From nobody Fri Feb 1 04:20:24 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 467CE12DF72 for ; Fri, 1 Feb 2019 04:20:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.853 X-Spam-Level: X-Spam-Status: No, score=-8.853 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=N+YbQGNo; dkim=pass (1024-bit key) header.d=ericsson.com header.b=K5zEjv1L Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hB67qiZH-Uab for ; Fri, 1 Feb 2019 04:20:20 -0800 (PST) Received: from sesbmg23.ericsson.net (sesbmg23.ericsson.net [193.180.251.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F02C128CE4 for ; Fri, 1 Feb 2019 04:20:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1549023618; x=1551615618; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=ufW01UK4b2JOezA5fSjgZGI8+eUDA8x2aogkOSRhIZo=; b=N+YbQGNohN2beUxMFLLoRF3lz9C/IlDPrs5pZpawPsSDjgp28HsOZ45VxXKNBiTY DTHHXi0wdARjaZAMJCniVTG4/lHjUhQJznkl9S5PD1zCny1LEs/6SdbLAGlssCNd W+IDJz0UFendD76X8mkkaTG5ycFhErCd7LgffGXv74Y=; X-AuditID: c1b4fb25-209009e000005ff7-06-5c5439820b74 Received: from ESESBMB501.ericsson.se (Unknown_Domain [153.88.183.114]) by sesbmg23.ericsson.net (Symantec Mail Security) with SMTP id E6.2C.24567.289345C5; Fri, 1 Feb 2019 13:20:18 +0100 (CET) Received: from ESESBMR505.ericsson.se (153.88.183.201) by ESESBMB501.ericsson.se (153.88.183.184) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Fri, 1 Feb 2019 13:20:14 +0100 Received: from ESESBMB504.ericsson.se (153.88.183.171) by ESESBMR505.ericsson.se (153.88.183.201) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Fri, 1 Feb 2019 13:20:14 +0100 Received: from EUR03-VE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB504.ericsson.se (153.88.183.171) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Fri, 1 Feb 2019 13:20:14 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ufW01UK4b2JOezA5fSjgZGI8+eUDA8x2aogkOSRhIZo=; b=K5zEjv1LSrA5GE0UR1qQ3+vUMwX8QhG+NVTuhoSqgqYu3La7laW6UVW/6f5XlgMu6h/IGz+LxrfLZFiEIfvuTWi1DBtLsIXsawGyz+9SqqRaWdPDWLp4GkXb2IvB4PfSEsmLEantjs34KD2daH2Ap6lKLBkhYEKTqnZtWmtTTdg= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB4411.eurprd07.prod.outlook.com (20.176.167.140) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1580.13; Fri, 1 Feb 2019 12:20:12 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc%5]) with mapi id 15.20.1580.019; Fri, 1 Feb 2019 12:20:12 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: [Emu] Question about draft-ietf-emu-eap-tls13-03 && application data Thread-Index: AQHUuih7JlHfcLZuZ0+q4sD+9289AQ== Date: Fri, 1 Feb 2019 12:20:12 +0000 Message-ID: <752C2FF0-46B7-4A33-BF9E-D2AC9B52C8B2@ericsson.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.15.0.190117 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [192.176.1.88] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR07MB4411; 6:jXMu0z5PRbwdECIDvrvarrREuob+A1LWJiAN2GpBx3tiUDd6Pglyi4vNT2sqXQq5HGfw/xx5gEb9b6S+3Abp8tCVOUmHndm59q31enPBwkxoZ8qRvpUgu7u8NA1oed6GADIi+pJiUIyjMsILuCea9Q33md7uECgTMb2WkWK78MFq/1z730Lqy2wpAjkmcEh6w3vn7YcLp9qDNB6vTc+JR0NlUD5f+2r0U/khB6k3vdF6cxvmWAVUg0mPJcZK5r6wMj0hYsj7Im0hrsN5yeLl3hXgFMhJucriIL+UARQp7ECVibz4ihss6YiIMON1xmxlCbS3nO28hrcEG1NEsrJCQor8b/DU3nNySOoOG7sgtXqahg6u0X0/vqA1I/luO7TVoL42hWi1LNUTSnEeIzo+qINms0N+Qlub8aZ18a5VZpf0p5gvf4HjB+5FroFtE9DFxisMRQV/MHHwOvHvyd0KsA==; 5:35ZjAK8k1hkMR4mX/divvBK1qUolnW3I2YW3ZsV4Cdrl/VjMfPiFQkc/dXZXd3vzlXtY1vZIQjSIw3A7p1q63U9sFmLpoiFZMdSJ2WXeDaoBfK9T32fjc/9fCo4VqpTivG6u63+gD/Fwm5FiSNq0So/C4XZEjfwHmDpLy7yLUT/OUDXr5xKYi1vVzanwwxxq+luc6/VfX4u8Pb9qeDkgYQ==; 7:WqX+sSlVAKMcUXkUzdCSi+Gb0pKusapSkJ49CEQFnz6VRfIzHhkGl1cJ8ncRRSpYY+C5yPT5fpGEY6iFURNqvRkNgH5O3OPPJ7cQLtkE8MvpngzzfdW0W1iFM7ChgBE4DzcVn1wU8bmtI+3QeTWvzQ== x-ms-office365-filtering-correlation-id: 93c09171-625a-41b4-6f96-08d6883f9db4 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB4411; x-ms-traffictypediagnostic: HE1PR07MB4411: x-microsoft-antispam-prvs: x-forefront-prvs: 09352FD734 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(366004)(136003)(346002)(376002)(396003)(199004)(189003)(14454004)(8676002)(316002)(6916009)(256004)(478600001)(14444005)(53936002)(25786009)(6246003)(186003)(66066001)(2501003)(26005)(102836004)(1730700003)(81156014)(8936002)(81166006)(7736002)(86362001)(6506007)(229853002)(305945005)(58126008)(99286004)(2906002)(105586002)(71200400001)(6486002)(3846002)(6436002)(2351001)(44832011)(106356001)(36756003)(82746002)(6512007)(97736004)(2616005)(71190400001)(476003)(6116002)(68736007)(33656002)(83716004)(486006)(5640700003); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB4411; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: kdmuOymVYsxS62PA1K7P/Q0oJULpo+HryLUHMjbeTy6SuPpF9aEdQz6AUb7PqQZSYsAS2SqWtnEKlCb06ihllDbrzq0HRYfi224flPskudDqNGGNnWc5Xd5KYDj5rayYnUgA3STFcYxjFBUclrrNq8cOEAmfMdTexSndbabrVtXfzDZs2W7Z4XC0ZOpBVp2JrmTiGMYHrt9YXIpuL6CXKE2YmLXsnDYRJ1IHikBWRP6q2kQhFu11YD6QzA4zZjabureGTdvj2cJmuCr40azTBNwpRpNKxdtq9EL+1KF19W1US8jozdIJLyJVd1AnA499JwEwUh7u9qK//FfxTDq/TrJgSHHqIM8BwC6cef6ASLgH0jEMxDXceRsRd3ps8QNmeoIYdMkOBnvzoBchY8osevppZTqvRAqI1+n4Slszeac= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 93c09171-625a-41b4-6f96-08d6883f9db4 X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Feb 2019 12:20:12.7527 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB4411 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmplleLIzCtJLcpLzFFi42KZGbG9SLfJMiTG4MRKcYtj69eyODB6LFny kymAMYrLJiU1J7MstUjfLoEr4+m2J8wFW+Qqpk/+xd7AeEG2i5GTQ0LARGLLj13sXYxcHEIC RxglNq/fxwLhfGWUuLn/Myucc2XBaqjMYiaJ/skz2UH6WQQmMEs8b4gFsYUEJjNJTD3oA1H0 kFHi28udTCAJNgEDibl7GthAbBEBRYkfl9qYQWxhgWCJdTdXAU3lAIqHSNx5wQlRoiexatYu VpAwi4CKxMQ5ESBhXgF7ietg13FyMAqISXw/tQZsOrOAuMStJ/OZIN4RkFiy5zwzhC0q8fLx P1YQW1RAX+L38tNQvbESra3TWSFqFCTezT3NBmHLSlya380Icr6EQBO7xOMFz1kgEr4SH3se QzXcZJR49UIDwtaS+PfrPzuEnS0x5ddeqCNkJHb8uMsOMegyq8TD09eYIAGUKrF8bSsjRJGc xKrehywTGHVnIXliFtDPzAKaEut36UOEPSQO3upmhbAVJaZ0P2SfBQ4LQYmTM5+wLGBkXcUo WpxanJSbbmSsl1qUmVxcnJ+nl5dasokRmDgObvmtuoPx8hvHQ4wCHIxKPLzvlgXHCLEmlhVX 5h5ilOBgVhLhXSAVEiPEm5JYWZValB9fVJqTWnyIUZqDRUmc94+QYIyQQHpiSWp2ampBahFM lomDU6qBsUe/92lYWuGlkrAU5nVTu2re7O069jn3k900jew9d1lfrWINuXakJEq5/GidY+r8 9ezNjsvrex0Nrwu4aSVIfIhblJNuECucs/mBUF6r9jq2g2+MONq7jTlCDh2I5uKbd4ovznr9 V9PMP+WmN36+MlIJ7dKestdPf8G0Oe13qqISHx9zjdigxFKckWioxVxUnAgADfDsoRgDAAA= Archived-At: Subject: Re: [Emu] Question about draft-ietf-emu-eap-tls13-03 && application data X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Feb 2019 12:20:22 -0000 IA0KSGkgQWxhbg0KDQo+IEFsYW4gRGVLb2sgPGFsYW5kQGRlcGxveWluZ3JhZGl1cy5jb20+OyB3 cm90ZToNCj4NCj4+IFRoZSBtZW50aW9uZWQgcmVxdWlyZW1lbnQgY29tZXMgZnJvbSBTZWN0aW9u IDIuNCBvZiBSRkMgNTIxNiwgd2hpY2ggc3RhdGVzIHRoYXQ6IA0KPj4gDQo+PiAiU2luY2UgdGhl IGNpcGhlcnN1aXRlIG5lZ290aWF0ZWQgd2l0aGluIEVBUC1UTFMgYXBwbGllcyBvbmx5IHRvIHRo ZSBFQVAgY29udmVyc2F0aW9uLCBUTFMgY2lwaGVyc3VpdGUgbmVnb3RpYXRpb24gTVVTVCBOT1Qg YmUgdXNlZCB0byBuZWdvdGlhdGUgdGhlIGNpcGhlcnN1aXRlcyB1c2VkIHRvIHNlY3VyZSBkYXRh LiINCj4+IA0KPj4gSG93ZXZlciwgSSBkbyBub3QgcmVhbGx5IHVuZGVyc3RhbmQgd2h5IHN1Y2gg YSByZXF1aXJlbWVudCB3b3VsZCBiZSBuZWVkZWQuDQo+DQo+ICBJJ20gbm90IGV2ZW4gc3VyZSB3 aGF0IHRoYXQgcGhyYXNlIG1lYW5zLiAgU2VjdXJlICp3aGF0KiBkYXRhPw0KPg0KPiAgVGhlIG9u bHkgZGF0YSBpbiBxdWVzdGlvbiBpcyB0aGUgRUFQIGNvbnZlcnNhdGlvbi4gIFdoaWNoIGlzIHdo YXQgdGhlIGNpcGhlciBzdWl0ZSBuZWdvdGlhdGlvbiBwcm90ZWN0cy4NCj4NCj4+IEZvciBpbnN0 YW5jZSwgUVVJQyB1c2VzIHRoZSBUTFMgMS4zIGhhbmRzaGFrZSBjaXBoZXJzdWl0ZSBuZWdvdGlh dGlvbiB0byBuZWdvdGlhdGUgdGhlIGFsZ29yaXRobXMgdXNlZCBpbiBRVUlDLiBJZiB0aGlzIGlz IGEgcHJvYmxlbSwgd2Ugc2hvdWxkIGRpc2N1c3MgaWYgYW55IHVwZGF0ZXMgYXJlIG5lZWRlZC4N Cj4NCj4gIEkgd291bGQgZXhwZWN0IHRoYXQgVExTIG5lZ290aWF0ZXMgY2lwaGVyIHN1aXRlcywg YW5kIHRoZW4gdXNlcyB0aG9zZSBzdWl0ZXMgdG8gZXhjaGFuZ2UgYXBwbGljYXRpb24gZGF0YS4g IFdoaWNoIGlzIHdoYXQgd2UgbmVlZCBoZXJlIGZvciBvdGhlciBFQVAgdHlwZXMuICBBbmQgd2hp Y2ggaXMgd2hhdCBJIGJlbGlldmUgaXMgd2hhdCB3ZSBhbHJlYWR5IGhhdmUuDQo+DQo+ICBNeSAk MC4wMiB3b3VsZCBiZSB0byBmaWd1cmUgb3V0IHdoYXQgdGhhdCBwaHJhc2UgaW4gUkZDIDUyMTYg bWVhbnMuDQoNClNvdW5kcyBsaWtlIGEgcGxhbi4gDQoNCj5JIHN1c3BlY3QgaXQgKmRvZXNuJ3Qq IG1lYW4gdGhhdCBUTFMgMS4zIGNhbiBiZSB1c2VkIHRvIG5lZ290aWF0ZSB0aGUgaGFuZHNoYWtl LCBidXQgdGhlbiBhcHBsaWNhdGlvbiBkYXRhIHNob3VsZG4ndCBiZSBwcm90ZWN0ZWQgYnkgVExT Pw0KPg0KPiAgVGhhdCBkb2Vzbid0IG1ha2Ugc2Vuc2UuLi4NCg0KSWYgd2UgY2Fubm90IGNvbWUg dXAgd2l0aCBhIGdvb2QgcmVhc29uIHRvIGhhdmUgdGhlIHJlcXVpcmVtZW50LCBJIHRoaW5rIHdl IHNob3VsZCBjb25zaWRlciByZW1vdmluZyBpdCBpbiBkcmFmdC1pZXRmLWVtdS1lYXAtdGxzMTMu IGRyYWZ0LWlldGYtZW11LWVhcC10bHMxMyBhbHJlYWR5IGhhcyBhIHdob2xlIHBhcmFncmFwaCBq dXN0IHRyeWluZyB0byBtb3RpdmF0ZSB3aHkgdGhlIHVzZSBvZiBhbiBlbXB0eSBhcHBsaWNhdGlv biBkYXRhIHJlY29yZCBkb2VzIG5vdCB2aW9sYXRlIHRoaXMgUkZDIDUyMTYgcmVxdWlyZW1lbnQs IGFuZCBhcyB5b3Ugc2F5LCBpdCBnaXZlcyB0aGUgaWRlYSB0aGF0IG90aGVyIFRMUy1iYXNlZCBF QVAgbWV0aG9kcyBsaWtlIFRUTFMgLyBGQVNUIC8gUEVBUCAvIFRFQVAgaXMgZG9pbmcgc29tZWJv ZHkgYmFkLg0KDQo+SSdsbCBhbHNvIG5vdGUgdGhhdCBSQyA1MjE2IFNlY3Rpb24gMi40IG1lbnRp b25zIG1hbmRhdG9yeSB0byBpbXBsZW1lbnQgY2lwaGVycywgYW5kIHRoaXMgZHJhZnQgZG9lc24n dC4gIEl0IG1pZ2h0IGJlIHdvcnRoIGFkZGluZyB0aGF0LCBvciBhZGRpbmcgYSBub3RlIHJlZmVy ZW5jaW5nIGFuIGFwcHJvcHJpYXRlIHNlY3Rpb24gb2YgUkZDIDg0NDYuDQoNCmRyYWZ0LWlldGYt ZW11LWVhcC10bHMxMy0wMyBoYXMgdGhlIGZvbGxvd2luZyBwYXJhZ3JhcGggaW4gU2VjdGlvbiAy LjQ6DQoNCk9MRDoiV2hlbiBFQVAtVExTIGlzIHVzZWQgd2l0aCBUTFMgdmVyc2lvbiAxLjMgb3Ig aGlnaGVyLCB0aGUgRUFQLVRMUw0KcGVlcnMgYW5kIHNlcnZlcnMgTVVTVCBjb21wbHkgd2l0aCB0 aGUgcmVxdWlyZW1lbnRzIGZvciB0aGUgVExTDQp2ZXJzaW9uIHVzZWQuICBGb3IgVExTIDEuMyB0 aGUgY29tcGxpYW5jZSByZXF1aXJlbWVudHMgYXJlIGRlZmluZWQgaW4NClNlY3Rpb24gOSBvZiBb UkZDODQ0Nl0uIg0KDQpTZWN0aW9uIDkgb2YgUkZDODQ0NiBsaXN0IG1hbmRhdG9yeS10by1pbXBs ZW1lbnQgY2lwaGVyIHN1aXRlcywgc2lnbmF0dXJlIGFsZ29yaXRobXMsIGtleSBleGNoYW5nZSBh bGdvcml0aG1zLCBhbmQgZXh0ZW5zaW9ucy4gV2UgY291bGQgYWRkIHNvbWUgYWRkaXRpb25hbCB0 ZXh0IGJlIGFkZGVkIGRyYWZ0LWlldGYtZW11LWVhcC10bHMxMyB0byBjbGFyaWZ5IHRoYXQgdGhl IGNvbXBsaWFuY2UgcmVxdWlyZW1lbnRzIGluY2x1ZGUgY2lwaGVyIHN1aXRlcy4NCg0KTkVXOiAi V2hlbiBFQVAtVExTIGlzIHVzZWQgd2l0aCBUTFMgdmVyc2lvbiAxLjMgb3IgaGlnaGVyLCB0aGUg RUFQLVRMUyBwZWVycyBhbmQgc2VydmVycyBNVVNUIGNvbXBseSB3aXRoIHRoZSBjb21wbGlhbmNl IHJlcXVpcmVtZW50cyAoY2lwaGVyIHN1aXRlcywgc2lnbmF0dXJlIGFsZ29yaXRobXMsIGtleSBl eGNoYW5nZSBhbGdvcml0aG1zLCBleHRlbnNpb25zLCBldGMuKSBmb3IgdGhlIFRMUyB2ZXJzaW9u IHVzZWQuICBGb3IgVExTIDEuMyB0aGUgY29tcGxpYW5jZSByZXF1aXJlbWVudHMgYXJlIGRlZmlu ZWQgaW4gU2VjdGlvbiA5IG9mIFtSRkM4NDQ2XS4iDQoNCkNoZWVycywNCkpvaG4NCg0K From nobody Fri Feb 1 09:49:51 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2F5D131134 for ; Fri, 1 Feb 2019 09:49:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w5kuM3YRZifN for ; Fri, 1 Feb 2019 09:49:42 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id B5CC2131140 for ; Fri, 1 Feb 2019 09:49:36 -0800 (PST) Received: from [192.168.20.52] (ottawa.ca.networkradius.com [72.137.155.194]) by mail.networkradius.com (Postfix) with ESMTPSA id 17F362D16 for ; Fri, 1 Feb 2019 17:49:34 +0000 (UTC) From: Alan DeKok Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) Message-Id: Date: Fri, 1 Feb 2019 12:49:33 -0500 To: emu@ietf.org X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Feb 2019 17:49:45 -0000 This question isn't directly applicable to EAP-TLS, but it is related. There are multiple EAP methods that use TLS, and presumably all of = them will enable session resumption. The question is, what do we do = with cross-method session resumption? i.e. a user starts with EAP-TLS, and then tries to "resume" his = session, but this time uses TTLS. It's not clear that anything in the = spec forbids or prevents this. It's not clear if this resumption is an issue, but it should be = highlighted. The issue is made more difficult by the fact that session resumption = is usually done at the TLS layer. This means there is minimal ability = for the EAP layer to cross-check method types. If we do allow it, it should be called out explicitly in the EAP-TLS = document. If we don't allow it, we should find a way to forbid it. Alan DeKok. From nobody Fri Feb 1 13:26:11 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A341C126F72 for ; Fri, 1 Feb 2019 13:26:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WuETX9aaVg6d for ; Fri, 1 Feb 2019 13:26:07 -0800 (PST) Received: from mail-wr1-x42d.google.com (mail-wr1-x42d.google.com [IPv6:2a00:1450:4864:20::42d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 04FE3130EB4 for ; Fri, 1 Feb 2019 13:26:07 -0800 (PST) Received: by mail-wr1-x42d.google.com with SMTP id t6so8523959wrr.12 for ; Fri, 01 Feb 2019 13:26:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=WcDrYpuV1GA9zEebqIWM2bTmDQGN/dC+BYyDuX5X8mw=; b=q3gkBBwtPwKnp5Gs0okMhcoWyu8CukQokzRiepbyQcU33WqB8nZcVIWX8sDUETEnGz j/cu9JE8qqxToW7Txr0NIYGNjlf7nx+BSXCZEAZHxWuDSftD9kd0nawGQpa2ol81brWQ MqKxXp++tNoeBNahSTBLjGG/jG6Ty3ECmaiJoRD4Dmi0BJ+TXAVC4CjMKp3UNvas9psz PaxYDbWNvUX6yLdCOEHK9nNgEQ2MeZ3qWP0zsyjXbBK7uewQ6icLKsUAU/9vVHwBLF6i keOsssmISYpBDCNCEzqEzzi3YomC9MHv2tdff1Aid8Iqj5kWOwd/9TaVdy4rbViczYhS 3Cew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=WcDrYpuV1GA9zEebqIWM2bTmDQGN/dC+BYyDuX5X8mw=; b=CQv0tZQP/nxFmiuVJqQG9XvzRLcdxruH8/fOxjKHW+JngP3bjrmZIey6DixHtGVgEd Ds0Oz7hl1MXBAlXrtn1ulws2OORyg8geMW2VtI32FjnPPUxH9vp5sjQ5ykh9IsTlcOQV eNKs4Vp3mKA3tIa2XXTpZAUUBEmWmSo8PFzm9nOyPs37RZ3a+UXlTNfqBD027nAVRFRb nof/QrX9ycs5TJWiSo9FoomeS7gi6Y+2V/GJmIhZ1i2huwppU9O2fjSqH4tbzsB/8DAT 5hdHoduoBlkYFOjxhgnQfbCjNXWNfEqpR4go/1u8m/H5xkrOoTMdYpjlcuoTjksxE0Ww dtcA== X-Gm-Message-State: AJcUukfiiy7l0JVHohLVkvv3/xUGaKZfkeAPMbmxYu+n23CChKT4EyUw 9/5hG/TpxfW90wANnTKO4XWpj8NX/g++ydBhiSyD+8dR X-Google-Smtp-Source: ALg8bN6onjzOjVF4HwQYYlo7WwetHIeOw0wY/MF7NsfSa/6SEdtdoOKoefexTxLzv/W74kZ0Gm1XdXhaYQ6BpS1XTSc= X-Received: by 2002:adf:fe43:: with SMTP id m3mr39006690wrs.290.1549056365349; Fri, 01 Feb 2019 13:26:05 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Jouni Malinen Date: Fri, 1 Feb 2019 23:25:54 +0200 Message-ID: To: Alan DeKok Cc: emu@ietf.org Content-Type: multipart/alternative; boundary="00000000000064d2df0580dbcabb" Archived-At: Subject: Re: [Emu] Session identifiers for fast re-authentication X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Feb 2019 21:26:11 -0000 --00000000000064d2df0580dbcabb Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Jan 28, 2019 at 8:46 PM Alan DeKok wrote: > The EMU charter says: > > - Define session identifiers for fast re-authentication for > EAP-SIM, EAP-AKA, and EAP-AKA=E2=80=99. The lack of this definition > is a recently discovered bug in the original RFCs. > > I have recently uploaded a document which addresses this point. > > https://datatracker.ietf.org/doc/draft-dekok-emu-eap-session-id/ Thanks! As far as the [FILS] reference is concerned, it should be pointing to IEEE Std 802.11ai-2016. Which would be something like this in IETF RFC, I guess: IEEE, "IEEE Standard for Information technology--Telecommunications and information exchange between systems Local and metropolitan area networks--Specific requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications - Amendment 1: Fast Initial Link Setup", IEEE Std 802.11ai-2016. And a small typo in Section 2.3.1: "[RFC5247] id not define" should be "[RFC5247] did not define" For Section 3, it might be clearer to talk about enabling FILS or ERP rather than fast re-authentication. EAP-SIM and EAP-AKA as currently defined do allow fast re-authentication (the one defined explicitly for those EAP methods to be used), i.e., the case that is being enabled here is establishment of the ERP key hierarchy (which is needed for FILS) when using EAP-SIM/EAP-AKA fast re-authentication. In other words, replace the last sentence with something like: It therefore enables ERP key hierarchy establishment using fast re-authentication with EAP-SIM and EAP-AKA. - Jouni --00000000000064d2df0580dbcabb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, Jan 28, 2019 at 8:46 PM Alan DeKok <aland@deployingradius.com> wrote:
=C2=A0 The EMU charter says:

- Define session identifiers for fast re-authentication for
EAP-SIM, EAP-AKA, and EAP-AKA=E2=80=99. The lack of this definition
is a recently discovered bug in the original RFCs.

