneuve, Nokia Corporate Standards.

 

Jari Arkko <jari.arkko@piuha.net> Tue, 11 December 2018 16:23 UTC <= /span>

Re: optional but everyon=
e requiring a feature.
I think in this case the “can require ever=
yone to do it” is probably far away in the future, in practice. Given=
 that Release 15 does not require this extension, it only requires RFC 5448=
 EAP-AKA’ (or the bis), this means that there will be lots of phones =
and networks that only do the base… if you mandated an extension you&=
#8217;d have lots of users having a problem connecting. <=
/pre>

It is not completely unthinkable that at some po=
int you’d be in a situation where there’s enough deployment to =
start requiring something, but that would certainly be many years away. Plu=
s some portion of 5G deployment happens in so called Option 3 model, which =
means no new core, no new protocols (incl. EAP) between the network and the=
 UE. Before you can progress away from that and the RFC 5448-only modes, mu=
ch time will pass.


Jari


 
--_000_DB6PR07MB3464A066DD8E8C968D42777A92B80DB6PR07MB3464eurp_-- From nobody Mon Dec 31 08:42:19 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 894DD130E64 for ; Mon, 31 Dec 2018 08:42:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gdGZ8ZvvEz6D for ; Mon, 31 Dec 2018 08:42:15 -0800 (PST) Received: from mail-qt1-x829.google.com (mail-qt1-x829.google.com [IPv6:2607:f8b0:4864:20::829]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 71C1D130E63 for ; Mon, 31 Dec 2018 08:42:15 -0800 (PST) Received: by mail-qt1-x829.google.com with SMTP id t13so29679007qtn.3 for ; Mon, 31 Dec 2018 08:42:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=yxEXHIGGyE4hB8g+7ogKNwFMi9CqVs7vfFBvk/uDRo4=; b=ZNSKW/UkfnSQk+024reyJgTD9BmVHpmPgpPH9yKdX2X9pvFklBPZ5945EDIWqXxEv3 V4ksXX6uafRcjitLJ+2pL6v4Z4YAg/MAxszXVvFICuIMR5s3f2QABOMNJ2YDeFvax0rq gHFEPulw2xSTTHPYDpMRwPLDzLCtZcThocgPk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=yxEXHIGGyE4hB8g+7ogKNwFMi9CqVs7vfFBvk/uDRo4=; b=ZbggnniWdE8NVj39XbuVVk29yhAn3Mk6XzQxAFDVZwfni/fhJzoPTGePvPGX8zuDiH NUHInKpKIsN6+bYZwpdkc2CrnfX50U0eVf98oFEbOr1hdLcrK6KDfLNf03KazXIM57N6 te9V+jyItrHA4LbOHPz8atY27qM5bhCKwkdFbMBBpkVkWoWdXMPjGsISWROWxESN7siV 2rG101ymsYYd5H+8XiNp/62n5o3wkV4qDWYfmfmRl/5xft/6P8ZZcCBhixC4zxVrmoh7 pNRyAVx8XldBz5QG4GKbSpoVOt2RI8R9jlJ2EozSp0lQGbIYByAu9TOkPua/2OtEzLLG TgdA== X-Gm-Message-State: AJcUukdKIOHz4LBxMq7JpHcs79zO50vEvZdGjqXHuagMtVNsCZN1anhn 20kMSrxq+1Ue/m3YZoFHjs8IDB2zvV5Hqg== X-Google-Smtp-Source: ALg8bN7sGtMrXvlwJMDVgGy0gl9u9zj+sH/sO2vlxheSdINOlnjnWm61p7GxzjLMUiKxv7t1+g6jBQ== X-Received: by 2002:a0c:a4a3:: with SMTP id x32mr36287013qvx.89.1546274534404; Mon, 31 Dec 2018 08:42:14 -0800 (PST) Received: from [172.16.0.18] ([96.231.217.246]) by smtp.gmail.com with ESMTPSA id 32sm26148837qto.55.2018.12.31.08.42.13 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 31 Dec 2018 08:42:13 -0800 (PST) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Message-Id: <1379F403-7BAA-432C-A455-F5F1E530D9DE@sn3rd.com> Date: Mon, 31 Dec 2018 11:42:12 -0500 To: emu@ietf.org X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: [Emu] minor Issues/PRs for draft-ietf-emu-rfc5448bis X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Dec 2018 16:42:18 -0000 I volunteered a while back to review this I-D. I am just now getting = around to it and most of my comments are pretty minor so I=E2=80=99ll = submit gh issues/PRs for those [0][1]. I tried to respect that this is = a -bis draft so I tried my best to restrict changes to the new sections. = All of these I think are minor and probably don=E2=80=99t require a lot = of discussion. I am willing to throw in PRs for the issues one we close = them out (or not if we decide no change is required). Cheers, spt [0] https://github.com/emu-wg/draft-ietf-emu-rfc5448bis/issues [1] https://github.com/emu-wg/draft-ietf-emu-rfc5448bis/pulls= From nobody Mon Dec 31 08:42:27 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66621130E70 for ; Mon, 31 Dec 2018 08:42:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id skm1ocYq3KzF for ; Mon, 31 Dec 2018 08:42:19 -0800 (PST) Received: from mail-qt1-x82a.google.com (mail-qt1-x82a.google.com [IPv6:2607:f8b0:4864:20::82a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 82804130E59 for ; Mon, 31 Dec 2018 08:42:19 -0800 (PST) Received: by mail-qt1-x82a.google.com with SMTP id t33so29662365qtt.4 for ; Mon, 31 Dec 2018 08:42:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=f7Jo9SGVPj2hKMnWzgA/vgMCPh+8n33uEUIPCUrz5Lo=; b=QqdETzPMRA2LdRtH5w1h8Bu4zqSrlUU+MD91xaeB6Mq69sbWvaQ1IbxzL2MputaMpL CnxN08dreBwZEDAIIF6loPgACi8vy7uot/ztMPp2aCR/UucxZ9O8o34UYa/jCr7VCfWl kKb1TvmftRTIFUMJ0J+cEBisVNEDi0NFYsssQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=f7Jo9SGVPj2hKMnWzgA/vgMCPh+8n33uEUIPCUrz5Lo=; b=G15Tb0v3wC2J7Mp/ecs9xtZkPee9UywaH0eFV7BEhtX4k6YgI201Rv5aCqh0uDYyyh IWVVkLYlqj1AwDZ9e1ykr6rUY6qeduazENC6O2wZfTNpz5S02u2EImqk4X6q41qFcfDK 4JdV+nCwlPUI/4sx5L6RuH1VtKmMsHYvGOAk+pzAxnJPCrEtHMf+yLmxsndhBsgspYTX 5oGuozyKA2dXNkIAxf+/C8qzYvmuAANCF+uU2YHtbRwe+tbwp46951FFjuy7Cup5PgGh Fg9BtpD5B97KUMkAwxfUPjS2fU8Y5cxhQyfnnEvXHbuy20EM4yb5TdCHZFEUg1tknch6 NhZA== X-Gm-Message-State: AJcUuke9VTbIE4nSMuuGX659nRLfIYK4Zi3J548Sw/IPWJPhhsVawqw4 t0IgI81mukXgEIah4VGCSry1hCjJHRye9A== X-Google-Smtp-Source: ALg8bN4YfvoM0MVGdrRu4CniYr3PDbVjR2JuWtkgF+nt39gnQqCFSpTw2PG0mPOLFP7b/p92H5OeFQ== X-Received: by 2002:a0c:8ae3:: with SMTP id 32mr36782417qvw.27.1546274538572; Mon, 31 Dec 2018 08:42:18 -0800 (PST) Received: from [172.16.0.18] ([96.231.217.246]) by smtp.gmail.com with ESMTPSA id 32sm26148837qto.55.2018.12.31.08.42.17 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 31 Dec 2018 08:42:18 -0800 (PST) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Message-Id: <5294D88C-F228-4603-9E10-7CA6AEE2D617@sn3rd.com> Date: Mon, 31 Dec 2018 11:42:17 -0500 To: emu@ietf.org X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: [Emu] The "SHA-256 assumption" in draft-ietf-emu-rfc5448bis X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Dec 2018 16:42:26 -0000 For this issue, I thought maybe it would be worth its own thread, but I = also submitted an issue for it [0]. Do not be alarmed I think there is = an easy fix. In =E2=80=9909 when RFC 5488 was published, the following was true: We assume that SHA-256 is at least as secure as SHA-1. But, sometime later in =E2=80=9909 the wheels started to come off / came = off of SHA-1 (but not SHA-256). Later, the IETF published RFC 6194 that = basically said SHA-1 is no-go unless it is used with HMAC. Since = EAP-AKA and EAP-AKA=E2=80=99 use HMAC should we tweak this sentence = mention HMAC? e.g., We assume that HAMC SHA-256 is at least as secure as HMAC SHA-1. We could also add a reference to RFC6194 assuming s3.3 still holds true? Or should we rename the assumption the HMAC-SHA-256 assumption? Cheers, spt [0] https://github.com/emu-wg/draft-ietf-emu-rfc5448bis/issues/10= From nobody Mon Dec 31 21:18:48 2018 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D2FF012D4F1 for ; Mon, 31 Dec 2018 21:18:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PPz8USR8upGX for ; Mon, 31 Dec 2018 21:18:45 -0800 (PST) Received: from p130.piuha.net (p130.piuha.net [193.234.218.130]) by ietfa.amsl.com (Postfix) with ESMTP id C0DAB12D4EF for ; Mon, 31 Dec 2018 21:18:44 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id 4887466025A; Tue, 1 Jan 2019 07:18:41 +0200 (EET) Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ChpW9BZQsLR6; Tue, 1 Jan 2019 07:18:40 +0200 (EET) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2001:14b8:1829::130]) by p130.piuha.net (Postfix) with ESMTPS id F08816601CE; Tue, 1 Jan 2019 07:18:39 +0200 (EET) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Jari Arkko In-Reply-To: <1379F403-7BAA-432C-A455-F5F1E530D9DE@sn3rd.com> Date: Tue, 1 Jan 2019 07:18:38 +0200 Cc: emu@ietf.org Content-Transfer-Encoding: 7bit Message-Id: References: <1379F403-7BAA-432C-A455-F5F1E530D9DE@sn3rd.com> To: Sean Turner X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [Emu] minor Issues/PRs for draft-ietf-emu-rfc5448bis X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Jan 2019 05:18:47 -0000 Thanks for your review, Sean. Jari