=C2=A0 I have recently uploaded a document which addresses this point.

https://datatracker.ietf.org/doc/dra= ft-dekok-emu-eap-session-id/

Thanks!

As far as the [FILS] reference is concerned, it shou= ld be pointing to IEEE Std 802.11ai-2016. Which would be something like thi= s in IETF RFC, I guess:
IEEE, "IEEE Standard for Inform= ation technology--Telecommunications and information exchange between syste= ms Local and metropolitan area networks--Specific requirements - Part 11: W= ireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specificat= ions - Amendment 1: Fast Initial Link Setup", IEEE Std 802.11ai-2016.<= /div>

And a small typo in Section 2.3.1: "[RF= C5247] id not define" should be "[RFC5247] did not define"

For Section 3, it might be clearer to talk about en= abling FILS or ERP rather than fast re-authentication. EAP-SIM and EAP-AKA = as currently defined do allow fast re-authentication (the one defined expli= citly for those EAP methods to be used), i.e., the case that is being enabl= ed here is establishment of the ERP key hierarchy (which is needed for FILS= ) when using EAP-SIM/EAP-AKA fast re-authentication. In other words, replac= e the last sentence with something like:
It therefore enables ERP= key hierarchy establishment using fast re-authentication with EAP-SIM and = EAP-AKA.

- Jouni

<= /div>
--00000000000064d2df0580dbcabb-- From nobody Sat Feb 2 03:50:21 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A31D5130E71 for ; Sat, 2 Feb 2019 03:50:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.854 X-Spam-Level: X-Spam-Status: No, score=-8.854 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=BcTC01c2; dkim=pass (1024-bit key) header.d=ericsson.com header.b=bmd8cb9j Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B9tDj6YH3P_z for ; Sat, 2 Feb 2019 03:50:18 -0800 (PST) Received: from sesbmg23.ericsson.net (sesbmg23.ericsson.net [193.180.251.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F336130E70 for ; Sat, 2 Feb 2019 03:50:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1549108215; x=1551700215; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=RT+qNjrtWMTWmz1YR9TUExDn0naB652C9NXnqw5eeZA=; b=BcTC01c2d2ZND4sibSYGiUou5wyXA7Sif6IzjtliFJFkvtDt4qGVbsq7bZE0I1gc /x7VWLMcwJaCbfIbUHKf7zG2NL3LXHxJ0y/BgqePPM1Pu3jbJtWZYQC91GTowEV8 KpPlasHeP9G0XfAjusAYmpK/UkHST0q3DGsrnl70bP4=; X-AuditID: c1b4fb25-d89ff70000005ff7-88-5c5583f7f47d Received: from ESESBMB502.ericsson.se (Unknown_Domain [153.88.183.115]) by sesbmg23.ericsson.net (Symantec Mail Security) with SMTP id 17.42.24567.7F3855C5; Sat, 2 Feb 2019 12:50:15 +0100 (CET) Received: from ESESSMR501.ericsson.se (153.88.183.108) by ESESBMB502.ericsson.se (153.88.183.185) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Sat, 2 Feb 2019 12:50:15 +0100 Received: from ESESBMB505.ericsson.se (153.88.183.172) by ESESSMR501.ericsson.se (153.88.183.108) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Sat, 2 Feb 2019 12:50:15 +0100 Received: from EUR03-DB5-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB505.ericsson.se (153.88.183.172) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Sat, 2 Feb 2019 12:50:15 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RT+qNjrtWMTWmz1YR9TUExDn0naB652C9NXnqw5eeZA=; b=bmd8cb9jAJZ4GEgaF6OBB7tKqeT1cr8IBCpnCO06BVS1kO087WTUWteOI3k/TIPSOGiGOeq6m8WCwbYWkT+g9pOpH4EEABnoc4VuomjPlHVY65KIaH//TnPaO5RqhKyGUDJmC1IZOgrvc2w7BZO/08+vJHzR15+eJ8Lr02iu+Zc= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3388.eurprd07.prod.outlook.com (10.170.247.27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1580.13; Sat, 2 Feb 2019 11:50:14 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc%5]) with mapi id 15.20.1580.019; Sat, 2 Feb 2019 11:50:14 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: [Emu] Notes on session resumption with TLS-based EAP methods Thread-Index: AQHUuu119ihdWwBfjkShvh+NKpE/rQ== Date: Sat, 2 Feb 2019 11:50:13 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.15.0.190117 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR07MB3388; 6:LLa0VUK5A5plYWN4Juj79nasLo6orx+k1Ur9QNe6bG2dw4NqqP8N683BdDPpF2HJGOWK2Sr8ahfrsVr5DImu+Vt4W+/B5zHnOWOzXZTIFNjQUWuGhjqufd9A7j8Vp02X+SAxIwPScbXCcu18hjfcWNaBjO3/PzxN1BDMWc15ZiveySumaMGDF2TwOhY5gWtrxHpj0JQHewp1YxRUZRsjf9MR5VnnMAaj6YRd2lI9W/by/vdSOrmTd0E/6ZaclkbLHwYwYiQMmST31JVFXJyTvQtXDS/zvAiLh467s6dkCnBNpyrXyXbO+vBb9LON+yEEGtJPAv28yXGybeSdAF+zjoKKHelN1+WcHqyDR3Yr+BaOeGs7cs7cC1OM/iVKh/7ptdeYzNcXZFniDJ9yyEY2mQLQ/nr3ly2fVzFi5piUgsjIISvb+TN1UxuROBUQha6rJDV1mKFj7LOkKD+X4eixIg==; 5:HRHYYQhoEes9anDSDA605pDekHDgBAOnCPJy2i3sh6OnZBT/BqocaKBdVV2xKE93F5x5SzFiqc8yNzw5WnHruoG+e74IgMiE8r3kq+CVISvDJP8xN2T/ggUTNsm4G3ILlPYz2dGgiiOd1JY+Pd8J8n6oa6vydlRLYzV/3CRCGSN4oXmn+bpVjhlB0ScaqOZhJvyvn8W7AlCMzhfYZD6+BA==; 7:5EY2+J8v4E96tCdwBjvNxP0Gc32Z2SCCYK5nSubZ2sw6AXXsIrRYx+Jn+JK2CFIxTrkSWg4p9Xow2nGtg6XU+S5gxPjeY3gsYv2ROdyfyOB7sxKNLUlezeIS4Sx45yyjTP1NnbQIblMXbdpvf3V55A== x-ms-office365-filtering-correlation-id: cf4c0efd-8f92-411d-bad1-08d6890497dc x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3388; x-ms-traffictypediagnostic: HE1PR07MB3388: x-microsoft-antispam-prvs: x-forefront-prvs: 09368DB063 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(136003)(376002)(39860400002)(366004)(346002)(189003)(199004)(2616005)(256004)(82746002)(476003)(14454004)(71190400001)(71200400001)(14444005)(83716004)(6246003)(53936002)(6916009)(25786009)(66066001)(36756003)(486006)(105586002)(2351001)(106356001)(97736004)(33656002)(478600001)(2501003)(5640700003)(3846002)(6116002)(68736007)(6512007)(44832011)(6436002)(6486002)(58126008)(26005)(316002)(186003)(102836004)(6506007)(305945005)(2906002)(8676002)(81166006)(7736002)(1730700003)(81156014)(86362001)(4744005)(99286004)(229853002)(8936002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3388; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: OUxTZIWd0QKz1NtxF8i81U5WrGuuYimsGDxzUUhf16oztga1+7AfHtXVAaTBZ6dHEeQ5GLhGf62MftXLrz6xFlcJl5H2e/1LhV7J6PrhTr2NaqRpMKZd0Y2cIjqK+udBM5XITbnkaChVMCEhxZVNzlnddd6vDK3MPfqHSbA/i3Yeq9aDrudlcZXf3vXrOSN5NfnFtjdXwqYQzwwJ1kq/hO8KdmLhE08uynBVLn4fz2I/hmcMASkrRXFkLi7fckEHL0cPMFj9f6MNrwyNr1YJiT1ctP/FIcxiVkSnLEdEyt98hqqLu/TlijWs4sfCkSYmPw8/Qxn02mCMkHtfsprZ4QuP3iOKZrSl+kzfSWfB7//WKgMh+/jKTfmyOyF1YOe1YWPb+xfLbD09WUyILGeetGDG6aw9IHT8HkMrwmtn+Vk= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: cf4c0efd-8f92-411d-bad1-08d6890497dc X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Feb 2019 11:50:13.8072 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3388 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmplleLIzCtJLcpLzFFi42KZGbG9WPd7c2iMwcM5qhbH1q9lcWD0WLLk J1MAYxSXTUpqTmZZapG+XQJXxswTs1kLFrFVnH1ylamBsYeti5GTQ0LARGL7xU9gtpDAEUaJ pkelXYxcQPZXRomjPSsZ4ZwP31axQjiLmST+nOgCc1gEJjBLXO1YywKRmQSUObmYCWLYQ0aJ bZd9QGw2AQOJuXsawJaICChK/LjUxgxiCwt4SmxddQYq7iUx59RHFghbT+J7432wGhYBFYnr v5eD1fAK2Es09kwBizMKiEl8P7UGbBezgLjErSfzmSAeEpBYsuc8M4QtKvHy8T9WEFtUQF/i 9/LTLBC9sRKtrdNZIWoUJU7vWwFVLytxaX432M8SAk3sEpdezIQa6isxtWUhVOImo8TuH/+h EloSGyc1AHVzANnZEquXRUGYMhKv13pAlN9hlfg2dRs0hFMllq9tZYRolZNY1fuQZQKj7iwk P8wCamcW0JRYv0sfwvSQuHjbHKJCUWJK90P2WeCQEJQ4OfMJywJG1lWMosWpxUm56UbGeqlF mcnFxfl5enmpJZsYgYnj4JbfqjsYL79xPMQowMGoxMOrkhcaI8SaWFZcmXuIUYKDWUmEtzcX KMSbklhZlVqUH19UmpNafIhRmoNFSZz3j5BgjJBAemJJanZqakFqEUyWiYNTqoGxPc85Z9rs m3/O7izYMOXDghW9JoynpPfd8XT/LVTSypJu+kRPgaWRb9PLv7s52pieJVVEfY5wrllt98zS 0zBF46f+6R/B0XZ71l3p/u5jcNIklcWo0cfQXkv46Uz30g2fGrymxanHBXQyn1U+ZF6735Mx qkm6la+S9WDIli8mf9YyJnzu4lZiKc5INNRiLipOBADix0VAGAMAAA== Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 02 Feb 2019 11:50:20 -0000 SGkgQWxhbiwNCg0KVmVyeSBnb29kIHRoYXQgdGhpcyBpcyBkaXNjdXNzZWQgYW5kIGhpZ2hsaWdo dGVkLg0KDQpNeSB1bmRlcnN0YW5kaW5nIGlzIHRoYXQgVExTIGl0c2VsZiBjbGVhcmx5IGFsbG93 cyBhIHJlc3VtZWQgY29ubmVjdGlvbiB0byBiZSB1c2VkIGZvciBhIGNvbXBsZXRlbHkgZGlmZmVy ZW50IHB1cnBvc2UuIFRoZSBBTFBOIHNwZWNpZmljYXRpb24gKFJGQyA3MzAxKSBzYXlzIHRoYXQ6 DQoNCiJXaGVuIHNlc3Npb24gcmVzdW1wdGlvbiBvciBzZXNzaW9uIHRpY2tldHMgW1JGQzUwNzdd IGFyZSB1c2VkLCB0aGUgcHJldmlvdXMNCmNvbnRlbnRzIG9mIHRoaXMgZXh0ZW5zaW9uIGFyZSBp cnJlbGV2YW50LCBhbmQgb25seSB0aGUgdmFsdWVzIGluIHRoZQ0KbmV3IGhhbmRzaGFrZSBtZXNz YWdlcyBhcmUgY29uc2lkZXJlZC4iDQoNCkkgZG9uJ3Qga25vdyBob3cgaW1wb3J0YW50IHRoaXMg ZmVhdHVyZSBpcyBpbiBFQVAsIGJ1dCBpZiBpdCBpcyB1c2VmdWwgYW5kIGRvIG5vdCBjYXVzZSBz ZWN1cml0eSBwcm9ibGVtcywgd2Ugc2hvdWxkIHByb2JhYmx5IG5vdCBmb3JiaWQgaXQuDQoNCkNo ZWVycywNCkpvaG4NCg0K From nobody Sat Feb 2 06:26:33 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A1BC126BED for ; Sat, 2 Feb 2019 06:26:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d0xVJ5yRQvTZ for ; Sat, 2 Feb 2019 06:26:29 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 46ED3124BE5 for ; Sat, 2 Feb 2019 06:26:28 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 43F098D0; Sat, 2 Feb 2019 14:26:27 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: Date: Sat, 2 Feb 2019 09:26:25 -0500 Cc: "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <5CD1558B-B912-459D-95C4-2BF49EBADD0A@deployingradius.com> References: To: John Mattsson X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 02 Feb 2019 14:26:32 -0000 On Feb 2, 2019, at 6:50 AM, John Mattsson = wrote: > Very good that this is discussed and highlighted. >=20 > My understanding is that TLS itself clearly allows a resumed = connection to be used for a completely different purpose. The ALPN = specification (RFC 7301) says that: >=20 > "When session resumption or session tickets [RFC5077] are used, the = previous > contents of this extension are irrelevant, and only the values in the > new handshake messages are considered." >=20 > I don't know how important this feature is in EAP, but if it is useful = and do not cause security problems, we should probably not forbid it. I would suggest then referencing or duplicating the above text, and = saying something like: --- Implementations SHOULD be capable of session resumption across different = TLS-based EAP types. This recommendation is made for a few reasons. It = is recommended by [RFC7301], there appears to be no compelling reason to = forbid it, and implementations can always choose to reject session = resumption based on local policies. Some EAP types have complex state and negotiation. For this EAP types, = session resumption across different EAP types may not be possible, and = if not possible, MUST be forbidden by both specifications and = implementations. Additional discussion of this topic is outside of the = scope of this document. --- e.g. TTLS and PEAP both allow session resumption, and when done, skip = the phase 2 / inner-tunnel authentication. In contrast, FAST and TEAP both still require phase2 to occur after = session resumption. The session resumption there is just used to skip = the TLS negotiation. And the MSK / EMSK depends on the inner tunnel = authentication methods, so the TLS-Exporter() function needs more than = just the TLS parameters. Alan DeKok. From nobody Sat Feb 2 09:03:23 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD329126C7E for ; Sat, 2 Feb 2019 09:03:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.854 X-Spam-Level: X-Spam-Status: No, score=-8.854 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=f/0DLmJf; dkim=pass (1024-bit key) header.d=ericsson.com header.b=eNKn8+FC Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M_b8QobB2C_J for ; Sat, 2 Feb 2019 09:03:19 -0800 (PST) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DCA6C126BED for ; Sat, 2 Feb 2019 09:03:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1549126997; x=1551718997; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=GMBuTbhXHw7lyGRVIkaS45coDzPfDiDWN/ZROoOmxQY=; b=f/0DLmJflgwI2WJjY3SCOr7yQZTnjKYjRP9ItcHqNb02WqCi9AsyUZRa1qH0ZlP3 Px0XfLKm8NBlhdbs6eDOsPZcJqTfeQ4g7+rg3PMGbaWY+gRLVamjvLd309Rz+byC gKTQzUrS7rwyRAv9Mf2VjiXAZ/7nzMOCgqefWd86lIw=; X-AuditID: c1b4fb2d-db5ff7000000062f-f1-5c55cd551da4 Received: from ESESSMB504.ericsson.se (Unknown_Domain [153.88.183.122]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id 8A.B0.01583.55DC55C5; Sat, 2 Feb 2019 18:03:17 +0100 (CET) Received: from ESESBMB502.ericsson.se (153.88.183.169) by ESESSMB504.ericsson.se (153.88.183.192) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Sat, 2 Feb 2019 18:03:16 +0100 Received: from EUR02-HE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB502.ericsson.se (153.88.183.169) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Sat, 2 Feb 2019 18:03:16 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GMBuTbhXHw7lyGRVIkaS45coDzPfDiDWN/ZROoOmxQY=; b=eNKn8+FC7NnCs+DEAExSxVEwKyOO3/CM/a0v+zBFhtzPHblSWVNkSEoaDT02qzPyCkzborCRe63hECFi+Saq5pGmdXUKO06cbkJZRDLTwXZC3amUI6cE+myB6KOSOmGieHebpbEStBuFQ/UyuQxBMndFLO83I0anclNs+Crkxt4= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3418.eurprd07.prod.outlook.com (10.170.247.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1580.14; Sat, 2 Feb 2019 17:03:14 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc%5]) with mapi id 15.20.1580.019; Sat, 2 Feb 2019 17:03:14 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: [Emu] Notes on session resumption with TLS-based EAP methods Thread-Index: AQHUuxkvIfH109X2qUSgGqnxeo1jyw== Date: Sat, 2 Feb 2019 17:03:14 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.15.0.190117 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR07MB3418; 6:QtTyA3y85o3Pt9iyVkLJwoPYP3ib1sR7NHC7W3bNy4CZ/3pGdCSZAjYkDF3UlYNfqe2r8zXTcNrS8YvA3H1JpN5G/DJ17tvC+xym3KfLah5lkXo6ZNjZ2aKhuZtQVAlz8+a97bkm1BKdYjFF8H48AOQtuyejjZEbVh5x/l3/rOwxIPad6NlZouw8kIYPYRB51dTi/Kq4KqFBsVW4oN6VIboUziBU+WovcKezETl8XL0vYWKNMtQUvcYHd4oQ0TpQ5UC9XF8nEORyUpIjjbKvw26sRgPsDXCrrJXHVvdBcWdE+LtEXZSuw5xqN0Ev63iDnvcMIzBEFCqbdNbqbaI6VkEgjkRBrko2a3yL8Z5Xejd4iz0U4vUHUh8BakzOdGk+e23tVmGNMRoGspKgvaaw4C26JQVtQKWSx7kF8B14QKpgdQdAI4Iq5BPztaaOsjk/KmJ/BboZSQ4E8vzks2uDpA==; 5:Smus9twF8PNIxld5qf2DlDtrClTzE24jDmZKbm4uRUbK9BuMIeaZgH8Q4ctlPysVp+ktUb+s2nu9YHV7OWBmuVELmxHstU3BX+6q2CkDgtDCWZab7e21oFz6tTKXNZl7XbU0LEMMHilHr1yPiTb8V/Y3RWq5NfY5fYRgeFu/B/0z1MZebIp/JowYJo68ruqts2eYazQFXCWJvypsBLQ6Gw==; 7:qIJyrTIgxf/Va6QJn4Ebsz0op+sWdYEadLnrXNqgNH0+HcYfejRHqRpdpXGvT0/ioPNiJkrMRgFouG9Vo38QjYplZpo125F80jIaaqU40F90tkXKWU33jljjz8YOuqakBBuw/AgCXNUUM1UNwz51TA== x-ms-office365-filtering-correlation-id: c8fec5ce-d994-47a6-74b7-08d6893051ff x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3418; x-ms-traffictypediagnostic: HE1PR07MB3418: x-microsoft-antispam-prvs: x-forefront-prvs: 09368DB063 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(136003)(366004)(39860400002)(346002)(396003)(189003)(199004)(6246003)(2351001)(106356001)(105586002)(14454004)(6116002)(8936002)(33656002)(478600001)(99286004)(229853002)(14444005)(3846002)(256004)(26005)(8676002)(186003)(1730700003)(81156014)(81166006)(58126008)(102836004)(6506007)(68736007)(2906002)(82746002)(2501003)(53936002)(44832011)(486006)(6916009)(2616005)(83716004)(71190400001)(71200400001)(97736004)(36756003)(25786009)(316002)(7736002)(476003)(305945005)(6486002)(86362001)(66066001)(5640700003)(6436002)(6512007); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3418; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: vY4GbcehZeFaXo7Yg9MjMeOCZa0p82Mj0iFRxoVZnDG/mKl9KxJsihvVkVv1WcDq1A8F/IV6PKZCM3N6mRZ6K+AFt3hds4Ju8l4ADOkAlk12bgQzebXDuDmN+7TudplmswJr+E4gmcjpJQzkQIEgDSX/CAen6gpfZ6qBMUYh68A9V9o0b3fCpC3bE73JWkpCNVD7kL25rHU30EDAzPgAOpDbqON13y6UuTDkji0U7SAJRu4W9qF6oq5rdQ04q+sNmpkw03iXcmT72wV/Wu5VY7DBzQL1ZgjineZVhSBPfNcJ3WGP37BP7FX9oPhfv/qSnbhezKGgTDHya/rO7YZiuOACAtRnBmLUA6UUNHA+GfC0CfDwgkvPIMp637wkXeoTaZsvRRuyyy9TjqS+kkc/lNpyQrd4mbhxTfTpP6o92hc= Content-Type: text/plain; charset="utf-8" Content-ID: <04EEED99B8BB264984E063DD4770E6BE@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: c8fec5ce-d994-47a6-74b7-08d6893051ff X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Feb 2019 17:03:14.4473 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3418 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA02Sa0hTYRjHe89lHpej1+n0SVPY6EuSc9mFGFHmh7QgjGARYpehBzV1jnPM 1L5soxmomaiQm4pBhrK2FPFWWNnQLmqa9sXSoumopkaUWYlS7XgW9O33/J/fe3leXoaUl9NR TK6hiOUM+nyVRErZTveVxete6DI07nZq/5MOF5WEUltbV4kTKF16IIvNzy1muYSD56U539YH kLEal1R6RwkTmt5SgYIZwHugrstLVSApI8dDCIbb3bRYrCDwDq6RYnGLgM5an0QoKFxDwuT1 xoBWS8B725BE2EyOPQjM5iCBJVgDzQOmjTwcK+HXVDkpcBg+Cj2OsUB+DJpGvlIiq+Hj7BhR gRj/CdthuTVUiGX4EFT7rITACEfAzxHnBpM4Et54WwhxBgytAxOkyArwzf+mBVbgBFhrG6XE tWfAar1Bi44SRh+2B/wYmGqpRMIsgC1B4HpUFZCOw5+FpUDjNYKuTxYkXA5wHHgeBJw86J3r l4jxNlh0pYr6Kxpqhz8T4puw0OayItGPBcc1DyVKEySMNDyja9BO+38D2f17kXgHdNxPEONU sDiXCZGVUF/pCbJvvEsoPLd5qZuIdiAFz/J8QXbibjXL5WbyfKFBbWCLupD/dzzuXovvR3cW D7sRZpAqRKa16TLktL6YLy1wI2BIVbiMbfZHsix9aRnLFZ7jLuazvBtFM5QqUrYuD82Q42x9 EZvHskaW+9clmOAoEwr7kp5oj52L+74pZmbSmDyRXb9UrJnP016YTTGdkr5rQh80kS/vanl6 dWao8a2y6uQlbm/DPZu2yjy+ejXE8kOpzpzPmk4vSVs2HtG6B+t0qyW+3Mul0aN1DWbOEZ+y uedKSlOnuTP5bFphkmWrxel82rugda2Mj9zu2xeh6FZRfI5+VxzJ8fq/b6IOBhkDAAA= Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 02 Feb 2019 17:03:22 -0000 QWxhbiBEZUtvayA8YWxhbmRAZGVwbG95aW5ncmFkaXVzLmNvbT47IHdyb3RlOg0KDQo+SSB3b3Vs ZCBzdWdnZXN0IHRoZW4gcmVmZXJlbmNpbmcgb3IgZHVwbGljYXRpbmcgdGhlIGFib3ZlIHRleHQs IGFuZCBzYXlpbmcgc29tZXRoaW5nIGxpa2U6DQo+DQo+LS0tDQo+SW1wbGVtZW50YXRpb25zIFNI T1VMRCBiZSBjYXBhYmxlIG9mIHNlc3Npb24gcmVzdW1wdGlvbiBhY3Jvc3MgZGlmZmVyZW50IFRM Uy1iYXNlZCBFQVAgdHlwZXMuICBUaGlzIHJlY29tbWVuZGF0aW9uIGlzIG1hZGUgZm9yIGEgZmV3 IHJlYXNvbnMuICBJdCBpcyByZWNvbW1lbmRlZCBieSBbUkZDNzMwMV0sIHRoZXJlIGFwcGVhcnMg dG8gYmUgbm8gY29tcGVsbGluZyByZWFzb24gdG8gZm9yYmlkIGl0LCBhbmQgaW1wbGVtZW50YXRp b25zIGNhbiBhbHdheXMgY2hvb3NlIHRvIHJlamVjdCBzZXNzaW9uIHJlc3VtcHRpb24gYmFzZWQg b24gbG9jYWwgcG9saWNpZXMuDQo+DQo+U29tZSBFQVAgdHlwZXMgaGF2ZSBjb21wbGV4IHN0YXRl IGFuZCBuZWdvdGlhdGlvbi4gIEZvciB0aGlzIEVBUCB0eXBlcywgc2Vzc2lvbiByZXN1bXB0aW9u IGFjcm9zcyBkaWZmZXJlbnQgRUFQIHR5cGVzIG1heSBub3QgYmUgcG9zc2libGUsIGFuZCBpZiBu b3QgcG9zc2libGUsIE1VU1QgYmUgZm9yYmlkZGVuIGJ5IGJvdGggc3BlY2lmaWNhdGlvbnMgYW5k IGltcGxlbWVudGF0aW9ucy4gIEFkZGl0aW9uYWwgZGlzY3Vzc2lvbiBvZiB0aGlzIHRvcGljIGlz IG91dHNpZGUgb2YgdGhlIHNjb3BlIG9mIHRoaXMgZG9jdW1lbnQuDQo+LS0tDQoNCkdvb2Qgc3Vn Z2VzdGlvbiwgSSdsbCBhZGQgc29tZXRoaW5nIGxpa2UgdGhhdCB0byB0aGUgcmVzdW1wdGlvbiBz ZWN0aW9uIGluIGRyYWZ0LWlldGYtZW11LWVhcC10bHMxMw0KDQoNCj4gZS5nLiBUVExTIGFuZCBQ RUFQIGJvdGggYWxsb3cgc2Vzc2lvbiByZXN1bXB0aW9uLCBhbmQgd2hlbiBkb25lLCBza2lwIHRo ZSBwaGFzZSAyIC8gaW5uZXItdHVubmVsIGF1dGhlbnRpY2F0aW9uLg0KDQpUaGF0IHNlZW1zIGxp a2UgaXQgY291bGQgYmUgYSBzZWN1cml0eSBwcm9ibGVtIGluIHNvbWUgaW1wbGVtZW50YXRpb25z IGFzIGNyb3NzLW1ldGhvZCByZXN1bXB0aW9uIGlzIG5vdCBkaXNjdXNzZWQgYW55d2hlcmUgYW5k IFRUTFMgYW5kIFBFQVAgc2F5cyB0aGF0IGlubmVyLXR1bm5lbCBhdXRoZW50aWNhdGlvbiBpcyBz a2lwcGVkIGZvciBUTFMgcmVzdW1wdGlvbi4uLg0KDQpZb3VyIHBsYW5uZWQgZG9jdW1lbnQgb24g VExTIDEuMyBmb3Igb3RoZXIgRUFQIG1ldGhvZHMgc2hvdWxkIGhhdmUgc29tZSB0ZXh0IGRlc2Ny aWJpbmcgdGhpcy4gUmF0aGVyIHRoYXQgZm9yYmlkZGluZyBjcm9zcy1tZXRob2QgcmVzdW1wdGlv biBmb3IgVFRMUyBhbmQgUEVBUCwgSSBhc3N1bWUgb25lIGNvdWxkIGp1c3Qgc3BlY2lmeSB0aGF0 IGlubmVyLXR1bm5lbCBhdXRoZW50aWNhdGlvbiBtdXN0IGJlIGRvbmUgYWZ0ZXIgY3Jvc3MtbWV0 aG9kIHJlc3VtcHRpb24uIE9yPw0KDQo= From nobody Sun Feb 3 04:46:20 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D24DD128CF3 for ; Sun, 3 Feb 2019 04:46:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.854 X-Spam-Level: X-Spam-Status: No, score=-8.854 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=c5Ew5N/6; dkim=pass (1024-bit key) header.d=ericsson.com header.b=hYqEARiM Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UOmMmNyf4t8M for ; Sun, 3 Feb 2019 04:46:16 -0800 (PST) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E4BE31271FF for ; Sun, 3 Feb 2019 04:46:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1549197973; x=1551789973; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=R2jEkmY/WYEHimGDoyDQNX0BSlWAo0GoI119iDcLkoE=; b=c5Ew5N/6MA9x0oAXexndY0ckei3maMWwppLNE0p1bvECH/bBfUAvD2hen4aojJqZ oG8eAcbuT8m9fXY0bzxAPw/2YK9f0I43lefkm8k9s4L7BpvgutSBp5Pkpg3MtHwD xt+d/FcsUDsezZO1UZQHPtuzUCtsUzJ+nYA0mXG4lHs=; X-AuditID: c1b4fb2d-d9dff7000000062f-6c-5c56e295bbc1 Received: from ESESBMB502.ericsson.se (Unknown_Domain [153.88.183.115]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id 2A.05.01583.592E65C5; Sun, 3 Feb 2019 13:46:13 +0100 (CET) Received: from ESESBMR506.ericsson.se (153.88.183.202) by ESESBMB502.ericsson.se (153.88.183.185) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Sun, 3 Feb 2019 13:46:13 +0100 Received: from ESESSMB505.ericsson.se (153.88.183.166) by ESESBMR506.ericsson.se (153.88.183.202) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Sun, 3 Feb 2019 13:46:13 +0100 Received: from EUR04-DB3-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB505.ericsson.se (153.88.183.166) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Sun, 3 Feb 2019 13:46:13 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=R2jEkmY/WYEHimGDoyDQNX0BSlWAo0GoI119iDcLkoE=; b=hYqEARiMgS8bGvMyr0AWV1TqlgKy+5b9EKb2lnnrp2oMuqAwuzKp7bWoBhpSgt7FZllApq6lJ30Qe1vkEaQheEsEv0skJIrhrew02uMK1mjR3Xv/gHh+kXz3YUuWMYMaZ60tOs0dZbcMyS1KM+4Uq9FXFOD9LaFCHejx7El1OuM= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB4393.eurprd07.prod.outlook.com (20.176.167.30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1580.13; Sun, 3 Feb 2019 12:46:11 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc%5]) with mapi id 15.20.1580.019; Sun, 3 Feb 2019 12:46:11 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: [Emu] TLS 1.3 and other EAP methods Thread-Index: AQHUu75w2MYK3esDb0eCkRlqNTnh1w== Date: Sun, 3 Feb 2019 12:46:11 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.15.0.190117 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR07MB4393; 6:qluW0LPz+EMSSVciRFmrSnmc9RrMkDnXo9npQwivnav4SG9w3xCbIYtZgl2eg6j31T+//cRA5eBrhInVJsyO11LVggiACxE9sZAKlEHgNUOGAtH1blZ4XPtzvl7HAQvwYPQmc9L7xBT1tCq7slGMAV0+xXQs0CzYZwTpPeAluZUiM4MeXtcQhFZm1MfJcuUlVOdaXnau8YHnmtcyFttxxmWkxqUibfAu9/BMJh5G7/CJQmBlWhotsQ4ywL+0KbD+5ti9CKoMEOCgQ59YLVGBNZqNWeKip2CG1D4SQhueuWReogRm/Qi0fvDsOJ4sD/7dj69a5a7kOrWAEx0vn2FZhQr6LeV2RrZ+SS0bsE4hKxhumEwRPbPPbtMM8WcnLNx/6c3glST5f5/IxRD67i/S+dI1aNSjnuFhrr34BNXdEUPTzDFdhF97EZFVIk9ybsKpeQovDMIPXq+MnbXNYaZ8FQ==; 5:8oaYOpvvTIrh62m4c4q24LNo+VGGen4VPzrOdto5pXDTksiarwFVbq1V1gGmD9pwamvaWej87PCmFmhBNhj453nNCCl75BBjX8OoDqknDzjna7v+i4RpfWFTecK0MsUA1bY3YeEwd6pgbPUrG2sHOTZjLItPCgYlc51U/OzKggab9c/kXP9ns07l0ViGJt3SlxgeGO3HY4LlVvrHtMyVCA==; 7:viqlURkedZPMr0BNB784CoXKr5qKn0hb8HPLb3n38D1mS4wRhSWMLSUsEZA7b9bRytQy8yeQkkS4f5sILH5uU3HCTsT87WSIQ/1zLmXVlwN00AyIGNBvm49vAtt8e50nV1UVR94rE5cPpyr3NX4N/g== x-ms-office365-filtering-correlation-id: 7bc0331b-34e4-480b-ae92-08d689d59352 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB4393; x-ms-traffictypediagnostic: HE1PR07MB4393: x-microsoft-antispam-prvs: x-forefront-prvs: 0937FB07C5 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(346002)(376002)(136003)(366004)(39860400002)(189003)(199004)(476003)(102836004)(6506007)(2906002)(53936002)(105586002)(2501003)(256004)(486006)(2616005)(186003)(106356001)(6246003)(6916009)(26005)(2351001)(36756003)(1730700003)(68736007)(81156014)(6512007)(8676002)(66066001)(81166006)(83716004)(25786009)(8936002)(7736002)(6486002)(6436002)(316002)(58126008)(97736004)(478600001)(14454004)(3846002)(6116002)(44832011)(71200400001)(71190400001)(305945005)(4744005)(82746002)(33656002)(5640700003)(99286004)(86362001)(229853002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB4393; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: tLjEcRQO9jlV2U+9IWhTjnzoVvPdOV9QqFLxAXXDGkJnl8xtpaikhtY1X3FP5lSAvvFbc01gg/f413Ud6NXIpoQYAAfwPCYRRcb6YP8aI7mY1EETQpgEtLkJK7NH2MCPOYIb1h42MJmo9r3lUU0T62luWCf/LLc1o6u9h+iXTirDTGzRR6GhA6nMFxSyrS2s/fVoOE0rwxsMPVgnbDYwZsZJujWpGOtt9dcs7W7rIPqIGCo9vwcfYU/OJ+wemae6G3bvyefadwbP3kZXoS4KsbME1DaV9iQXGuecI4AzIOjoW+MfMOkw0VG2h+WhJZZizPAcQglpaz2iTIzmehtTzXTG7lQgN+Perzq7awGce2kjl9sEVoHSI/gAaAGyrrt3DZJtkhT9YQqq0dUBwfFPkuNlHYAT47WzoGUtCFGPo3g= Content-Type: text/plain; charset="utf-8" Content-ID: <2909556FF21A1D4FAEC59A2FBE3D9921@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 7bc0331b-34e4-480b-ae92-08d689d59352 X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Feb 2019 12:46:11.1842 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB4393 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA01Sa0hTYRjuO5ftOFod5+1VU3D0J8tr/WgiZkUggRaEIl6woQcn6tRzlmRk DW0Vm5WkphvGxCzzhqjlKiRqWjkNQlPLKYS3MoqSwMq8te0z6N9z/Xjfl48hZVdpPyZHreF4 tTJPLpJQxmSLEFIzm5QWXj+37+DLzg4qFsU1Na0QJ1GKJDqLy8sp5viwmNMS1bjRRhX2is82 6p7RWlQv1iM3BtgDoDPrCT2SMDJ2AEHX+pIYk2UEldZJ5Ey5iPbKCWzcIWCqYZxyEoqtJOHh 4LoIOzcJWPlooDCZQVB1fYFy9kVsONzu04qc2JMNgt+jl0kn9nDoA2O3SKxHwPTXHgLjUNDb F10TUuxusA8/ds0hZQ/ByOyg6x3EesOvoXZXnmR9wD5vJvBGLDT1vSEx9oLPcxu0E3uxYbDa PEzhbjrodLU0zgTB8NP7W/kAGDUbkHMBYMvEoKsyb50pHro33omwMYlg8+errUYwvLhxl8I4 FxZbyh2vMg68C2wmf5wfpUH/uo3Al+SguUOHcD4QWq/NUJUoxPTfEiZHnWT3QOeTMCzHwcTS NI1xEFQbZsQm1y3cwWacpxoQ3Yq8BE4Q8rMj94dyfE6mIBSoQ9Wcphs5/sfzB6shj1Dbl8NW xDJIvl0aX5eUJqOVxUJJvhUBQ8o9pZ+mHZI0S1lyjuMLMvgzeZxgRf4MJfeRrsnc02RstlLD 5XJcIcf/cwnGzU+L6IDvsonqVf5PUUogEfU20jch8UNt6bfokTCFrShdlGi3Z13U3lv2j6k4 1RigiEu9lNnvPXQhVpUxlDlV4X8+xLLQt1MT31pXM1K217c3aoelvC21Z9PYkhSckl0o/NjW f/yY4WhjuV6cP+apWFJ1tb+3KSxD3QneHqWzR9bqkuWUoFJGBJO8oPwLfgiu1BsDAAA= Archived-At: Subject: Re: [Emu] TLS 1.3 and other EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 03 Feb 2019 12:46:18 -0000 QmFzZWQgb24gdGhpcyBkaXNjdXNzaW9uIEkgc3VnZ2VzdCBjaGFuZ2luZyB0aGUgdGl0bGUgYW5k IHRoZSBzY29wZSBvZiBkcmFmdC1tcy1lbXUtZWFwdGxzY2VydCANCg0KT0xEOiAiSGFuZGxpbmcg TGFyZ2UgQ2VydGlmaWNhdGVzIGFuZCBMb25nIENlcnRpZmljYXRlIENoYWlucyBpbiBFQVAtVExT Ig0KTkVXOiAiSGFuZGxpbmcgTGFyZ2UgQ2VydGlmaWNhdGVzIGFuZCBMb25nIENlcnRpZmljYXRl IENoYWlucyBpbiBUTFMtYmFzZWQgRUFQIE1ldGhvZHMiDQoNClRoZSBwcm9ibGVtIGRlc2NyaXB0 aW9uLCBkaXNjdXNzaW9uLCBhbmQgc29sdXRpb25zIGFyZSB0aGUgc2FtZSBmb3IgYWxsIFRMUy1i YXNlZCBFQVAgTWV0aG9kcywgc28gaXQgd291bGQgYmUgZ29vZCB0byBtYWtlIGl0IGNsZWFyIHRv IHJlYWRlcnMgdGhhdCB0aGUgaW5mb3JtYXRpb24gaXMgdXNlZnVsIGZvciBvdGhlciBUTFMtYmFz ZWQgRUFQIE1ldGhvZHMgc3VjaCBhcyBUVExTIC8gRkFTVCAvIFBFQVAgLyBURUFQIGFzIHdlbGwu IFRoZSBvbmx5IHRoaW5nIHRoYXQgd291bGQgY2hhbmdlIGlzICJFQVAtVExTIiByZXBsYWNlZCB3 aXRoICIgVExTLWJhc2VkIEVBUCBNZXRob2RzIiBpbiBhIG51bWJlciBvZiBwbGFjZXMuIEFsbCB0 aGUgdGVjaG5pY2FsIGNvbnRlbnQgd291bGQgYmUgdGhlIHNhbWUuDQoNCkNoZWVycywNCkpvaG4N Cg0KDQoNCg0K From nobody Sun Feb 3 04:59:58 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85F0A12E036 for ; Sun, 3 Feb 2019 04:59:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9vAoFVN3PqTZ for ; Sun, 3 Feb 2019 04:59:55 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 473411271FF for ; Sun, 3 Feb 2019 04:59:55 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 08BBA1A26; Sun, 3 Feb 2019 12:59:53 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: Date: Sun, 3 Feb 2019 07:59:52 -0500 Cc: "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <585980EC-F4AB-4CD8-9E54-A786B7D8CEA8@deployingradius.com> References: To: John Mattsson X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] TLS 1.3 and other EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 03 Feb 2019 12:59:57 -0000 On Feb 3, 2019, at 7:46 AM, John Mattsson = wrote: >=20 > Based on this discussion I suggest changing the title and the scope of = draft-ms-emu-eaptlscert=20 >=20 > OLD: "Handling Large Certificates and Long Certificate Chains in = EAP-TLS" > NEW: "Handling Large Certificates and Long Certificate Chains in = TLS-based EAP Methods" >=20 > The problem description, discussion, and solutions are the same for = all TLS-based EAP Methods, so it would be good to make it clear to = readers that the information is useful for other TLS-based EAP Methods = such as TTLS / FAST / PEAP / TEAP as well. The only thing that would = change is "EAP-TLS" replaced with " TLS-based EAP Methods" in a number = of places. All the technical content would be the same. I think that's good, thanks. Alan DeKok. From nobody Sun Feb 3 05:44:03 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BEBD312E036 for ; Sun, 3 Feb 2019 05:44:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.853 X-Spam-Level: X-Spam-Status: No, score=-8.853 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=fi6o7HJK; dkim=pass (1024-bit key) header.d=ericsson.com header.b=ajPvEJHH Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hl3Uo5fMrTpV for ; Sun, 3 Feb 2019 05:43:59 -0800 (PST) Received: from sesbmg23.ericsson.net (sesbmg23.ericsson.net [193.180.251.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CD14F1271FF for ; Sun, 3 Feb 2019 05:43:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1549201436; x=1551793436; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=fQqGC5HXIqNq8RMEWcyIrhKJ9sAER5h3LyAkKTZjFNE=; b=fi6o7HJK9K9nKJWY4wErBN8kUxzn2UCLV7X/o7vY4Wxs+FD9391hJG4PP7j0HHZk dPu3dwdj6UkkR//Dh5yHJvTed8M5ayNiZDdKRglafO8wSgnvbQJE+NWF710tnBsb 2AT3XufW4ULwtYx1VZ1177ymswPLH7994T+zyTxAF+Y=; X-AuditID: c1b4fb25-d89ff70000005ff7-7b-5c56f01c89ca Received: from ESESBMB503.ericsson.se (Unknown_Domain [153.88.183.116]) by sesbmg23.ericsson.net (Symantec Mail Security) with SMTP id 01.B5.24567.C10F65C5; Sun, 3 Feb 2019 14:43:56 +0100 (CET) Received: from ESESBMR504.ericsson.se (153.88.183.139) by ESESBMB503.ericsson.se (153.88.183.116) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Sun, 3 Feb 2019 14:43:56 +0100 Received: from ESESSMB505.ericsson.se (153.88.183.166) by ESESBMR504.ericsson.se (153.88.183.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Sun, 3 Feb 2019 14:43:56 +0100 Received: from EUR02-VE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB505.ericsson.se (153.88.183.166) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Sun, 3 Feb 2019 14:43:55 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fQqGC5HXIqNq8RMEWcyIrhKJ9sAER5h3LyAkKTZjFNE=; b=ajPvEJHHW2bEMs/rasGevSLjQD8iXGi5xrMxpkoomCFzAxdVjeugs1MopllFKx84s/T1VPuFurEH+X1L8nv1RhzCihjjcsvf/ZRsc1uJ4LmpM3J0EY7zeHhdPsAEUt36bMWn7CMvXOJA7nASwrJ3nH2Faaj9fBBAF3plAdxb9/A= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3257.eurprd07.prod.outlook.com (10.170.246.24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1601.14; Sun, 3 Feb 2019 13:43:54 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc%5]) with mapi id 15.20.1580.019; Sun, 3 Feb 2019 13:43:54 +0000 From: John Mattsson To: "emu@ietf.org" , Jari Arkko Thread-Topic: [Emu] Session identifiers for fast re-authentication Thread-Index: AQHUu8aBhf5g0EMZlEOmVo42yzUEfw== Date: Sun, 3 Feb 2019 13:43:54 +0000 Message-ID: <128BABD0-7F1A-4B5C-8F03-0AE6B73F91C6@ericsson.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.15.0.190117 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR07MB3257; 6:GUPTZtVS95bR01PNLtbHFzkLS9RbQgdhnpgp0C+sW8lF2Vl5tFrMt5eGBEd/EG2WLn7CJCEcZkr5rzyy9BElk7irAMxLuo7ZMfykoK9NKBLS7gv64j5fBTfNtj+jjf78i7+MAYQehQWweVxaimEAS2Y6vu9M0rZXTjmMipnELE6jgHQZkRSKLgYCOdtpYetcyPZkzoalSUivOM0rOkx7gBcXqenpa7sYtUh5EZEaUMUbNjtInWhZOTCafCo52n3Goi9YiN5RsOr+q2xQ8l+IBCxdAB9LbEUGDTth3BBcA+PEyJLKWPw6GHoOAwf7PH1X7bVyD85dNVt2gzvCDJpJQbInIyCrUvz3BKnfXTk9YNXh4sSZ5nzgWlBPcCWznS0t6q8/lIM1UFLooMNKatC3CrHvAsfElAUPwtkE8ZzqwRvoVWhMWWoiv44yV7UZnZWwX15YYYKR0/IjNDRqB0yOXQ==; 5:SF6nlNHidbaMloyEHXlsLptxtXcAUr4nzL+s5ogfNuO5yj2cRE0UkLtdE4H/wuebOCkKbMknwjvi0ekEBn54sQy2JL6pDEB23YIn7uiIcZeCehcliOlihwAQNsb4m3j4HV1V4W3LgEsPW9Qekx1RPIdkr3d+xbrUoItWGEXgTVCQ9AzLd0eojFED45hj34at+VSb5b42+Z2N6Az9pXyTtQ==; 7:px15BKzlTdXYMzV76n5GkBqxcX9R4MjIhxehSSJLfA2bHprZwFnJC6zUDfBZ50e4SIjeI1aeVGLSEVIpgX81me/JAcsVwVgqOw7q3FUHeUvuF4F2x9OFCOGVceB94w7Ygjoiz81hUZSaA22PBjVQDg== x-ms-office365-filtering-correlation-id: dda516bb-fe60-4707-50dc-08d689dda3d6 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3257; x-ms-traffictypediagnostic: HE1PR07MB3257: x-microsoft-antispam-prvs: x-forefront-prvs: 0937FB07C5 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(346002)(376002)(366004)(136003)(396003)(199004)(189003)(2501003)(6506007)(4744005)(186003)(68736007)(82746002)(102836004)(2906002)(26005)(256004)(86362001)(53936002)(97736004)(6512007)(6306002)(3846002)(6246003)(6116002)(14454004)(476003)(229853002)(36756003)(6636002)(2616005)(99286004)(6486002)(8676002)(81166006)(81156014)(8936002)(305945005)(7736002)(71190400001)(71200400001)(33656002)(83716004)(106356001)(6436002)(44832011)(966005)(478600001)(110136005)(25786009)(58126008)(66066001)(316002)(105586002)(486006); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3257; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: m88HhSW0FEUWW30JHXTc3UrruUNZgGQu/4k9FOLHngHxfarJq0cBzhZ+QJbabL3sz+wTY1xn7/x0RAiI46ZRY73HCqoPc5tjPnZNggq7ZKsNsa9saGBiD/jKgmn8T8dr6n/GFdAcuYwqc5FVxeBZPpjjNAM4NU7faIX3C4gh5QhBY2FWV5dVZ5YKNy5NDFea6YSvmTM+p9+abFSpXq6YmvFQH13+9U0lI7Sj5HfRo9Mtg97Q0pYjZF3g1mBZ/Mszqoq6Hy7V+DBXiMBNZw97QgV5q49AFCQ3Pd+IpWwB0Vr5/OLpJXQlxING3Y0718LdgJSR+kzamrQxDAd5rysvJoxpQJwnovrSd5TpCfdnSuVPW1Ba6FSBs2doT+fWqD90v3b0Cut7f4+o7MvCz4zZbgWKrZmmjIzi33g1M6sMny8= Content-Type: text/plain; charset="utf-8" Content-ID: <12955BECC163674AB3F2EAA440954754@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: dda516bb-fe60-4707-50dc-08d689dda3d6 X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Feb 2019 13:43:54.7972 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3257 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA02SbUhTURjHOdu923U1O07NB2eRw1gZTq0+WMxsfcmgMIJEwtCVFxXntN1l 6Yc0QSlfQJdQTvJ14dvMSKF8KXOKYsOEXsBpiGvLpRiKFSLWand3Rd9+/+f5/89znsOh+JJy MpTK1uppnVatkQlERH3KM31U2HpyaszypDxuoreHOIkSTaYt3nl0SaTMoDXZBbQu+kS6KGvN sULmfxHdtA4FlqBxUQXyowAfhTudd4kKJKIkeByB2fRBwIkfCBq3rMJ/YvJ3i0+08eCzpYPH CgLX8GHC8caXMfDAul5LcsKOoKpnQciOEeAYeDhcImA5CJ+GlfZZbz0Qq6Bqw+wJUJ76KZhf 9ecsCvg60MpnmcAR4HK6EctinACvFpzeYxDeDZuvzTyW+TgE5pxNPG4jDKbhGT7HwbDscJMs B+No2G63Elz2MpSV3Sc5TzhYX3b4/HvgbVMl4rhUCHPv93F8DqaH2PuIPGxDUD2yRXCNSKg1 dPsOyoE+9xKP3QVwGEwZpZx/mgRz6S+vR4JpaO8p8w3YC13VdqIGRRn/28HoifPxQegdjObK ibDpdJIch0NdpV1o9D5FAEzVO4lmRHahYIZmruRmHj6ioHXZVxkmT6vQ0vqnyPM7Rvu39z9H 71ZVFoQpJNspTnqQnCoh1QVMYa4FAcWXBYldHz0lcYa6sIjW5aXprmtoxoKkFCELEf+UBKRK cKZaT+fQdD6t+9vlUX6hJSgu9Phk5szt1YuP5I5j1wJ1sxv2gbx781DbfXbMGqb1K045UDfS ODaoHVNH2F4oG4jWhOqOeFd8uUCq/L7Qt2tdeWPQldDWbHtccQaSLizOFo1/si4OG0bb5Npi uRp9a7CZ3XP+a9PSJ0uKqnQVumXQmA7tCHD1p3XaYlUtMoLJUsdG8nWM+g/+V49BGQMAAA== Archived-At: Subject: Re: [Emu] Session identifiers for fast re-authentication X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 03 Feb 2019 13:44:02 -0000 DQpMb29rcyBnb29kIQ0KDQpJIG9ubHkgaGF2ZSBlZGl0b3JpYWwgY29tbWVudHMNCg0KLSAiZGVm aW50aW9uIg0KDQotICJpbXBsZW1lbWVudGF0aW9ucyINCg0KLSAiICAgICBTZXNzaW9uLUlkID0g MHgxOSB8fCBjbGllbnQucmFuZG9tIHx8IHNlcnZlci5yYW5kb20pLg0KICAgVGhpcyBkZWZpbml0 aW9uIGlzIGFscmVhZHkgaW4gd2lkZS1zcHJlYWQgdXNlIGluIG11bHRpcGxlIFBFQVAiDQoNCiAg IFNob3VsZCByZW1vdmUgIikuIiBhbmQgYWRkIGEgYmxhbmsgbGluZS4NCg0KLSBJIG5vdGljZWQg dGhhdCB0aGlzIGRyYWZ0IGFuZCBkcmFmdC1pZXRmLWVtdS1yZmM1NDQ4YmlzIHVzZXMgc2xpZ2h0 bHkgZGlmZmVyZW50IG5vdGF0aW9uIChkZWNpbWFsIHZzLiBoZXhhZGVjaW1hbCkuIFNob3VsZCBi ZSBhbGlnbmVkLg0KDQogICBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1l bXUtcmZjNTQ0OGJpcy0wNA0KDQogICAgICBTZXNzaW9uLUlkID0gNTAgfHwgTk9OQ0VfUyB8fCBN QUMNCg0KICAgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWRla29rLWVtdS1lYXAt c2Vzc2lvbi1pZC0wMA0KDQogICAgICBTZXNzaW9uLUlkID0gMHgxNyB8fCBOT05DRV9TIHx8IE1B Qw0KDQogICBBbGwgZXhhbXBsZXMgSSBjYW4gZmluZCAoUkZDIDUyNDcsIFJGQyA1MjE2KSB1c2Ug aGV4YWRlY2ltYWwgbm90YXRpb24sIHNvIEkgc3VnZ2VzdCB0aGF0IGRyYWZ0LWlldGYtZW11LXJm YzU0NDhiaXMgaXMgdXBkYXRlZCB0byBhdm9pZCBhbnkgY29uZnVzaW9uIGZvciBpbXBsZW1lbnQ6 DQoNCiAgICAgT0xEOiAiU2Vzc2lvbi1JZCA9IDUwIHx8IFJBTkQgfHwgQVVUTiINCiAgICAgTkVX OiAiU2Vzc2lvbi1JZCA9IDB4MzIgfHwgUkFORCB8fCBBVVROIg0KDQogICAgIE9MRDogIlNlc3Np b24tSWQgPSA1MCB8fCBOT05DRV9TIHx8IE1BQyINCiAgICAgTkVXOiAiU2Vzc2lvbi1JZCA9IDB4 MzIgfHwgTk9OQ0VfUyB8fCBNQUMiDQoNCkNoZWVycywNCkpvaG4NCg0K From nobody Sun Feb 3 06:24:40 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F076130D7A for ; Sun, 3 Feb 2019 06:24:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E8ywwykMhSPh for ; Sun, 3 Feb 2019 06:24:35 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 81B4212E036 for ; Sun, 3 Feb 2019 06:24:34 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 373233BD3; Sun, 3 Feb 2019 14:24:33 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: <128BABD0-7F1A-4B5C-8F03-0AE6B73F91C6@ericsson.com> Date: Sun, 3 Feb 2019 09:24:31 -0500 Cc: "emu@ietf.org" , Jari Arkko Content-Transfer-Encoding: 7bit Message-Id: References: <128BABD0-7F1A-4B5C-8F03-0AE6B73F91C6@ericsson.com> To: John Mattsson X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] Session identifiers for fast re-authentication X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 03 Feb 2019 14:24:38 -0000 On Feb 3, 2019, at 8:43 AM, John Mattsson wrote: > > I only have editorial comments > > - "defintion" > > - "implemementations" > > - " Session-Id = 0x19 || client.random || server.random). > This definition is already in wide-spread use in multiple PEAP" > > Should remove ")." and add a blank line. Fixed, thanks. I'll do some more touchups and issue a new draft next week. Alan DeKok. From nobody Sun Feb 3 07:12:54 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E125C130D7A for ; Sun, 3 Feb 2019 07:12:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V8EsLHa-Dxu4 for ; Sun, 3 Feb 2019 07:12:51 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 5FCAD12E036 for ; Sun, 3 Feb 2019 07:12:51 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 0E6E83BD6; Sun, 3 Feb 2019 15:12:49 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: Date: Sun, 3 Feb 2019 10:12:48 -0500 Cc: "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: To: John Mattsson X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 03 Feb 2019 15:12:53 -0000 On Feb 2, 2019, at 12:03 PM, John Mattsson = wrote: > Good suggestion, I'll add something like that to the resumption = section in draft-ietf-emu-eap-tls13 Thanks. >> e.g. TTLS and PEAP both allow session resumption, and when done, skip = the phase 2 / inner-tunnel authentication. >=20 > That seems like it could be a security problem in some implementations = as cross-method resumption is not discussed anywhere and TTLS and PEAP = says that inner-tunnel authentication is skipped for TLS resumption... I'm not sure what security problems there are. If a user = authenticates via TTLS/PEAP, and resumes via PEAP/TTLS, the protocol = flow is almost exactly the same. i.e. the only real difference between = the resumed sessions is that one is encapsulated in PEAP, and the other = in TTLS. They're otherwise identical. > Your planned document on TLS 1.3 for other EAP methods should have = some text describing this. Rather that forbidding cross-method = resumption for TTLS and PEAP, I assume one could just specify that = inner-tunnel authentication must be done after cross-method resumption. = Or? I think it's fine to skip inner authentication. If the EAP server = needs to do additional *authorization*, it can always refuse to resume = the session. But if there's no additional authorization, I don't see any issue = here. Alan DeKok. From nobody Mon Feb 4 21:19:43 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F7D0129AA0 for ; Mon, 4 Feb 2019 21:19:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.853 X-Spam-Level: X-Spam-Status: No, score=-8.853 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=BDJ03qIW; dkim=pass (1024-bit key) header.d=ericsson.com header.b=mYNxKvZu Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IbQj29ZuJnJE for ; Mon, 4 Feb 2019 21:19:39 -0800 (PST) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E29D130DE5 for ; Mon, 4 Feb 2019 21:19:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1549343977; x=1551935977; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Y76W3bwgCO53iMqukjWcpK5pJe+0W159tdzXyOfvUpY=; b=BDJ03qIW2vad1KdXBtrAnXXKj4nRUZdougwDmBaQ3mmYrTKNN2WdgmvXNxCOBwqE DI+GyGbZsh7B4F6gNiFnLjqRynadzc9vOs5WDq9hwqDtOM5PesZGb4NjgXsouRlb ge1Y3ieoKSrRwmy6FZa43MEN9w1B3E6y9M5ae1VbbYw=; X-AuditID: c1b4fb3a-5c9c29e00000672c-5f-5c591ce99f77 Received: from ESESSMB501.ericsson.se (Unknown_Domain [153.88.183.119]) by sessmg22.ericsson.net (Symantec Mail Security) with SMTP id 6A.CE.26412.9EC195C5; Tue, 5 Feb 2019 06:19:37 +0100 (CET) Received: from ESESSMB501.ericsson.se (153.88.183.162) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Tue, 5 Feb 2019 06:19:36 +0100 Received: from EUR03-AM5-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Tue, 5 Feb 2019 06:19:36 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Y76W3bwgCO53iMqukjWcpK5pJe+0W159tdzXyOfvUpY=; b=mYNxKvZu5/FzrHZTYNkKWhhF8qF2TDSmZls7K7qFn0LN8hSFw4wIsCqcz1UiP4AN/IM+8r21LVhg5pcU/9C1SMxxTm9uSRSk6g7gyYqRI8KQTHgTO5aACAWNE4KUFvFW6Z8RqkSSjSo5rX8cl7u1Ru3wmYVrRgKi4nzGJVkUEBA= Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com (10.168.92.142) by HE1PR0701MB2633.eurprd07.prod.outlook.com (10.168.187.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1601.12; Tue, 5 Feb 2019 05:19:35 +0000 Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::99fa:d557:2cc:787e]) by HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::99fa:d557:2cc:787e%4]) with mapi id 15.20.1601.016; Tue, 5 Feb 2019 05:19:35 +0000 From: Mohit Sethi M To: Alan DeKok , "emu@ietf.org" Thread-Topic: [Emu] Notes on session resumption with TLS-based EAP methods Thread-Index: AQHUvRJeKrFhAzTuu0WiU30PumuF2A== Date: Tue, 5 Feb 2019 05:19:34 +0000 Message-ID: <13063b6c-3573-9455-4753-1692755a4b1f@ericsson.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 x-originating-ip: [89.166.49.243] x-clientproxiedby: HE1PR0902CA0038.eurprd09.prod.outlook.com (2603:10a6:7:15::27) To HE1PR0701MB2905.eurprd07.prod.outlook.com (2603:10a6:3:4b::14) authentication-results: spf=none (sender IP is ) smtp.mailfrom=mohit.m.sethi@ericsson.com; x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR0701MB2633; 6:5hHIZYorIcY8gvoUZ3FSqxDjcPUCgqH91HcWSl+OyayKF0OFUJh3ZcIXtghHaGI7jYiX95MBkTQr5jtBx+ElqfaOENgZX74Pq2RS236j3DQFSQ9aUzx01fEOHy1J4tnSrxdhL0u9h3xEVQ4V8ze87ze0/pyMiIZaJ4UU1z96dRu0fVSkOahFPnnNfjAqxS/tS0QxVWA87GP+olivns6Fj/D3+Ys6gyiSttO5bbyJu0aJYqdT5Ac72e8jqHpGSLwJDrw9BXDpicoNJefYbls9pRqGoc3+NVKHSswCmgr4gJ6w1LSOPJ3it1Xjt5DbP4BlMfvL1nLbn6VLlCih1YlgYCSg3otGm5kOAbewOAy99OQ6dIz1EYqfWWnhy2KdY4XNB3shY0KmcJH7ahXimZfqpbRgJ05fgSpqSx2Z6U7dVk2sU0JlxL972LqMNMhfTBLUsGZBndKvok4Mo0KAjRRX8A==; 5:Wi8+pU7Qs3dghcg2SkOFEB2AHHvIkkAtLieeYvudo3rcK2stpdNOILdGCHbOMpZnap1M0lTwXjTeoZyYOTGMNaFdjsglFjnsi3qsi3MFGxqSeLCxQomHFG+DywE83iXOZdyXiAdLh7mL9tdiF84RiquRnxx8bjjHcx0HoBSu9Z9OGBLuFgigkzJ5WetWxyMhiVfIk20f/RfthoZ8/gJRhw==; 7:ToYp3uh7YBKWRdZxFYLq63CzBXe75TcQ3cIPwo8jZic5j0JBQTCwyew8FiNP0ww7EsCR1Hmq7qNop2vw54fBlD9KH1VwfX2Nmpd9hkQ6lfAgeBxR0OhcQZ59+gK7i7dD70Tmqj84/8oI/eg22dmGpw== x-ms-office365-filtering-correlation-id: cb1e06c2-03b5-4646-8a22-08d68b298414 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020); SRVR:HE1PR0701MB2633; x-ms-traffictypediagnostic: HE1PR0701MB2633: x-microsoft-antispam-prvs: x-forefront-prvs: 0939529DE2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(396003)(366004)(136003)(346002)(376002)(189003)(199004)(6306002)(65826007)(386003)(6246003)(446003)(14444005)(305945005)(25786009)(229853002)(99286004)(6512007)(11346002)(52116002)(2616005)(486006)(256004)(76176011)(6486002)(8676002)(58126008)(81166006)(316002)(68736007)(8936002)(65956001)(65806001)(6436002)(97736004)(66066001)(7736002)(186003)(36756003)(53936002)(102836004)(26005)(53546011)(6506007)(2906002)(81156014)(478600001)(2501003)(31696002)(105586002)(86362001)(476003)(966005)(3846002)(71190400001)(71200400001)(31686004)(6116002)(14454004)(110136005)(106356001)(64126003); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2633; H:HE1PR0701MB2905.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: tCsdzLpshV2TSOckbiVaTSCnuWPqVmY9nxhbPVcFQxgQLZxms5zdSfHNiabMnUVABp6C6WHAoB5vITGBFxwgzInVt44dRNEkbHwr35lBY9jzdbQotOQliFmJC/oakR8gZi3UOqM1u3fUjmd3P3qnDzJM9npm+M/8WDfhDcoiLGOXldPTy3ilgrv1i81DuKHF2p60tO4OypA33STONA91Nc6THYTOSukvBnMfNfdP+lrKV8iEBATvs4gejHacbQjplFDGQlfBdr1ZVyZdkdoZag5/xY5sAUmskwDsUHktL6FYPP1RiPo0oJmR3NFLhx1Loo1GtW9z2Bb2Mb4BduBUTjCakiDdH1z7qray2VKZxIzDS0LZASDf08/v1NAbNhKinbLk/fBIrHRBL/m6q73jc81aDoIfoRn55MT60qYaN+I= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: cb1e06c2-03b5-4646-8a22-08d68b298414 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Feb 2019 05:19:33.8116 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2633 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupjleLIzCtJLcpLzFFi42KZGbG9XPelTGSMwc6TbBZNn5vYLY6tX8vi wOTRcrSFxWPJkp9MAUxRXDYpqTmZZalF+nYJXBkH2h8xFdwQqdj1eDJ7A+MUkS5GDg4JAROJ FX+Muxi5OIQEjjBK/OpdzgrhfGWUOLflJDOEs5hJYtXJT2wgDovABGaJ5kdH2LsYOYEy05kk Xq7Wgqh6zCixaF4DI0iCTcBAYvKUFWBFIgKeEguXPAKzhYHsravOsEHEvSTmnPrIAmHrSaxq uwMWZxFQkXj06TUryH28AvYSX1ozIHa5SbT0X2MGsTkF3CVOtJ0HK2cUEJP4fmoNE4jNLCAu cevJfDBbQkBAYsme88wQtqjEy8f/WEFsUYEIiXXfDjFCxBUlzr57yARyv4TAdEaJOz92M0IM jZX48L8fapCOxNnrT6AaZCUuze9mhGhoYZf4uek2IyQgfYGeSYOI32aUaPj+hR2m+eP6b1DN +RIHuu+yQtgyEjt2HmSawGgwC8nhs4BGMQtoSqzfpQ9hekgs7YOqUJSY0v2QHcTmFRCUODnz CcsCRtZVjKLFqcXFuelGRnqpRZnJxcX5eXp5qSWbGIGp5OCW31Y7GA8+dzzEKMDBqMTDa8Ea GSPEmlhWXJl7iFGCg1lJhHfn34gYId6UxMqq1KL8+KLSnNTiQ4zSHCxK4rx/hARjhATSE0tS s1NTC1KLYLJMHJxSDYyKgb9cGpobww6pdi41srTUkt4hujnLrz3aOjOrM9P1SU/s7wizTpMA l+57rFemCz2avm1LhXt6T3iOfIST9hbDXXYLK3h8jp+4LKJVqjNHb+XbaMdJ2qbLNdVV9RvW boz/tebmC62/xSq8Wz+xOu9h4ut7eu/jC7HveuLiOpIdB3xe82ixK7EUZyQaajEXFScCAKq7 SAAhAwAA Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Feb 2019 05:19:41 -0000 SGkgQWxhbiwNCg0KRG8geW91IGhhdmUgZXhwZXJpZW5jZSB3aXRoIHN1Y2ggY3Jvc3MgbWV0aG9k IHJlc3VtcHRpb24/IEFyZSB0aGVyZSBhbnkgDQpkZXBsb3ltZW50cyB0aGF0IG1ha2UgdXNlIG9m IHRoaXM/DQoNCk15IGluaXRpYWwgcmVhY3Rpb24gaXMgdGhhdCBzdWNoIGNyb3NzIG1ldGhvZCBz ZXNzaW9uIHJlc3VtcHRpb24gc2hvdWxkIA0KYmUgZm9yYmlkZGVuLiBUaGF0IGlzIGJlY2F1c2Ug RUFQLVRMUyBoYXMgZGlmZmVyZW50IHNlY3VyaXR5IHByb3BlcnRpZXMgDQp3aGVyZSBib3RoIHRo ZSBwZWVyIGFuZCBzZXJ2ZXIgYXJlIG11dHVhbGx5IGF1dGhlbnRpY2F0ZWQgd2l0aCBUTFMgYW5k IA0KY2VydGlmaWNhdGVzLiBNaXhpbmcgaXQgd2l0aCBvdGhlciBFQVAgbWV0aG9kcyB0aGF0IHVz ZSBUTFMgb25seSBmb3IgDQpzZXJ2ZXIgYXV0aGVudGljYXRpb24gY29tcGxpY2F0ZXMgdGhlIHNl Y3VyaXR5IHByb3BlcnRpZXMgYW5kIHByb29mcy4NCg0KQWxzbywgRUFQIG1ldGhvZHMgdGhhdCBv bmx5IHVzZSBUTFMgZm9yIHRoZSBvdXRlciB0dW5uZWwgKFRUTFMsIFBFQVAsIA0KZXRjLikgdHlw aWNhbGx5IGJlZ2luIHdpdGggYW4gYW5vbnltb3VzIE5BSSBmb3IgcHJpdmFjeS4gV2hhdCBOQUkg d291bGQgDQpzdWNoIHBlZXJzIHVzZSBpZiB0aGV5IHJlbHkgc29sZWx5IG9uIFRMUyBiYXNlZCBy ZXN1bXB0aW9uPw0KDQpBcyBhIGNvLWF1dGhvciBvZiBkcmFmdC1pZXRmLWVtdS1lYXAtdGxzMTMs IEkgZG9uJ3QgdGhpbmsgd2Ugc2hvdWxkIA0Kc3VwcG9ydCBzdWNoIGNyb3NzIG1ldGhvZCByZXN1 bXB0aW9uLiBJZiBhbnl0aGluZywgdGhpcyBzaG91bGQgYmUgDQpkaXNjb3VyYWdlZC9mb3JiaWRk ZW4uDQoNCi0tTW9oaXQNCg0KT24gMi8xLzE5IDc6NDkgUE0sIEFsYW4gRGVLb2sgd3JvdGU6DQo+ ICAgIFRoaXMgcXVlc3Rpb24gaXNuJ3QgZGlyZWN0bHkgYXBwbGljYWJsZSB0byBFQVAtVExTLCBi dXQgaXQgaXMgcmVsYXRlZC4NCj4NCj4gICAgVGhlcmUgYXJlIG11bHRpcGxlIEVBUCBtZXRob2Rz IHRoYXQgdXNlIFRMUywgYW5kIHByZXN1bWFibHkgYWxsIG9mIHRoZW0gd2lsbCBlbmFibGUgc2Vz c2lvbiByZXN1bXB0aW9uLiAgVGhlIHF1ZXN0aW9uIGlzLCB3aGF0IGRvIHdlIGRvIHdpdGggY3Jv c3MtbWV0aG9kIHNlc3Npb24gcmVzdW1wdGlvbj8NCj4NCj4gICAgIGkuZS4gYSB1c2VyIHN0YXJ0 cyB3aXRoIEVBUC1UTFMsIGFuZCB0aGVuIHRyaWVzIHRvICJyZXN1bWUiIGhpcyBzZXNzaW9uLCBi dXQgdGhpcyB0aW1lIHVzZXMgVFRMUy4gIEl0J3Mgbm90IGNsZWFyIHRoYXQgYW55dGhpbmcgaW4g dGhlIHNwZWMgZm9yYmlkcyBvciBwcmV2ZW50cyB0aGlzLg0KPg0KPiAgICBJdCdzIG5vdCBjbGVh ciBpZiB0aGlzIHJlc3VtcHRpb24gaXMgYW4gaXNzdWUsIGJ1dCBpdCBzaG91bGQgYmUgaGlnaGxp Z2h0ZWQuDQo+DQo+ICAgIFRoZSBpc3N1ZSBpcyBtYWRlIG1vcmUgZGlmZmljdWx0IGJ5IHRoZSBm YWN0IHRoYXQgc2Vzc2lvbiByZXN1bXB0aW9uIGlzIHVzdWFsbHkgZG9uZSBhdCB0aGUgVExTIGxh eWVyLiAgVGhpcyBtZWFucyB0aGVyZSBpcyBtaW5pbWFsIGFiaWxpdHkgZm9yIHRoZSBFQVAgbGF5 ZXIgdG8gY3Jvc3MtY2hlY2sgbWV0aG9kIHR5cGVzLg0KPg0KPiAgICBJZiB3ZSBkbyBhbGxvdyBp dCwgaXQgc2hvdWxkIGJlIGNhbGxlZCBvdXQgZXhwbGljaXRseSBpbiB0aGUgRUFQLVRMUyBkb2N1 bWVudC4gIElmIHdlIGRvbid0IGFsbG93IGl0LCB3ZSBzaG91bGQgZmluZCBhIHdheSB0byBmb3Ji aWQgaXQuDQo+DQo+ICAgIEFsYW4gRGVLb2suDQo+DQo+IF9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fDQo+IEVtdSBtYWlsaW5nIGxpc3QNCj4gRW11QGlldGYu b3JnDQo+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vZW11DQoNCg== From nobody Mon Feb 4 21:25:16 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 80342131055 for ; Mon, 4 Feb 2019 21:25:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.853 X-Spam-Level: X-Spam-Status: No, score=-8.853 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=MMMvfkKg; dkim=pass (1024-bit key) header.d=ericsson.com header.b=St8r8fOX Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fKfBRXm4VaTE for ; Mon, 4 Feb 2019 21:25:09 -0800 (PST) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EBB97130DFA for ; Mon, 4 Feb 2019 21:25:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1549344307; x=1551936307; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=id36q8AIBUa81xdLEAS3GSGzBsDtL7ruBV3WjJvSp1k=; b=MMMvfkKgxCSW+1ELh6ZWVYXGuVXzpYqeEmdeBUpV7QRZV6zDgie7ffflaS8S8K0z mcZLkBy6D+kans8srYLQQzhKiTb5WNMWyvaBcHsMFqKTQrNcRYAj2Tr08Sjw3R+b 2GJHZTUBun8YUCFEm55b+0bW8y4G4Y3gm9WbSuO92Gs=; X-AuditID: c1b4fb3a-5c9c29e00000672c-31-5c591e330f99 Received: from ESESSMB501.ericsson.se (Unknown_Domain [153.88.183.119]) by sessmg22.ericsson.net (Symantec Mail Security) with SMTP id B6.9F.26412.33E195C5; Tue, 5 Feb 2019 06:25:07 +0100 (CET) Received: from ESESBMB503.ericsson.se (153.88.183.170) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Tue, 5 Feb 2019 06:25:06 +0100 Received: from EUR04-HE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB503.ericsson.se (153.88.183.170) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Tue, 5 Feb 2019 06:25:06 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=id36q8AIBUa81xdLEAS3GSGzBsDtL7ruBV3WjJvSp1k=; b=St8r8fOXaO/1QgcixRtukLhhg3buVsJmNTs2WIciY9uMurrCR/3ER0giXR2b3K6Czmy7uTlfS0RwB0KbCRcLRYgJZ8I3kfQzAbVzgVJwwa3wHfpf68kghJAt+Y6O18WZlbDNRbXK+6S+xIije4rEPyRRpeJVph6Jzfp6ozU77CM= Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com (10.168.92.142) by HE1PR0701MB2633.eurprd07.prod.outlook.com (10.168.187.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1601.12; Tue, 5 Feb 2019 05:25:05 +0000 Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::99fa:d557:2cc:787e]) by HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::99fa:d557:2cc:787e%4]) with mapi id 15.20.1601.016; Tue, 5 Feb 2019 05:25:05 +0000 From: Mohit Sethi M To: Alan DeKok , John Mattsson CC: "emu@ietf.org" Thread-Topic: [Emu] TLS 1.3 and other EAP methods Thread-Index: AQHUvRMjF1RaOQQ8kkaDErtqoDuxSw== Date: Tue, 5 Feb 2019 05:25:05 +0000 Message-ID: <36a1fd73-ed43-67fa-7ad6-b847d1c7c2fc@ericsson.com> References: <6DA031E2-FB48-4A1F-85FB-88A1394C22A2@ericsson.com> <73C5F487-8AEB-412D-89F8-DE9FDE4D3C5C@deployingradius.com> In-Reply-To: <73C5F487-8AEB-412D-89F8-DE9FDE4D3C5C@deployingradius.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 x-originating-ip: [89.166.49.243] x-clientproxiedby: HE1PR05CA0371.eurprd05.prod.outlook.com (2603:10a6:7:94::30) To HE1PR0701MB2905.eurprd07.prod.outlook.com (2603:10a6:3:4b::14) authentication-results: spf=none (sender IP is ) smtp.mailfrom=mohit.m.sethi@ericsson.com; x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR0701MB2633; 6:3gPV/CCGyznI1cYoLnN1EawbI/7Vc8npocZCYThgKjejdYM1Jd1QTJ4n3dej0flGAe6QLKrqtOlxV9OfNwOIY2gWQJ+mnOKZv81cNBJbqCLbqDs1u2G5O/+6yKIDas2S24x7AhodhpVq3798WKggUtSBgrOG3cOkHnkRqTRWgAMeCxNEUd3xSqsjf2Pml3+6n+chu/DYe9siuN8ERwaa3pZvWKSnaFRDHiwnzR1qUTYi65d0X94ZhuQxSgi9fd4H1EFxpzL1yXUZ3lnI0gTocDTc3mFzH7dgKPAvjWlIq8oIGgBhURsWQTW2h1/E8bVreeP8TTcu/6RSzYvvS/8ttPZW4S0qhqnqp6FKLL8JQF4YvEXx4QRv0LaoLYLA3gmZbWfZOGeKWtwjeEREQyB2ks8gzu5PKoNN6JIKDbO/Vx1AmJ1/Ul4I013Brpq76bH3SL+t9XBQJeoiDSYln92fcQ==; 5:O+/qxyarlJnV3dvPNe+RiKNDJpIpQDDEjL7dUO0YEocmkvmfiYWuwuIDyY0D99mNz4zTbPTUNVVT5fXHHY0IpMoneIP5KpxE+7QmoIHyGrtQhl0AroYXwPrtaaBWQydX3r2zRbde67ChHkATq1KOt7IagqOX5ndvN7Ox/PaIzURbJnIl8sPNr+/n0Sdm8gwQwnEh9R7uSyJyP7Drgw+EPA==; 7:iAgBQ9ICd+ZQ41QfBjZ0dAuwQ5BlqpI3OEKPqRz7AGK8Lla66xILRc2E0S/ogYAXjf1yHHAHibrCgfBPXT+JtFeGAzbJ8TnEmwQH7nX6s1GiWZRbhZd0ayNQ4AgNf5Vu3tLPYao32WXEw2bsg/Xa7g== x-ms-office365-filtering-correlation-id: 6ee18d91-a7ca-4f93-b2ce-08d68b2a48ee x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020); SRVR:HE1PR0701MB2633; x-ms-traffictypediagnostic: HE1PR0701MB2633: x-microsoft-antispam-prvs: x-forefront-prvs: 0939529DE2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(396003)(366004)(136003)(346002)(376002)(189003)(199004)(51444003)(6306002)(65826007)(386003)(6246003)(446003)(14444005)(4326008)(305945005)(25786009)(229853002)(99286004)(6512007)(11346002)(52116002)(2616005)(486006)(256004)(76176011)(6486002)(8676002)(58126008)(81166006)(316002)(68736007)(8936002)(65956001)(65806001)(6436002)(97736004)(66066001)(7736002)(186003)(36756003)(53936002)(102836004)(26005)(53546011)(6506007)(2906002)(81156014)(478600001)(6636002)(31696002)(105586002)(86362001)(476003)(966005)(3846002)(71190400001)(71200400001)(31686004)(6116002)(14454004)(110136005)(106356001)(64126003); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2633; H:HE1PR0701MB2905.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: +p3KA1gYziQ8BeXf28MMe7FZsqxExE7jTHkXT6b3UAmdZWt6ToZCgf2yGENKk/mrAz1EyesHxO7hrSdQonfUDZg7CNc8hvvPMXJ8DIWdE1Q5sgRfV5esC55r81hqs3VDZvananl8vksTN1T79pCMJTmwhUgN5/1bGN9O+aw/kn8DWP8RBUUalizX631bdw/QcWb5053pLVPW9Kh4rgYy8+TeqxTNZ8S57KE0g3xmAaoveSCZgmag3ASwl7zBdHMjSd/5aTNWk07OlWMxxnKjax7jpzqG6Jp9PsP2Ys9aMW584v6Vg91M+OGv95CbeQhC+C5I8tlWQKFCg+2hF9MBxGRQ5fTi1jCusWBBtvd9ilaks3PENsr38Mo36A+tgVYPKGlCETyavtC9kdxwXFHUawixEf8gGZFQSq57qbqdCsE= Content-Type: text/plain; charset="utf-8" Content-ID: <4B0FD4987533FF4289E42D45620EC04C@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 6ee18d91-a7ca-4f93-b2ce-08d68b2a48ee X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Feb 2019 05:25:04.0447 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2633 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprIKsWRmVeSWpSXmKPExsUyM2J7ua6xXGSMwaprPBZNn5vYLY6tX8vi wOTRcrSFxWPJkp9MAUxRXDYpqTmZZalF+nYJXBmHOrtYCqZJV6xa3cTUwLhHqouRk0NCwETi 7NKrjF2MXBxCAkcYJd40zoJyvjJKTJm4jx3CWcwkcXryZCYQh0VgArPEx+dPmCEy05kk9jzc DeU8ZpS4snY3O8hkNgEDiclTVoDZIgIREicuLABq5+BgFlCUONmjAxIWBio5cmUaM0SJocSd N5uZIGw9ieO3zoHFWQRUJCZ/XMMGYvMK2Euc3bKbFcQWEqiROPL+KQvISE4Bd4ktvxVBwowC YhLfT60BG8MsIC5x68l8Jog/BSSW7DnPDGGLSrx8/A9sjCjQZeu+HWKEiCtKnH33EOxJCYGp jBKfT09nghgaK/Hhfz/UIB2Js9efQDXISlya380I0dDCLvFj5QY2iISvxIfvIDZI4jajRMP3 L+ww3R/Xf4PqzpdYsfgx8wRGw1lIrp0FDiNNifW79CHCHhLX/95mhLAVJaZ0P2SfBQ4LQYmT M5+wLGBkXcUoWpxaXJybbmSkl1qUmVxcnJ+nl5dasokRmFAObvlttYPx4HPHQ4wCHIxKPLwW rJExQqyJZcWVuYcYJTiYlUR4d/6NiBHiTUmsrEotyo8vKs1JLT7EKM3BoiTO+0dIMEZIID2x JDU7NbUgtQgmy8TBKdXAKJB0/O5S54hHdl+EQw95Teo87P7r5PL1uz0vaW3L9kh+qfLtY4cX R5WJaoqeX+BOH/WUtJ0fTpwXXCw7I3iK/quLd5j/5S5dcpL9QOIinrnrjN6ESr5w+HH73ts5 86/Y/vuWNXmzZob16ksiwY7mvL0nnhwN3r+/jo/VuT7jYcEy/jX9MV+1/ZVYijMSDbWYi4oT AT7Dk4UkAwAA Archived-At: Subject: Re: [Emu] TLS 1.3 and other EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Feb 2019 05:25:13 -0000 SGkgQWxhbiwNCg0KVGhhbmtzIGZvciBicmluZ2luZyB0aGlzIHVwLiBJIGFncmVlIHRoYXQgd2Ug c2hvdWxkIHRha2UgdGhpcyANCm9wcG9ydHVuaXR5IHRvIGZpeCBvdGhlciBFQVAgbWV0aG9kcyB3 aGljaCByZWx5IG9uIFRMUyBmb3IgdGhlIG91dGVyIA0KdHVubmVsLiBJIHRoaW5rIHRoYXQgdGhl c2UgdXBkYXRlcyBtZXJpdCBhIHNlcGFyYXRlIGRvY3VtZW50LiBCdXQgSSBhbSANCm5vdCBjZXJ0 YWluIHdoeSB0aGUgdHdvIGRvY3VtZW50cyBuZWVkIHRvIGJlIHB1Ymxpc2hlZCBzaW11bHRhbmVv dXNseT8NCg0KLS1Nb2hpdA0KDQpPbiAxLzI4LzE5IDc6MjQgUE0sIEFsYW4gRGVLb2sgd3JvdGU6 DQo+IE9uIEphbiAyOCwgMjAxOSwgYXQgMTI6MTAgUE0sIEpvaG4gTWF0dHNzb24gPGpvaG4ubWF0 dHNzb25AZXJpY3Nzb24uY29tPiB3cm90ZToNCj4+PiBTdXJlLiAgVGhlIHF1ZXN0aW9uIHRoZW4g YmVjb21lcyBvbmUgb2YgZW5jb2RpbmcuICBGb3IgdHlwZXMgPCAyNTYsIDEgb2N0ZXQgaXMgPmVu b3VnaC4gIEZvciBvdGhlcnMsIGl0IHNob3VsZCBiZSBhIDMyLWJpdCBudW1iZXIgaW4gbmV0d29y ayBieXRlIG9yZGVyLg0KPj4gTWF5YmUgd2UgY2FuIHN0YXRlIHRoYXQgaXQgaXMgdGhlIEVBUCBN ZXRob2QgVHlwZSB2YWx1ZSBpbiBuZXR3b3JrIGJ5dGUgb3JkZXIgd2l0aCBhbnkgbGVhZGluZyBi eXRlcyBvZiB2YWx1ZSB6ZXJvIHJlbW92ZWQ/IFRoZW4gMTMgaXMgZW5jb2RlZCBhcyAiMEQiLCAy NTYgaXMgZW5jb2RlZCBhcyAiMDEwMCIsIGFuZCA0Mjk0OTY3Mjk1IGlzIGVuY29kZWQgYXMgIkZG RkZGRkZGIi4NCj4gICAgSG1tLi4uIEkgdGhpbmsgOC8zMi1iaXQgbnVtYmVycyB3b3VsZCBiZSBz aW1wbGVyLg0KPg0KPj4+IFRoYW5rcy4gIE15IG9ubHkgcmVtYWluaW5nIG5pdCBoZXJlIGlzIHRo YXQgdGhlcmUgc2hvdWxkIHJlYWxseSBiZSBhIHNlbnRlbmNlID5hbGx1ZGluZyB0byBvdGhlciBU TFMtYmFzZWQgRUFQIG1ldGhvZHMuICBTbyB3ZSBkb24ndCBoYXZlIHRvIHJldiBhbGwgb2YgdGhv c2UgPmRvY3VtZW50cywgdG9vLiAgSSdtIG5vdCBzdXJlIHRoYXQgdGhpcyBkb2N1bWVudCBpcyB0 aGUgYmVzdCBwbGFjZSB0byBkbyBpdCwgYnV0IGl0J3MgPm9ubHkgMS0yIHNlbnRlbmNlcy4NCj4+ IFRoYXQgaXMgZG9hYmxlIGJ1dCBtYXliZSBub3QgY29tcGxldGVseSB0cml2aWFsIGFzOg0KPj4N Cj4+IC0gZHJhZnQtaWV0Zi1lbXUtZWFwLXRsczEzIHNob3VsZCB0aGVuIHByb2JhYmx5IGZvcm1h bGx5IHVwZGF0ZSB0aGUgUkZDcyBmb3IgdGhlIG90aGVyIG1ldGhvZHMsIGUuZy4gRUFQLVRUTFMg KFJGQyA1MjgxKS4NCj4gICAgTWF5YmUuLi4gdGhhdCdzIHVwIHRvIHRoZSBBRHMsDQo+DQo+PiAt IEkgYXNzdW1lIHRoZSBvdGhlciBtZXRob2RzIHNob3VsZCB1c2UgdGhlIHNhbWUgbGFiZWxzIChl LmcuICJFWFBPUlRFUl9FQVBfVExTX0tleV9NYXRlcmlhbCIpIGFzIEVBUC1UTFMNCj4gICAgWWVz Lg0KPg0KPj4gLSBFQVAtRkFTVCAoUkZDIDQ4NTEpIGRlcml2ZXMgYSAxMTIgYnl0ZSBsb25nIGtl eV9ibG9jayBhbmQgVEVBUCAoUkZDIDcxNzApIGRlcml2ZXMgYW4gNDAgYnl0ZSBsb25nIHNlc3Np b25fa2V5X3NlZWQgaW5zdGVhZCBvZiB0aGUgMTI4IGJ5dGUgbG9uZyBrZXlfbWF0ZXJpYWwgaW4g RUFQLVRMUy4NCj4gICAgPHNocnVnPiAgVHJ1bmNhdGluZyAxMjggYnl0ZXMgdG8gMTEyIG9yIDQw IGJ5dGVzIHdvdWxkIGJlIGZpbmUuICBUaGUgZ29hbCBpcyB0byBoYXZlICpzb21ldGhpbmcqIHRo YXQgcGVvcGxlIGNhbiB1c2UuDQo+DQo+PiAtIFBBRVAgaXMgd2lkZWx5IGRlcGxveWVkIGJ1dCBu b3QgYW4gUkZDDQo+ICAgIFNvbWUgZ3VpZGFuY2Ugd291bGQgc3RpbGwgYmUgdXNlZnVsLg0KPg0K PiAgICBNeSAkMC4wMiBpcyB0aGF0IHRoZSB3b3JzdCB0aGluZyB3ZSBjb3VsZCBkbyBpcyB0byBw dWJsaXNoIEVBUC1UTFMgZm9yIFRMUyAxLjMsIGFuZCB0byBnaXZlIG5vIGd1aWRhbmNlIGZvciBv dGhlciBUTFMtYmFzZWQgRUFQIG1ldGhvZHMuICBJIGhhdmUgYSBzdHJvbmcgcHJlZmVyZW5jZSB0 aGF0ICphbGwqIFRMUy1iYXNlZCBFQVAgbWV0aG9kcyBiZSBjYXBhYmxlIG9mIHdvcmtpbmcgd2l0 aCBUTFMgMS4zLg0KPg0KPiAgICBNYXliZSB0aGlzIGRvY3VtZW50IGlzbid0IHRoZSBwbGFjZSBm b3IgdGhlc2UgdXBkYXRlcy4gIEJ1dCBJTUhPLCBhbnkgdXBkYXRlcyB0byBUVExTLCBGQVNULCBl dGMuIE1VU1QgYmUgcHVibGlzaGVkIHNpbXVsdGFuZW91c2x5IHdpdGggdGhpcyBzcGVjLiAgT3Ro ZXJ3aXNlIGltcGxlbWVudG9ycyB3aWxsIGhhdmUgbm8gZ3VpZGVsaW5lcywgYW5kIFRUTFMgLyBG QVNUIC8gUEVBUCAvIFRFQVAgd2lsbCBiZSBicm9rZW4gZm9yICp5ZWFycyouDQo+DQo+ICAgIEFs YW4gRGVLb2suDQo+DQo+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fDQo+IEVtdSBtYWlsaW5nIGxpc3QNCj4gRW11QGlldGYub3JnDQo+IGh0dHBzOi8vd3d3 LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vZW11DQo= From nobody Mon Feb 4 21:28:21 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84266131026 for ; Mon, 4 Feb 2019 21:28:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.853 X-Spam-Level: X-Spam-Status: No, score=-8.853 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=KqahRqG1; dkim=pass (1024-bit key) header.d=ericsson.com header.b=M1t1tIOO Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ULKfmeiN8RYw for ; Mon, 4 Feb 2019 21:28:18 -0800 (PST) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 57E62129AA0 for ; Mon, 4 Feb 2019 21:28:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1549344496; x=1551936496; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=wPUexoy04ROj1osy9obhkSMgqGm5ceB117EPrpNDfAU=; b=KqahRqG1D/IwJLIEpiJsK4Bu1C0p28TkSLkZNJ/63zZ4EFkGU8Ke4AQuDmVFOyhu MU86zAk6BzKYLX+dvB+XcRMc5lZl4mlOe5FUuPfjvVucbMtfkHWiEPi49qrwKqps KZDu5EUFRFwW79NElopCwDvkHiDgZ/+eiwCJ0KGxomI=; X-AuditID: c1b4fb30-41b3a9e00000355c-9c-5c591ef008fa Received: from ESESSMB502.ericsson.se (Unknown_Domain [153.88.183.120]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id 0B.E8.13660.0FE195C5; Tue, 5 Feb 2019 06:28:16 +0100 (CET) Received: from ESESSMB501.ericsson.se (153.88.183.162) by ESESSMB502.ericsson.se (153.88.183.163) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Tue, 5 Feb 2019 06:28:09 +0100 Received: from EUR04-VI1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Tue, 5 Feb 2019 06:28:09 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wPUexoy04ROj1osy9obhkSMgqGm5ceB117EPrpNDfAU=; b=M1t1tIOOrh1pFCI9PC/LgwP8U5ka/oEMt1p+kIy4B4833B46ZfPaVyxDd1u/hoM/JPotHBw28PqRXM6akwtGKmlaBF4A4O3TWoMcWMA6kHTqV0RNhZKH+fsxUa/HPpXvCK8bvOstIVaE3Mymck0khV4K7epvj7fEst1/2q8rSOQ= Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com (10.168.92.142) by HE1PR0701MB2539.eurprd07.prod.outlook.com (10.168.129.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1601.16; Tue, 5 Feb 2019 05:28:08 +0000 Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::99fa:d557:2cc:787e]) by HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::99fa:d557:2cc:787e%4]) with mapi id 15.20.1601.016; Tue, 5 Feb 2019 05:28:08 +0000 From: Mohit Sethi M To: John Mattsson , "emu@ietf.org" Thread-Topic: [Emu] TLS 1.3 and other EAP methods Thread-Index: AQHUvRORVee5WG1YQUC2jMkyIlLXYA== Date: Tue, 5 Feb 2019 05:28:08 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 x-originating-ip: [89.166.49.243] x-clientproxiedby: HE1PR06CA0127.eurprd06.prod.outlook.com (2603:10a6:7:16::14) To HE1PR0701MB2905.eurprd07.prod.outlook.com (2603:10a6:3:4b::14) authentication-results: spf=none (sender IP is ) smtp.mailfrom=mohit.m.sethi@ericsson.com; x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR0701MB2539; 6:RXxHgeCslKUgvyXAWozIrfFHpCjHZhc2kSGPn9fJ9OG3biti02DtbJceb8oj99dP4adDX7bLP/aGWhYlN10ex/yyDyGaWWfTywZNJsMpwz4FQ/obvMS4fe9xhc8uVTTWFdwvfsRmtH2ay+JmamZiXDAj6Gx6lKogk476BuMAvitLmDvTkhMul1me9qhmVt6ti+HiuCoKwMXsSm5xmz1xsoavBP0ju4mp2cXWx1hLkUr5PYidoGBL59Zd4pMFXQh/lAgUTSLUqSeQHrvk5YT3i4ilOwBrzis9rqv8vI8IU3ZnX0teoiRRJGfzSskSXj53PaFSOtTWE5IOCofX8XAhM+AxiQ6BMJ7k7ICW1UqNjGu/wJ4jFlVZNsel9UdKxeQynISA5WPYlmlRwtOExZr99Jlr7QRCC618qBaOBp05z0QNMK3UZ2YbKjAsrQenNPo2g44KcrPUQPQe7QrK1kB/uw==; 5:9d9uG/h8CunipCUd2Flvl/bSTFUoWOQcE54O7ucp1Usn8DVcKvT9zeuUx/B4uF0+u1gGvNA7HxIvr/dcxG977fMEbclnCQ4+PDka5HNXKn2QyZdaTKqcYGEU5SYMTae0qVbSV15iGuEJGK1pWKNi2srnH9EHhAIBTmSkeyyvtAZ/ZTCEGCLi3sXkPk6RHo+7tDj6U50vFaPDXJtqQFfTwg==; 7:8ryhoX3P+zfLZlqB3kUHyobHvdlmQmW/wBPUYbbiP5hkgfnjQ3AHKooWfDS2fEDanhApyb6l45vOjJJV8ElilbUR/bZGCkb+F6V8cILyE4vpn+2YB63VLHJB0H12DG/0qWjeMN/qJBGhT3SKBVuP+w== x-ms-office365-filtering-correlation-id: 20e28aa4-32b6-4fb4-4bd5-08d68b2ab664 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020); SRVR:HE1PR0701MB2539; x-ms-traffictypediagnostic: HE1PR0701MB2539: x-microsoft-antispam-prvs: x-forefront-prvs: 0939529DE2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(136003)(396003)(366004)(39860400002)(346002)(189003)(199004)(186003)(7736002)(58126008)(110136005)(26005)(8676002)(478600001)(36756003)(229853002)(316002)(305945005)(97736004)(25786009)(31696002)(71200400001)(76176011)(102836004)(65806001)(65956001)(66066001)(81166006)(81156014)(52116002)(86362001)(386003)(53546011)(6506007)(6306002)(3846002)(6116002)(99286004)(2616005)(476003)(11346002)(31686004)(64126003)(446003)(2906002)(68736007)(71190400001)(256004)(53936002)(6246003)(14454004)(8936002)(2501003)(6486002)(966005)(6436002)(106356001)(65826007)(105586002)(6512007)(486006); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2539; H:HE1PR0701MB2905.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: PjyV4cAImb6L8tOzPfXNgebm5MAgjAFLqG5+0Bg5aFBDcx2yRES3cSYmKS5mDqbZIU6UAXTM0+pNn4OAB9UtAJvJ+nqudGqNCO91e+jhfew1ujHLUCOF1GXnzET5FmUbJ0CvZDy/Qq7HbQCjo/xPg9F9w3EeAWkP+NVX7TilBvLMFqp32Rq/qfqQYTceFnyl59okk9cy9OCh9DBRhuXXOIWAKyTVukfd3NwTl3oeiWFrIQZAZN/AC6fGf50MJJofqxI7GmSeqpupXmqqfO+jN3j3Tisa1OdyjP9CJt2diocDtFApamiTkAuL6Q/c1vD6afVgTdYOG/vwVxlOK9vKZwgOwmRkwyvq9CYqTXom+mtQtNlUHXm8utFmpLEmhBiAkC8+lT+evuMtv3WZXBpTrspGdX7Lflh8Hw6fbQZZO1o= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 20e28aa4-32b6-4fb4-4bd5-08d68b2ab664 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Feb 2019 05:28:07.7351 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2539 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpjleLIzCtJLcpLzFFi42KZGbG9QveDXGSMwbJOFYtj69eyODB6LFny kymAMYrLJiU1J7MstUjfLoEr48yuCSwFt3gqbkwIa2DcwNPFyMkhIWAiMf3vXvYuRi4OIYEj jBKn7z1kgXC+Mkrs+nKDGcJZzCQx7egJVpAWFoEJzBILHlpAJKYxSTy43Q/V8phR4sqP12wg VWwCBhKTp6xgB7FFBHwlWi8/YwKxhYHiR65MY4aIG0rcebOZCcLWk5hy5gUzxAYVieM3FoP1 8grYS1zqu84IYgsB2TP+HWIBsTkFHCQm/p8CZjMKiEl8P7UGbA6zgLjErSfzmSCeE5BYsuc8 M4QtKvHy8T+wD0QFIiTWfTvECBFXlDj77iFU/VRGiX2N2RAzYyU+/O+HiutInL3+BKpeVuLS /G5GkIclBFrYJb6u+QK1wFfixvqjLBCJ24wSl1dvZ4Xp/rr9AlR3vsSGk++gbBmJHTsPMk1g NJiF5PBZjBxAtqbE+l36EGEPiUsLJjBC2IoSU7ofss8Ch4ugxMmZT1gWMLKuYhQtTi1Oyk03 MtJLLcpMLi7Oz9PLSy3ZxAhMHQe3/DbYwfjyueMhRgEORiUe3lpgShFiTSwrrsw9xCjBwawk wrvzb0SMEG9KYmVValF+fFFpTmrxIUZpDhYlcd4/QoIxQgLpiSWp2ampBalFMFkmDk6pBsb1 Mvuznvca+GSIiXx+vs33+dwN7W5r9wgfD8vnqbS+J1TNJt9YtU0vZlrJgbN7zun9OjovrqRQ ZG+7AUvpkZvrrTXeyV7wP+Qo9Nz29cfP9pW877kamFl7wqdHffvEHH6V97dT54n+tWsljdzW MEx/duvNtwkM01InmKz6tOYTH1+ifPiFh8pKLMUZiYZazEXFiQAo9gK+GQMAAA== Archived-At: Subject: Re: [Emu] TLS 1.3 and other EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Feb 2019 05:28:20 -0000 SGkgSm9obiwgQWxhbiwgYW5kIG90aGVycywNCg0KVGhlIHJlY29tbWVuZGF0aW9ucyBpbiB0aGlz IGRvY3VtZW50IG1heSBiZSB1c2VkIGJ5IGFsbCBUTFMtYmFzZWQgRUFQIA0KbWV0aG9kcy4gSG93 ZXZlciwgZnJhZ21lbnRpbmcgbGFyZ2UgY2VydGlmaWNhdGVzIGFuZCBjZXJ0aWZpY2F0ZSBjaGFp bnMgDQppbnRvIG1hbnkgc21hbGwgbWVzc2FnZXMgaXMgbGVzcyBvZiBhIHByb2JsZW0gd2hlbiBv bmx5IG9uZSBzaWRlIA0KKHNlcnZlcikgaXMgYXV0aGVudGljYXRpbmcgd2l0aCBjZXJ0aWZpY2F0 ZXMuDQoNCi0tTW9oaXQNCg0KT24gMi8zLzE5IDI6NDYgUE0sIEpvaG4gTWF0dHNzb24gd3JvdGU6 DQo+IEJhc2VkIG9uIHRoaXMgZGlzY3Vzc2lvbiBJIHN1Z2dlc3QgY2hhbmdpbmcgdGhlIHRpdGxl IGFuZCB0aGUgc2NvcGUgb2YgZHJhZnQtbXMtZW11LWVhcHRsc2NlcnQNCj4NCj4gT0xEOiAiSGFu ZGxpbmcgTGFyZ2UgQ2VydGlmaWNhdGVzIGFuZCBMb25nIENlcnRpZmljYXRlIENoYWlucyBpbiBF QVAtVExTIg0KPiBORVc6ICJIYW5kbGluZyBMYXJnZSBDZXJ0aWZpY2F0ZXMgYW5kIExvbmcgQ2Vy dGlmaWNhdGUgQ2hhaW5zIGluIFRMUy1iYXNlZCBFQVAgTWV0aG9kcyINCj4NCj4gVGhlIHByb2Js ZW0gZGVzY3JpcHRpb24sIGRpc2N1c3Npb24sIGFuZCBzb2x1dGlvbnMgYXJlIHRoZSBzYW1lIGZv ciBhbGwgVExTLWJhc2VkIEVBUCBNZXRob2RzLCBzbyBpdCB3b3VsZCBiZSBnb29kIHRvIG1ha2Ug aXQgY2xlYXIgdG8gcmVhZGVycyB0aGF0IHRoZSBpbmZvcm1hdGlvbiBpcyB1c2VmdWwgZm9yIG90 aGVyIFRMUy1iYXNlZCBFQVAgTWV0aG9kcyBzdWNoIGFzIFRUTFMgLyBGQVNUIC8gUEVBUCAvIFRF QVAgYXMgd2VsbC4gVGhlIG9ubHkgdGhpbmcgdGhhdCB3b3VsZCBjaGFuZ2UgaXMgIkVBUC1UTFMi IHJlcGxhY2VkIHdpdGggIiBUTFMtYmFzZWQgRUFQIE1ldGhvZHMiIGluIGEgbnVtYmVyIG9mIHBs YWNlcy4gQWxsIHRoZSB0ZWNobmljYWwgY29udGVudCB3b3VsZCBiZSB0aGUgc2FtZS4NCj4NCj4g Q2hlZXJzLA0KPiBKb2huDQo+DQo+DQo+DQo+DQo+IF9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fDQo+IEVtdSBtYWlsaW5nIGxpc3QNCj4gRW11QGlldGYub3Jn DQo+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vZW11DQo= From nobody Tue Feb 5 05:13:03 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BAB361310B3 for ; Tue, 5 Feb 2019 05:13:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RwOhpJ61Ew5A for ; Tue, 5 Feb 2019 05:12:59 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 55AF51310AE for ; Tue, 5 Feb 2019 05:12:58 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 742A03BC7; Tue, 5 Feb 2019 13:12:57 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: <13063b6c-3573-9455-4753-1692755a4b1f@ericsson.com> Date: Tue, 5 Feb 2019 08:12:55 -0500 Cc: "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <8D7301E3-890E-4338-B2F4-89DA6632D39C@deployingradius.com> References: <13063b6c-3573-9455-4753-1692755a4b1f@ericsson.com> To: Mohit Sethi M X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Feb 2019 13:13:02 -0000 On Feb 5, 2019, at 12:19 AM, Mohit Sethi M = wrote: > Do you have experience with such cross method resumption? Are there = any=20 > deployments that make use of this? There are no deployments that make use of it. It's worked in my = testing. > My initial reaction is that such cross method session resumption = should=20 > be forbidden. That is because EAP-TLS has different security = properties=20 > where both the peer and server are mutually authenticated with TLS and=20= > certificates. Mixing it with other EAP methods that use TLS only for=20= > server authentication complicates the security properties and proofs. I'm not sure how. Cross-method session resumption is essentially just changing byte 5 = (type) of the EAP conversation. Pretty much everything else remains the = same. In the implementations I've seen, that really *is* the difference. No = one is going to implement TLS over EAP 5 times: once for EAP-TLS, then = TTLS, PEAP, TEAP, FAST, ... Instead, they use a common EAP layer, and a common TLS layer. Only = once the TLS session has been established is there any method-specific = (i.e. inner-tunnel) code run, and data exchanged. So it's not clear to me how doing session resumption with byte 5 =3D=3D = 0x0d (EAP-TLS) is fine, but doing it with byte 5 =3D=3D 0x15 (TTLS) is = insecure. > Also, EAP methods that only use TLS for the outer tunnel (TTLS, PEAP,=20= > etc.) typically begin with an anonymous NAI for privacy. What NAI = would=20 > such peers use if they rely solely on TLS based resumption? The answer here is one of two things: a) the authentication server caches user information bases on the TLS = session ID b) the authentication server encrypts user information, and sends it to = the client as part of the session ticket. Either method allows the authentication server to resume the session = based on the *real* NAI of the user. This has *always* been the problem with TLS-based session resumption.=20= My concern here is that this practice has been implemented and widely = deployed for many years. The problem of (and solution for) the = anonymous NAI and TLS-based session resumption has been known for a long = time. > As a co-author of draft-ietf-emu-eap-tls13, I don't think we should=20 > support such cross method resumption. If anything, this should be=20 > discouraged/forbidden. I'm happy to do that, I'd just like to understand the reasons behind = doing it. Alan DeKok. From nobody Tue Feb 5 05:16:48 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9763B1310BB for ; Tue, 5 Feb 2019 05:16:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dEI3k7CfUFW8 for ; Tue, 5 Feb 2019 05:16:46 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id E4E221310BF for ; Tue, 5 Feb 2019 05:16:45 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id CA5B83BB5; Tue, 5 Feb 2019 13:16:44 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: <36a1fd73-ed43-67fa-7ad6-b847d1c7c2fc@ericsson.com> Date: Tue, 5 Feb 2019 08:16:43 -0500 Cc: John Mattsson , "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <80884539-DE85-4037-8E9C-FF9B940AE533@deployingradius.com> References: <6DA031E2-FB48-4A1F-85FB-88A1394C22A2@ericsson.com> <73C5F487-8AEB-412D-89F8-DE9FDE4D3C5C@deployingradius.com> <36a1fd73-ed43-67fa-7ad6-b847d1c7c2fc@ericsson.com> To: Mohit Sethi M X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] TLS 1.3 and other EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Feb 2019 13:16:48 -0000 On Feb 5, 2019, at 12:25 AM, Mohit Sethi M = wrote: >=20 > Thanks for bringing this up. I agree that we should take this=20 > opportunity to fix other EAP methods which rely on TLS for the outer=20= > tunnel. I think that these updates merit a separate document. But I am=20= > not certain why the two documents need to be published simultaneously? To be clear: they don't need consecutive RFC numbers. But it will be = absolutely a disaster if EAP-TLS is published, and then 18 months later = "TLS 1.3 for other methods" is published. It makes zero sense to publish TLS 1.3 for EAP-TLS, and then to tell = all of the other EAP methods "too bad, you're not getting updates". = People will want to use TLS 1.3 for other methods, and they will ask the = very good question as to why the IETF punted on the problem. If there is no standard for TLS 1.3 for other methods, the customers = *will* demand one, and implementors *will* create one. At that point, = the IETF will have ceded change control for those EAP methods over to = those implementors. Alan DeKok. From nobody Tue Feb 5 05:18:53 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E26E1310B4 for ; Tue, 5 Feb 2019 05:18:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bbr-tentmW_z for ; Tue, 5 Feb 2019 05:18:50 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 002E01310CA for ; Tue, 5 Feb 2019 05:18:49 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id C82F83BB5; Tue, 5 Feb 2019 13:18:48 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: Date: Tue, 5 Feb 2019 08:18:47 -0500 Cc: John Mattsson , "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: To: Mohit Sethi M X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] TLS 1.3 and other EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Feb 2019 13:18:52 -0000 On Feb 5, 2019, at 12:28 AM, Mohit Sethi M = wrote: >=20 > The recommendations in this document may be used by all TLS-based EAP=20= > methods. However, fragmenting large certificates and certificate = chains=20 > into many small messages is less of a problem when only one side=20 > (server) is authenticating with certificates. Other TLS-based EAP methods allow the use of client certificates, too. = While not the normal use-case, it is a well-known and deployed = use-case. The document should add a note that the issue is less of a concern = when client certificates are not used. Alan DeKok. From nobody Tue Feb 5 07:18:55 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 09C1F12D4EF for ; Tue, 5 Feb 2019 07:18:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.853 X-Spam-Level: X-Spam-Status: No, score=-8.853 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=PqkTNlNi; dkim=pass (1024-bit key) header.d=ericsson.com header.b=gfl2vVAY Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jVqkn5iRqjJl for ; Tue, 5 Feb 2019 07:18:51 -0800 (PST) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 69F33124BF6 for ; Tue, 5 Feb 2019 07:18:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1549379929; x=1551971929; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=v2SsPo+pkVoGBCCVMSTlMRjxurpexBRfBGdDtsdEBYY=; b=PqkTNlNiJtNzU3hMBcc6Kp90ix1UUaPfj0rzAIxxtfGe/W+acdWQl3WqlNDpENWT av2suuBdUXILI42cZUDCVpa1w/z6pWJUTYan8QWGn4HWuSx5Q0aaYH2g0bEZqA+C ZT4/EpyGkxRQxURIwlolI59RZ3lg98OQitXeff0k0gg=; X-AuditID: c1b4fb30-41b3a9e00000355c-73-5c59a959559a Received: from ESESSMB501.ericsson.se (Unknown_Domain [153.88.183.119]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id 1F.99.13660.959A95C5; Tue, 5 Feb 2019 16:18:49 +0100 (CET) Received: from ESESBMB503.ericsson.se (153.88.183.170) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Tue, 5 Feb 2019 16:18:48 +0100 Received: from EUR02-VE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB503.ericsson.se (153.88.183.170) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Tue, 5 Feb 2019 16:18:48 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=v2SsPo+pkVoGBCCVMSTlMRjxurpexBRfBGdDtsdEBYY=; b=gfl2vVAYo2ZCRIzpXrZxx+6qAap6eEF/ZEuuRcYJkVQK77wolWuEk2VLsOAZld3l5uqtNRuNtGKVfSn3P8abj98vHpumFyQIzaa6LYb5kRa7YtYNAHthuXxeOgQQhyAxaZk0AA6Ri95ChFKQ5aw4ofiZIbeNPaeEoCkZ2nXYWaQ= Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com (10.168.92.142) by HE1SPR00MB86.eurprd07.prod.outlook.com (10.168.126.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1601.17; Tue, 5 Feb 2019 15:18:47 +0000 Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::99fa:d557:2cc:787e]) by HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::99fa:d557:2cc:787e%4]) with mapi id 15.20.1601.016; Tue, 5 Feb 2019 15:18:47 +0000 From: Mohit Sethi M To: Alan DeKok CC: "emu@ietf.org" Thread-Topic: [Emu] Notes on session resumption with TLS-based EAP methods Thread-Index: AQHUvRJeKrFhAzTuu0WiU30PumuF2KXRLt6AgAAjKIA= Date: Tue, 5 Feb 2019 15:18:47 +0000 Message-ID: <187468e8-7134-0fff-9c2d-6b6baa6c4f91@ericsson.com> References: <13063b6c-3573-9455-4753-1692755a4b1f@ericsson.com> <8D7301E3-890E-4338-B2F4-89DA6632D39C@deployingradius.com> In-Reply-To: <8D7301E3-890E-4338-B2F4-89DA6632D39C@deployingradius.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 x-originating-ip: [89.166.49.243] x-clientproxiedby: HE1PR09CA0080.eurprd09.prod.outlook.com (2603:10a6:7:3d::24) To HE1PR0701MB2905.eurprd07.prod.outlook.com (2603:10a6:3:4b::14) x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1SPR00MB86; 6:lA/gxRKYNBCyRjDcJPdbPZk6+/1Pfr0iG3E1PlMaRi1gyJqwz5JQLutZYVWngJOM6xt0tWscWxQCS4g8E5l4KbQjOJtxIZGThvi/27rIU2Ap5lZN+LKXyClTbfCVPv1+OTCjlIYXAzZzflTF3H8yMlTKcebZrQ0XSM5+rOSf99YU7cLNvV+6ygYqSVY4KZFLSnEHAEc23GYbJDyg7kleWoFtN6HVXsh+B2XQKYAeu7s1Kl5GMv339B1elUPj2oJVqiUNbKQQ0rAx/y5mMmSp/Y3lSw9ax0xiS34ILPS2Vicss70xUmQiwVaDfM5/QYfz7+5FGvAoZZc/b6uj/4M3Ib04PFPAZ48Gp3u9O9a8lVrCndmHtSeBiFzMhrozc0DESiw4v+Mwwp6x5tiYriuFjrt6SvA7JeNwBjrs7y28+HjnJvzlJyvTyDu9YT09HA6H8K3ZGYXuoTsntU9CLeEYsw==; 5:L20XcqgFHtbCKbWDVqpBlIuruQmOUut4Y5ZbNc3Zutl8uGth9zjkVh/DxNdz3oJm7DKtZoo/px8Og+E+1hLmjutmyrgJNb+VADFLat7qyoTYwUlBknMiAkmDtcn8fUIBX9vq7PQDNR4p9vKAlcLocvQfedoYDz9S8JFuAbk8fOzQokwL/E3tBXSG950b80z0415U22V+Q4zRfNRf/fk93A==; 7:viwtY24dG9pX9bbjQOe/FIBdMntS2W4XlssZYMFmu/Z3hRGZyYxKS3dGT2AAROZlsNDKl/dN31OqUbCmjoAzqKjs8Su0Jihy4sN1r22wJgKtQHJuPas6Pz8OsrpZtKtwNfeVOQfZ4D1Yi9EBbR3inQ== x-ms-office365-filtering-correlation-id: 3bf86b11-276a-4a32-062b-08d68b7d39ab x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600110)(711020)(4605077)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:HE1SPR00MB86; x-ms-traffictypediagnostic: HE1SPR00MB86: authentication-results: spf=none (sender IP is ) smtp.mailfrom=mohit.m.sethi@ericsson.com; x-microsoft-antispam-prvs: x-forefront-prvs: 0939529DE2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(136003)(366004)(396003)(376002)(39860400002)(189003)(199004)(31696002)(6486002)(229853002)(86362001)(6436002)(3846002)(6116002)(4326008)(99286004)(316002)(52116002)(106356001)(102836004)(76176011)(6306002)(6512007)(36756003)(53936002)(31686004)(25786009)(14444005)(256004)(58126008)(8676002)(81166006)(68736007)(81156014)(6246003)(7736002)(8936002)(14454004)(105586002)(386003)(6506007)(486006)(53546011)(305945005)(26005)(446003)(186003)(71190400001)(71200400001)(11346002)(97736004)(6916009)(476003)(2906002)(65826007)(65956001)(66066001)(65806001)(478600001)(2616005)(64126003); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1SPR00MB86; H:HE1PR0701MB2905.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: wVBGroE1uEh9p3lz5zPmdbqPIbpMUWY1jT3bDjSR5hJpY4SUr7D53VRDaqteSlnnITpt3+M9pFWFhGcTDWMaMc2scWA+kVvZfum7DhAFR5vi2phPP2wFl+CwrtQ79dSQxW4wO19fXQfbqAenQpwX72vp43vbbIdsgUL/p5eUOsX5KejaW7U1sJ2QaEFRnDGZfSR/bBgGkmbCLmyVKiptmL9kybMC5AseqiDHfhLZDTeXnfwrY7p7oOD0DCe65bIn6fW84dfv/opUiEWnuvcpT4vqiBBdhuVy+0Bl6/eWdWu1a1FHCESJ9RWrjl63cZnEpbGa38GGZgWmQ+NAJqibVcHaXnwvd8UdWgFLkopk2xACKjLrm8N5wswTWKGsCK0N0Zu4PWvtZu1sQ6NX2VicnKKs+TQh8BCK2TF6J1cDmKc= Content-Type: text/plain; charset="utf-8" Content-ID: <2542A23A0ED7A84EAD2A9EEF5786E16F@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 3bf86b11-276a-4a32-062b-08d68b7d39ab X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Feb 2019 15:18:46.8211 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1SPR00MB86 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA02Se0hTYRjG+c45246r0ed0+mL4x9YFvKRTCkykvIBZYBRBaCi59DhXOuUc r0XlRJQ0bN4gTWre8142MUUQR5NcXkLsQoIkGmpF5r3QNLdj0H+/93me9/C8H4cmpSUCF1qj TWVYrSpRIRRTFRHdGccimyKjlMZ8N7+clRyR32BHGxVIhOWac6mwurrfxAXiijggjknUpDOs 96kYcULjyrooZf5opjmvi8pG80cKkB0N+DjUb9+jCpCYluJXCNY2dCJ+WEOQ2/Ya8UMtAd9H v9liFNaTMJ9rIHmnlIC5xVqCH2YQNO88FFi/LMRKKC17KrKyI3YHQ0fN7jpNk1gOQ/c9rbID PgtdzcNCPnIOqixLFM/+kL3URliZwoeh3WghrSzBp2F1umSvUg+CnmdfbQt2+Aw87mtFVkbY CTYsrbZlEjvDp9knBH8phrq+MZJnGSzMbNt6ynAEtK+bEK/LYeTHtO0YwOUIvnTVCnnDE0Y+ zO6FXGH8SSHiQzoR6AcLBLwRDp2Weoo3PiKoWC0XWk8G7AYNZcl8u2j4ufNgr5EGanS9pB75 VP5XttL2SG7Q0evNy2FQ+fyziGc5lBVO21iC7WGoYpYyIEEzknEMdy1J7evrxbCaWI5L1npp mdROtPunDBg3lS/RwlyQCWEaKfZL/lRHRkkFqnQuK8mEgCYVjpKWxl1JEqfKusmwyVfZtESG M6GDNKVwlmxJ7aOkWK1KZW4wTArD/nMJ2s4lGzXMjgc71V+qfhOUGH4oXilvqnG83a/+ZS4O WfCnqeCBuKL3xR45hnf6yUdTDhmZE23LgSec0zfVMflbcU6lHuxyEbdhiA+1hEYvTrbeNTdu j7H9b0fu9E8MhrDXM/O4yy+GRkb3nTTGHuiTDa/Iuy9WgauunWw5P9V7K2C6PE1BcQkqH3eS 5VR/AckGBYMlAwAA Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Feb 2019 15:18:54 -0000 SGkgQWxhbiwNCg0KT24gMi81LzE5IDM6MTMgUE0sIEFsYW4gRGVLb2sgd3JvdGU6DQo+IE9uIEZl YiA1LCAyMDE5LCBhdCAxMjoxOSBBTSwgTW9oaXQgU2V0aGkgTSA8bW9oaXQubS5zZXRoaUBlcmlj c3Nvbi5jb20+IHdyb3RlOg0KPj4gRG8geW91IGhhdmUgZXhwZXJpZW5jZSB3aXRoIHN1Y2ggY3Jv c3MgbWV0aG9kIHJlc3VtcHRpb24/IEFyZSB0aGVyZSBhbnkNCj4+IGRlcGxveW1lbnRzIHRoYXQg bWFrZSB1c2Ugb2YgdGhpcz8NCj4gICAgVGhlcmUgYXJlIG5vIGRlcGxveW1lbnRzIHRoYXQgbWFr ZSB1c2Ugb2YgaXQuICBJdCdzIHdvcmtlZCBpbiBteSB0ZXN0aW5nLg0KPg0KPj4gTXkgaW5pdGlh bCByZWFjdGlvbiBpcyB0aGF0IHN1Y2ggY3Jvc3MgbWV0aG9kIHNlc3Npb24gcmVzdW1wdGlvbiBz aG91bGQNCj4+IGJlIGZvcmJpZGRlbi4gVGhhdCBpcyBiZWNhdXNlIEVBUC1UTFMgaGFzIGRpZmZl cmVudCBzZWN1cml0eSBwcm9wZXJ0aWVzDQo+PiB3aGVyZSBib3RoIHRoZSBwZWVyIGFuZCBzZXJ2 ZXIgYXJlIG11dHVhbGx5IGF1dGhlbnRpY2F0ZWQgd2l0aCBUTFMgYW5kDQo+PiBjZXJ0aWZpY2F0 ZXMuIE1peGluZyBpdCB3aXRoIG90aGVyIEVBUCBtZXRob2RzIHRoYXQgdXNlIFRMUyBvbmx5IGZv cg0KPj4gc2VydmVyIGF1dGhlbnRpY2F0aW9uIGNvbXBsaWNhdGVzIHRoZSBzZWN1cml0eSBwcm9w ZXJ0aWVzIGFuZCBwcm9vZnMuDQo+ICAgIEknbSBub3Qgc3VyZSBob3cuDQo+DQo+ICAgIENyb3Nz LW1ldGhvZCBzZXNzaW9uIHJlc3VtcHRpb24gaXMgZXNzZW50aWFsbHkganVzdCBjaGFuZ2luZyBi eXRlIDUgKHR5cGUpIG9mIHRoZSBFQVAgY29udmVyc2F0aW9uLiAgUHJldHR5IG11Y2ggZXZlcnl0 aGluZyBlbHNlIHJlbWFpbnMgdGhlIHNhbWUuDQo+DQo+ICAgIEluIHRoZSBpbXBsZW1lbnRhdGlv bnMgSSd2ZSBzZWVuLCB0aGF0IHJlYWxseSAqaXMqIHRoZSBkaWZmZXJlbmNlLiAgTm8gb25lIGlz IGdvaW5nIHRvIGltcGxlbWVudCBUTFMgb3ZlciBFQVAgNSB0aW1lczogb25jZSBmb3IgRUFQLVRM UywgdGhlbiBUVExTLCBQRUFQLCBURUFQLCBGQVNULCAuLi4NCj4NCj4gICAgSW5zdGVhZCwgdGhl eSB1c2UgYSBjb21tb24gRUFQIGxheWVyLCBhbmQgYSBjb21tb24gVExTIGxheWVyLiAgT25seSBv bmNlIHRoZSBUTFMgc2Vzc2lvbiBoYXMgYmVlbiBlc3RhYmxpc2hlZCBpcyB0aGVyZSBhbnkgbWV0 aG9kLXNwZWNpZmljIChpLmUuIGlubmVyLXR1bm5lbCkgY29kZSBydW4sIGFuZCBkYXRhIGV4Y2hh bmdlZC4NCj4NCj4gICAgU28gaXQncyBub3QgY2xlYXIgdG8gbWUgaG93IGRvaW5nIHNlc3Npb24g cmVzdW1wdGlvbiB3aXRoIGJ5dGUgNSA9PSAweDBkIChFQVAtVExTKSBpcyBmaW5lLCBidXQgZG9p bmcgaXQgd2l0aCBieXRlIDUgPT0gMHgxNSAoVFRMUykgaXMgaW5zZWN1cmUuDQpJbmRlZWQsIFRM UyBiYXNlZCBFQVAgbWV0aG9kIGltcGxlbWVudGF0aW9ucyB0eXBpY2FsbHkgdXNlIGEgY29tbW9u IA0KdW5kZXJseWluZyBUTFMgaW1wbGVtZW50YXRpb24uDQoNCkJ1dCBzZXNzaW9uIHJlc3VtcHRp b24gaXMgbm90IHNpbXBseSBhYm91dCBjaGFuZ2luZyBvbmUgYnl0ZSBpbiB0aGUgRUFQIA0KY29u dmVyc2F0aW9uLiBJZiB5b3UgbG9vayBhdCBGaWd1cmUgMiBvZiBkcmFmdC1pZXRmLWVtdS1lYXAt dGxzMTMtMDMgDQooaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtZW11LWVh cC10bHMxMy0wMyksIGEgc2VydmVyIGlzIA0KaXNzdWluZyBhIE5ld1Nlc3Npb25UaWNrZXQgb25s eSBhZnRlciByZWNlaXZpbmcgdGhlIFRMUyBGaW5pc2hlZCBmcm9tIA0KdGhlIGNsaWVudCwgYXQg d2hpY2ggcG9pbnQgaXQgaGFzIGF1dGhlbnRpY2F0ZWQgdGhlIGNsaWVudCBpZGVudGl0eS4NCg0K V2hhdCB5b3UgYXJlIHN1Z2dlc3RpbmcgaXMgdGhhdCB0aGUgc2VydmVyIHNob3VsZCBpc3N1ZSBh IA0KTmV3U2Vzc2lvblRpY2tldCBldmVuIGJlZm9yZSB0aGUgY2xpZW50IGhhcyBiZWVuIGF1dGhl bnRpY2F0ZWQgKHdoaWNoIGlzIA0KdGhlIGNhc2UgZm9yIG90aGVyIFRMUyBiYXNlZCBFQVAgbWV0 aG9kcykgYW5kIHRoZW4gb25seSB1c2UgdGhhdCBmb3IgDQpyZXN1bXB0aW9uLiBUaGlzIGlzIHNp Z25pZmljYW50IGRpZmZlcmVuY2UuDQoNCkFsc28sIGNsaWVudCBhdXRoZW50aWNhdGlvbiB3aXRo IGFuIGVhc3ktdG8tZ3Vlc3MgcGFzc3dvcmQgaW5zaWRlIGEgVExTIA0KdHVubmVsIGlzIGRpZmZl cmVudCB0aGFuIGNsaWVudCBhdXRoZW50aWNhdGlvbiB3aXRoIGEgY2VydGlmaWNhdGUuIFdoaWNo IA0KaXMgd2h5IEkgc3RhdGVkIHRoZSBkaWZmZXJlbmNlIGluIHNlY3VyaXR5IHByb3BlcnRpZXMg YW5kIHByb29mcy4NCg0KSSBzdGlsbCBtYWludGFpbiBteSBpbml0aWFsIHBvc2l0aW9uIHRoYXQg c3VjaCBjcm9zcy1tZXRob2QgcmVzdW1wdGlvbiANCnNob3VsZCBiZSBmb3JiaWRkZW4uDQoNCi0t TW9oaXQNCg0KPg0KPj4gQWxzbywgRUFQIG1ldGhvZHMgdGhhdCBvbmx5IHVzZSBUTFMgZm9yIHRo ZSBvdXRlciB0dW5uZWwgKFRUTFMsIFBFQVAsDQo+PiBldGMuKSB0eXBpY2FsbHkgYmVnaW4gd2l0 aCBhbiBhbm9ueW1vdXMgTkFJIGZvciBwcml2YWN5LiBXaGF0IE5BSSB3b3VsZA0KPj4gc3VjaCBw ZWVycyB1c2UgaWYgdGhleSByZWx5IHNvbGVseSBvbiBUTFMgYmFzZWQgcmVzdW1wdGlvbj8NCj4g ICAgVGhlIGFuc3dlciBoZXJlIGlzIG9uZSBvZiB0d28gdGhpbmdzOg0KPg0KPiBhKSB0aGUgYXV0 aGVudGljYXRpb24gc2VydmVyIGNhY2hlcyB1c2VyIGluZm9ybWF0aW9uIGJhc2VzIG9uIHRoZSBU TFMgc2Vzc2lvbiBJRA0KPg0KPiBiKSB0aGUgYXV0aGVudGljYXRpb24gc2VydmVyIGVuY3J5cHRz IHVzZXIgaW5mb3JtYXRpb24sIGFuZCBzZW5kcyBpdCB0byB0aGUgY2xpZW50IGFzIHBhcnQgb2Yg dGhlIHNlc3Npb24gdGlja2V0Lg0KPg0KPiAgICBFaXRoZXIgbWV0aG9kIGFsbG93cyB0aGUgYXV0 aGVudGljYXRpb24gc2VydmVyIHRvIHJlc3VtZSB0aGUgc2Vzc2lvbiBiYXNlZCBvbiB0aGUgKnJl YWwqIE5BSSBvZiB0aGUgdXNlci4NCj4NCj4gICAgVGhpcyBoYXMgKmFsd2F5cyogYmVlbiB0aGUg cHJvYmxlbSB3aXRoIFRMUy1iYXNlZCBzZXNzaW9uIHJlc3VtcHRpb24uDQo+DQo+ICAgICBNeSBj b25jZXJuIGhlcmUgaXMgdGhhdCB0aGlzIHByYWN0aWNlIGhhcyBiZWVuIGltcGxlbWVudGVkIGFu ZCB3aWRlbHkgZGVwbG95ZWQgZm9yIG1hbnkgeWVhcnMuICBUaGUgcHJvYmxlbSBvZiAoYW5kIHNv bHV0aW9uIGZvcikgdGhlIGFub255bW91cyBOQUkgYW5kIFRMUy1iYXNlZCBzZXNzaW9uIHJlc3Vt cHRpb24gaGFzIGJlZW4ga25vd24gZm9yIGEgbG9uZyB0aW1lLg0KPg0KPj4gQXMgYSBjby1hdXRo b3Igb2YgZHJhZnQtaWV0Zi1lbXUtZWFwLXRsczEzLCBJIGRvbid0IHRoaW5rIHdlIHNob3VsZA0K Pj4gc3VwcG9ydCBzdWNoIGNyb3NzIG1ldGhvZCByZXN1bXB0aW9uLiBJZiBhbnl0aGluZywgdGhp cyBzaG91bGQgYmUNCj4+IGRpc2NvdXJhZ2VkL2ZvcmJpZGRlbi4NCj4gICAgSSdtIGhhcHB5IHRv IGRvIHRoYXQsIEknZCBqdXN0IGxpa2UgdG8gdW5kZXJzdGFuZCB0aGUgcmVhc29ucyBiZWhpbmQg ZG9pbmcgaXQuDQo+DQo+ICAgIEFsYW4gRGVLb2suDQo+DQo+DQo= From nobody Tue Feb 5 07:41:01 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E8D6B1200D7 for ; Tue, 5 Feb 2019 07:40:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.853 X-Spam-Level: X-Spam-Status: No, score=-8.853 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=QtUMIlWQ; dkim=pass (1024-bit key) header.d=ericsson.com header.b=TG5Fc1JH Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kdtXDAZORRtI for ; Tue, 5 Feb 2019 07:40:58 -0800 (PST) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8CC2A12DF71 for ; Tue, 5 Feb 2019 07:40:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1549381255; x=1551973255; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=qQ1Wv/9M+wzCzw3P/jAU/gUkt45aUlVXSiK4wk6Xcbc=; b=QtUMIlWQppu5Le/Dtl/6ppapcHqxHMXi6QfjMo7u8/yS1vLG7Fatq6I8LX90+hhA pm6nxZsqI0SjNDan8lOTUyYpBs7sLxLai6qJDx/fgMY1PbmUhPewoamM3QBwphY+ fSWf7cRdBDfgrSm85fpfc9gz+6IUUpCf/yE/WGKBMgI=; X-AuditID: c1b4fb3a-14fff7000000672c-87-5c59ae87d7c8 Received: from ESESBMB503.ericsson.se (Unknown_Domain [153.88.183.116]) by sessmg22.ericsson.net (Symantec Mail Security) with SMTP id 30.E4.26412.78EA95C5; Tue, 5 Feb 2019 16:40:55 +0100 (CET) Received: from ESESSMB505.ericsson.se (153.88.183.166) by ESESBMB503.ericsson.se (153.88.183.170) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Tue, 5 Feb 2019 16:40:55 +0100 Received: from EUR03-AM5-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB505.ericsson.se (153.88.183.166) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Tue, 5 Feb 2019 16:40:55 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qQ1Wv/9M+wzCzw3P/jAU/gUkt45aUlVXSiK4wk6Xcbc=; b=TG5Fc1JHzalUTiPQrOPEHD7L5r/F8gpkfiaLW2JazQeUSG4WF/zBXlG6UHn/1NNIxhKJBu4uUCQhYEwNRwY2zfFr7oKGiWYrlefgo0Ru8dz32SPqCniowenEDp89Bo3S97R9HaneNoLZwnBt/MeeSI52NYAapc0ElNtg/isEtkM= Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com (10.168.92.142) by HE1PR0701MB2556.eurprd07.prod.outlook.com (10.168.187.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1601.14; Tue, 5 Feb 2019 15:40:54 +0000 Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::99fa:d557:2cc:787e]) by HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::99fa:d557:2cc:787e%4]) with mapi id 15.20.1601.016; Tue, 5 Feb 2019 15:40:54 +0000 From: Mohit Sethi M To: Alan DeKok CC: John Mattsson , "emu@ietf.org" Thread-Topic: [Emu] TLS 1.3 and other EAP methods Thread-Index: AQHUvRMjF1RaOQQ8kkaDErtqoDuxS6XRL+yAgAAoRwA= Date: Tue, 5 Feb 2019 15:40:54 +0000 Message-ID: References: <6DA031E2-FB48-4A1F-85FB-88A1394C22A2@ericsson.com> <73C5F487-8AEB-412D-89F8-DE9FDE4D3C5C@deployingradius.com> <36a1fd73-ed43-67fa-7ad6-b847d1c7c2fc@ericsson.com> <80884539-DE85-4037-8E9C-FF9B940AE533@deployingradius.com> In-Reply-To: <80884539-DE85-4037-8E9C-FF9B940AE533@deployingradius.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 x-originating-ip: [89.166.49.243] x-clientproxiedby: HE1PR07CA0019.eurprd07.prod.outlook.com (2603:10a6:7:67::29) To HE1PR0701MB2905.eurprd07.prod.outlook.com (2603:10a6:3:4b::14) authentication-results: spf=none (sender IP is ) smtp.mailfrom=mohit.m.sethi@ericsson.com; x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR0701MB2556; 6:95606bsr/3VvYqou96NM2JXszW+oOvP8937rdgH0CknxNi//KWx1u72Qh5//PkVp28zqQwhe/DRBmiHJ5fbnkoDBRyQqi1G+4yUDgRcEUo7lzkbFtTHhrZ+rGZMEZM27GnuTxAh678YePxEFzlxN70n6Xnc0ymOdKjCHSY7C4IHjMQnKcJsK8yw2U+dX4Qmo4ktX7ZKZKNFwD1dUi8MymbXOx6PA+auUBElH9Gg9GswN4IjhYHYywR9VU0LOoAqMnV0gPSvjP/8gBoBehesHsB3qNL0fQPYfR5nHVrw9j9fOCQ8CgEeQTE+gFP9xzZuIrrWMu7DZap/pWor9lKHizvNHK1hpBc8+eB68ZGJBj53RV0yqgvhkC7wDNCihKiJEDBqb/zgUrSMR3u4/ICh3u/4HF0w+/dOf8p8539dD8JDPuaye4PYzYw9YriaKtazy4rUFjibPNQBN4HiN6m89fA==; 5:NTgQNt4Y/DG+yziri6GcfAyzZ1FQxDP+p3hudlEd/ypVmCHlxX4fqoYfaecCzsjVju+8af2zv5hMidfzFnqBDeE9tTm94+rleuhYdXLptsIk5ODr4oHp5kfqSmNqz3uq/Fk63lQFL8mN8CGOokdNhCoWRzUTX//60Agof7NF04XQ2+Oc6VEE+UjzUSuO6pLBn6MQn2GAAUrUqejxyolkpg==; 7:cdCNb0x3R8AY3YlYJR8OmJdGKSHF/PNKIKG1H9OPlFHb23YaB/SssvsqoJWq4ACGm2YNzXULLiQd4yvCekIlEdb0kC25YuxZW1IniTZeyNtwtk6cJtpi0R0DPGHoIN5iRV6ze9sDL7jKu77lv2SYuA== x-ms-office365-filtering-correlation-id: b4bb7e3d-ebee-45ed-1016-08d68b805073 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020); SRVR:HE1PR0701MB2556; x-ms-traffictypediagnostic: HE1PR0701MB2556: x-microsoft-antispam-prvs: x-forefront-prvs: 0939529DE2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(136003)(346002)(376002)(366004)(39860400002)(51444003)(189003)(199004)(25786009)(52116002)(58126008)(93886005)(186003)(65806001)(99286004)(3846002)(6116002)(53936002)(65956001)(66066001)(14454004)(68736007)(8936002)(86362001)(31696002)(229853002)(64126003)(54906003)(71190400001)(71200400001)(316002)(256004)(106356001)(36756003)(105586002)(305945005)(486006)(6486002)(97736004)(31686004)(8676002)(81166006)(2616005)(476003)(446003)(7736002)(81156014)(11346002)(6512007)(53546011)(386003)(6506007)(6916009)(65826007)(4326008)(2906002)(6436002)(6246003)(76176011)(102836004)(478600001)(26005); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2556; H:HE1PR0701MB2905.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: q6JAnWNL9y4RomdlDS9vvqUBBXhN6xJW9wGmyPpF+rBkX3UUT7S13iYlbDzw+DAlfQb6hemUQm/sJs97CC47ieoHrHeuj25ZW/M8sPsQYXFplsxOcUjU2ry93yb+sEU2dUuNUk5BPfm4On5/YqhVAnGQvTvBybeXr65I4HD70Of6cA7pNsA/mwiqeVCGxBby3USfEBtY87p5Bw99aa1ffkK+VXmprXoRknlIVM03MAYaYSvdq4Jffb1oI98BJ2cCCfoesSiui7EZkxwA2zGqbH/RSslWUnDe/pisc+jbledGLBETYrUwnYH0816jwMv4mrAnmy6oecf+qXdiMNCav+1U++iRlsnYVibqKRS33tzqjlN2lVIHAznnwLQ/mrSkmkPFreEwWHYE637BQ858UIsyYT0fy8SZXvkWljp2tFg= Content-Type: text/plain; charset="utf-8" Content-ID: <7C6869CA615D034FAC9E64802D298F85@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: b4bb7e3d-ebee-45ed-1016-08d68b805073 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Feb 2019 15:40:53.4751 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2556 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA01Sa0hTYRj2O+fMHVfDb8u1NyPK1Z/MvBVkKl4I0oQo7I/KMg96UvG+syQr 0mwhKNZCZ2mKQ/fDvK0000wQh0UWMzAvYJKZltnFZanhpWzHo9C/53su7/O+8NGkXC9ypZPT tawmnUlVOUqo8qh27cGC5mi1d+m1Q375v/LFfs/NTVQIEa57pqPCTaYl4jQRIwlMYFOTs1mN V1CcJGneVIgyB50v/hxapfKQ0bkQOdGAD4Ot4z1ViCS0HPciqJqzioTHAgJDV7uYd8lxLQEd o7k8prCehDZdoGAqI6D7lX4jPomgvO4dxbscsTeUlNatp12wOxjNNes8iU9Cf4EZ8Xib3dM7 WEYKHh8Y+9ZKCNgfBvosYqFtHwxen7fzNC3FwfB9FgldNgT1HyrX5zjhMGhY61vHCG+H3y8b CaFLCaNT1YRwJwZT12tSwAqYmfwr4rECR0HzogUJvBtYZycIvgCwAUH74jglDD0LP9ZubQzy AOvI1EZgFwxUFyEhoBOD7c5jShBOQmXJEikIb+2r/vkq3kybW5fF/DmAM6D8y1U98qn4b9kK u0Li/WDu9BLocDBUjVACdoPSogkxj6VYBn3lU5QRieqRgmM5Li3R19eT1STHc1xGumc6q21B 9n/S82jFvwP1TIdaEKaRaqt0xRitlouYbC4nzYKAJlUu0jcNdkqawORcYjUZ5zQXUlnOgnbS lEopXZXL1HKcyGjZFJbNZDWbKkE7ueahhMiwlrIHzFhQbM1ISMyVyH5nw7TNYcFWnPFUkT26 RYsMnTOylCeygOMevr2m+0tHb+dnysZ9DhhrQ+MLdgQ4gO6zS+7Nh5V7Oy+31TTdPZUWp4l4 0b1nWXki60ZoxVAWrY09VmHdzai1yojCxTPZnzyDh+lGnf4jzB0pPj98T0VxSYyPO6nhmH8V AgM9IwMAAA== Archived-At: Subject: Re: [Emu] TLS 1.3 and other EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Feb 2019 15:41:00 -0000 SGkgQWxhbiwNCg0KT25lIGNvdWxkIHVzZSB0aGUgc2FtZSBhcmd1bWVudC4gVGhvc2Ugb25seSBp bnRlcmVzdGVkIGluIGltcGxlbWVudGluZyANCkVBUC1UTFMgd2lsbCBiZSBmb3JjZWQgdG8gd2Fp dCB3aGlsZSBhbGwgb3RoZXIgbWV0aG9kcyBhcmUgYmVpbmcgdXBkYXRlZC4NCg0KQW55aG93LCBJ IGRvbid0IGV4cGVjdCB0aGUgb3RoZXIgZG9jdW1lbnQgdG8gdGFrZSAxOCBtb250aHMuIEkgbG9v ayANCmZvcndhcmQgdG8geW91ciBzdWJtaXNzaW9uIChhbmQgcmV2aWV3aW5nIGl0IG9uY2UgaXQg aXMgYXZhaWxhYmxlKS4NCg0KLS1Nb2hpdA0KDQpPbiAyLzUvMTkgMzoxNiBQTSwgQWxhbiBEZUtv ayB3cm90ZToNCj4gT24gRmViIDUsIDIwMTksIGF0IDEyOjI1IEFNLCBNb2hpdCBTZXRoaSBNIDxt b2hpdC5tLnNldGhpQGVyaWNzc29uLmNvbT4gd3JvdGU6DQo+PiBUaGFua3MgZm9yIGJyaW5naW5n IHRoaXMgdXAuIEkgYWdyZWUgdGhhdCB3ZSBzaG91bGQgdGFrZSB0aGlzDQo+PiBvcHBvcnR1bml0 eSB0byBmaXggb3RoZXIgRUFQIG1ldGhvZHMgd2hpY2ggcmVseSBvbiBUTFMgZm9yIHRoZSBvdXRl cg0KPj4gdHVubmVsLiBJIHRoaW5rIHRoYXQgdGhlc2UgdXBkYXRlcyBtZXJpdCBhIHNlcGFyYXRl IGRvY3VtZW50LiBCdXQgSSBhbQ0KPj4gbm90IGNlcnRhaW4gd2h5IHRoZSB0d28gZG9jdW1lbnRz IG5lZWQgdG8gYmUgcHVibGlzaGVkIHNpbXVsdGFuZW91c2x5Pw0KPiAgICBUbyBiZSBjbGVhcjog dGhleSBkb24ndCBuZWVkIGNvbnNlY3V0aXZlIFJGQyBudW1iZXJzLiAgQnV0IGl0IHdpbGwgYmUg YWJzb2x1dGVseSBhIGRpc2FzdGVyIGlmIEVBUC1UTFMgaXMgcHVibGlzaGVkLCBhbmQgdGhlbiAx OCBtb250aHMgbGF0ZXIgIlRMUyAxLjMgZm9yIG90aGVyIG1ldGhvZHMiIGlzIHB1Ymxpc2hlZC4N Cj4NCj4gICAgSXQgbWFrZXMgemVybyBzZW5zZSB0byBwdWJsaXNoIFRMUyAxLjMgZm9yIEVBUC1U TFMsIGFuZCB0aGVuIHRvIHRlbGwgYWxsIG9mIHRoZSBvdGhlciBFQVAgbWV0aG9kcyAidG9vIGJh ZCwgeW91J3JlIG5vdCBnZXR0aW5nIHVwZGF0ZXMiLiAgUGVvcGxlIHdpbGwgd2FudCB0byB1c2Ug VExTIDEuMyBmb3Igb3RoZXIgbWV0aG9kcywgYW5kIHRoZXkgd2lsbCBhc2sgdGhlIHZlcnkgZ29v ZCBxdWVzdGlvbiBhcyB0byB3aHkgdGhlIElFVEYgcHVudGVkIG9uIHRoZSBwcm9ibGVtLg0KPg0K PiAgICBJZiB0aGVyZSBpcyBubyBzdGFuZGFyZCBmb3IgVExTIDEuMyBmb3Igb3RoZXIgbWV0aG9k cywgdGhlIGN1c3RvbWVycyAqd2lsbCogZGVtYW5kIG9uZSwgYW5kIGltcGxlbWVudG9ycyAqd2ls bCogY3JlYXRlIG9uZS4gIEF0IHRoYXQgcG9pbnQsIHRoZSBJRVRGIHdpbGwgaGF2ZSBjZWRlZCBj aGFuZ2UgY29udHJvbCBmb3IgdGhvc2UgRUFQIG1ldGhvZHMgb3ZlciB0byB0aG9zZSBpbXBsZW1l bnRvcnMuDQo+DQo+ICAgIEFsYW4gRGVLb2suDQo+DQo+DQoNCg== From nobody Tue Feb 5 07:46:31 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 37661130E7D for ; Tue, 5 Feb 2019 07:46:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8KkkB00o_KNe for ; Tue, 5 Feb 2019 07:46:27 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 3C9251200D7 for ; Tue, 5 Feb 2019 07:46:27 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id D5BC61591; Tue, 5 Feb 2019 15:46:25 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: Date: Tue, 5 Feb 2019 10:46:24 -0500 Cc: John Mattsson , "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <43AE4AAF-2ED0-49D6-B6A5-9EE996992671@deployingradius.com> References: <6DA031E2-FB48-4A1F-85FB-88A1394C22A2@ericsson.com> <73C5F487-8AEB-412D-89F8-DE9FDE4D3C5C@deployingradius.com> <36a1fd73-ed43-67fa-7ad6-b847d1c7c2fc@ericsson.com> <80884539-DE85-4037-8E9C-FF9B940AE533@deployingradius.com> To: Mohit Sethi M X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] TLS 1.3 and other EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Feb 2019 15:46:30 -0000 On Feb 5, 2019, at 10:40 AM, Mohit Sethi M = wrote: >=20 > One could use the same argument. Those only interested in implementing=20= > EAP-TLS will be forced to wait while all other methods are being = updated. Yes. Sorry, but that's a good thing. Revving one EAP method while ignoring = the others is a major problem IMHO. > Anyhow, I don't expect the other document to take 18 months. I look=20 > forward to your submission (and reviewing it once it is available). It should be small. And the WG should be incentivized to publish it = quickly. Alan DeKok. From nobody Tue Feb 5 07:48:03 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C249130EAA for ; Tue, 5 Feb 2019 07:48:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WG8IzxNFksP3 for ; Tue, 5 Feb 2019 07:48:00 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 22AC7130E6E for ; Tue, 5 Feb 2019 07:48:00 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 14A831591; Tue, 5 Feb 2019 15:47:58 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: <187468e8-7134-0fff-9c2d-6b6baa6c4f91@ericsson.com> Date: Tue, 5 Feb 2019 10:47:57 -0500 Cc: "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <13063b6c-3573-9455-4753-1692755a4b1f@ericsson.com> <8D7301E3-890E-4338-B2F4-89DA6632D39C@deployingradius.com> <187468e8-7134-0fff-9c2d-6b6baa6c4f91@ericsson.com> To: Mohit Sethi M X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Feb 2019 15:48:02 -0000 On Feb 5, 2019, at 10:18 AM, Mohit Sethi M = wrote: >=20 > But session resumption is not simply about changing one byte in the = EAP=20 > conversation. If you look at Figure 2 of draft-ietf-emu-eap-tls13-03=20= > (https://tools.ietf.org/html/draft-ietf-emu-eap-tls13-03), a server is=20= > issuing a NewSessionTicket only after receiving the TLS Finished from=20= > the client, at which point it has authenticated the client identity. Yes... > What you are suggesting is that the server should issue a=20 > NewSessionTicket even before the client has been authenticated (which = is=20 > the case for other TLS based EAP methods) and then only use that for=20= > resumption. This is significant difference. No, that's not what I'm saying. I'm not sure why there's confusion. I'm saying this: 1) user is authenticated via EAP-TLS as normal 2) user gets a session ticket for fast session resumption 3) user tries to resume the session using the session ticket. My questions here are about (3). a) Can the user resume via EAP-TLS? Clearly, yes. b) Can the user resume via TTLS? In practice, very likely, yes OK... so should we disallow (b)? If so, why? If not, why not? > Also, client authentication with an easy-to-guess password inside a = TLS=20 > tunnel is different than client authentication with a certificate. = Which=20 > is why I stated the difference in security properties and proofs. That's true, but is only one part of the situation. What about doing an EAP-TLS session, and then resuming via TTLS? That = is a strong authentication with a certificate. How is that resumption = *quantitatively different* from resuming via EAP-TLS? In that situation, the difference *is* exactly octet 5 of the EAP = packet. So again, what *other* difference would forbid that kind of = session resumption? We also PEAP with inner MS-CHAP, versus TTLS with inner MS-CHAP. In = that case, both methods have similar data for inner authentication. So = why forbid cross-method session resumption? Or authenticating via TTLS with client certs, and resuming via = EAP-TLS. For that situation, they have similar security properties. In the end, if a site administrator says "I allow passwords and = session resumption", that should work. I still don't see any = quantitative difference when session resumption is done while changing = octet 5 of the EAP packet. Saying "security properties" when only octet = 5 has changed isn't a convincing argument. Maybe the answer here is "we have no idea what cross-method session = resumption means, and therefore we forbid it". That's a good answer. But if there are reasons for doing so, I wish = to understand those reasons. Alan DeKok. From nobody Tue Feb 5 08:16:21 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CEAAF130DE4 for ; Tue, 5 Feb 2019 08:16:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.853 X-Spam-Level: X-Spam-Status: No, score=-8.853 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=Ei7E0Idy; dkim=pass (1024-bit key) header.d=ericsson.com header.b=dtfI325P Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ygdr8dOVNNmS for ; Tue, 5 Feb 2019 08:16:17 -0800 (PST) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C4BC512008A for ; Tue, 5 Feb 2019 08:16:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1549383374; x=1551975374; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=YpSJej0sVFFRRhHSl9CaUN1OBGP98kMKPOoKbXijUkI=; b=Ei7E0Idys5DclTL4kAeGWTmbxZIM2JiSEbnTwpqgpvDikf4ECLErM8RMNr+JUfSM acYSA5YK2d2vSN9e0vkPSKKmjxU5R4LhipsOSMsL9oGMwG34oNl2/dFtGFv1RbjE /hmFwzM4jUiN6uRHSMDmOUQXFe18rzb/39B7difGgwM=; X-AuditID: c1b4fb2d-d9dff7000000062f-5c-5c59b6cea38b Received: from ESESSMB504.ericsson.se (Unknown_Domain [153.88.183.122]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id 2B.CD.01583.EC6B95C5; Tue, 5 Feb 2019 17:16:14 +0100 (CET) Received: from ESESSMB501.ericsson.se (153.88.183.162) by ESESSMB504.ericsson.se (153.88.183.192) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Tue, 5 Feb 2019 17:16:14 +0100 Received: from EUR02-VE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Tue, 5 Feb 2019 17:16:14 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YpSJej0sVFFRRhHSl9CaUN1OBGP98kMKPOoKbXijUkI=; b=dtfI325PiqlJX5TxiKJkpqbkXvC3VX6pRkQw2t35BrQ9MUSrMF2ZgifEwHktANpXi7XciPbXZt0QvwdW9e097FtDNkPdZ98rdxEmo9i+gWkFMw8eLtaEzG960rjtdw4RePCe4dUjEVEPpPaAr5XoNtMvlQYV1AnbMlKpkk8KoVc= Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com (10.168.92.142) by HE1PR0701MB2394.eurprd07.prod.outlook.com (10.168.128.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1601.16; Tue, 5 Feb 2019 16:16:13 +0000 Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::99fa:d557:2cc:787e]) by HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::99fa:d557:2cc:787e%4]) with mapi id 15.20.1601.016; Tue, 5 Feb 2019 16:16:13 +0000 From: Mohit Sethi M To: Alan DeKok CC: "emu@ietf.org" Thread-Topic: [Emu] Notes on session resumption with TLS-based EAP methods Thread-Index: AQHUvRJeKrFhAzTuu0WiU30PumuF2KXRLt6AgAAjKICAAAgpgIAAB+IA Date: Tue, 5 Feb 2019 16:16:12 +0000 Message-ID: References: <13063b6c-3573-9455-4753-1692755a4b1f@ericsson.com> <8D7301E3-890E-4338-B2F4-89DA6632D39C@deployingradius.com> <187468e8-7134-0fff-9c2d-6b6baa6c4f91@ericsson.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 x-originating-ip: [89.166.49.243] x-clientproxiedby: HE1PR0901CA0053.eurprd09.prod.outlook.com (2603:10a6:3:45::21) To HE1PR0701MB2905.eurprd07.prod.outlook.com (2603:10a6:3:4b::14) x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR0701MB2394; 6:qcU1x7FpcG/p6yvNkfK8ACWQT6y/VsY7x+OpqKe63a8G1nBr79Re5fsBbXeJ/nUYSZZ7RV41peRWt2V3nAFp7+4nif6Lf1bDwpnW1ZWUEUD5k7uU0IUjpKAXv00RSFPCKm/b9x4RiCkf1IqjJlhc+/qxg1JWo7o7avCcxZFPa9Ro15Vh9w5JChdAHoGcQo/x6ir5OEKp0JLYq1xULFp2SgxZZEBigrsRtL1b6Qxjmr29+V4i3iJxCWY5Dz4WxNBHA5uYsLvOWv2zeRcmU4DB12UO7GEnJUMUk5TwZ9gh7Lj8c7SG5AWtH0wP8TOFyIxXjT1CgW0AjbhFeYg3OUGbDtcW4j2e3sEYzpwfx/2zxqTPgcdhdpjoHMovJt5qnHD/4raZZEDxu1y4860XYhFG9Wx96n6MXLrvJfYajQFqZ3E3uG8jyCDr2A43f1mb+Ly+TsRc4yU0ZyXvMLQQ4agjjQ==; 5:E2NnMTjsba4Ua8vIXqad0sqT8EkyNcTFBf9Ww1lHWguCq56NvsVwkK4z3wwbepJCPYGRqPEZj8xEpgjJ7ZNsF2sK1L3bpGNcZ78fCCvjnkVDAwXopnD50/xlHx3R9VcNoCn5ePGLdpClFzWH/YGEloNCHlNprr5OnTmLM5ZXdOsEi6IimH+ROHKkqId9Xwa0hIOx+MEhSN4DgS7WiEWlJA==; 7:iU68OXaTEVcHwugjJg7W41DKxDEGiE7fesxhEXykef7zRrdO9/xiEwmOM8bBCtBun4kTXxBvtPh6z+mMNapN3TDAvMOg9nQVNkgFx8aSDLBUZ2MHDF0zoVtTRC1mx8NDS3Lt7zeG1Msn8GeCj376iA== x-ms-office365-filtering-correlation-id: dc5e6cb8-9940-46c4-d6ac-08d68b853f32 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600110)(711020)(4605077)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:HE1PR0701MB2394; x-ms-traffictypediagnostic: HE1PR0701MB2394: x-microsoft-antispam-prvs: x-forefront-prvs: 0939529DE2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(136003)(39860400002)(396003)(346002)(376002)(199004)(189003)(14444005)(71200400001)(256004)(6116002)(8936002)(81166006)(106356001)(3846002)(4326008)(6486002)(105586002)(81156014)(52116002)(486006)(6246003)(446003)(476003)(14454004)(229853002)(76176011)(2616005)(8676002)(99286004)(11346002)(6436002)(316002)(66066001)(97736004)(68736007)(6512007)(71190400001)(53936002)(31686004)(6306002)(58126008)(65806001)(25786009)(186003)(65956001)(7736002)(65826007)(93886005)(53546011)(2906002)(478600001)(64126003)(305945005)(6506007)(6916009)(26005)(386003)(31696002)(86362001)(102836004)(6346003)(36756003); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2394; H:HE1PR0701MB2905.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=mohit.m.sethi@ericsson.com; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: j3P7TwlDHOZFXlw8WBv6s3vJrukws5z8G5x5CW/FBcYPA5CzUk34yFQqLl6NTAsitvfmxzBlrzWoKPgR5zfcZQaJ1Vs7/uoDUmroR9ZWirBMvoW1rxTN014TyBfuBLCdTd9Ig8vRS35tJlqUb1XvjtrdOvVUPcHXq/IQ+4JItE0hDYQbWGm8TFNB3/Ga5/LB6Lnu6rOL700Q4qR1Jshcm708O5Rg45KQmKwEEO2qSF8k19PB565Bk1tt3LktMsZy5e7GBvQSOgEsR/8qb2FRBoHKdm2ZuVVNrmGlN1Sii3BUMUhy6m33nJwTTlX5j8EyKBzdTmCozE1cXX1Ke8B1xv0Umkt0wlCbZoqCMwdGmvU1nVevAgS7JfzG/1QSxbKPzN/mcGJg7SbacC34e/pkMvlrt3pkqQPLfyDgSom7LKM= Content-Type: text/plain; charset="utf-8" Content-ID: <2EEAD9671EF72C4DADF61CC0EBFB09F7@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: dc5e6cb8-9940-46c4-d6ac-08d68b853f32 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Feb 2019 16:16:12.0616 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2394 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA01Sa0hTYRjmO+dsOw5HX8vpm9aPTSWSeSspqaisyEsF9SNwYtTSg4o6ZWdJ GtoQCVFZllYqgVPnEjddmit1RrhKdKSCRBcLvM1KJMnMUrPI7Uzo3/M+z/NeeWlSfJvnT2eo NIxapcyS8YVUbeKTgtCRx4rkCP1XeXTxUrEgesDSRh0l4kpellBxBsMqcZZIEh5KZbIy8hh1 +OFLwnTDmzp+rj7o6sLnUr4WtQSWIS8acBSYJpZRGRLSYvwCgbFyiHAJYryMoKMnlBOaCLB2 zPJcAYUrSRhoslGccpcAh3XJE8wgaDTN81z5fBwBVdUtAhf2wSGgtzRumGiaxFIYqpC76G04 Hqytr/icJQHuOxYpDp+Ed7Y+0oUpHASzd1bcWISPgM54i+R6mQmoXSx2J3vhWBh/+sdtQtgX fjnM7h1I7AfjznqCWxSDoW+U5LAE5mb+uueU4ERo/2lHHC+F4YUpwtUA8D0En1Z/8DlBDsNv nR7TThirL0ecqUQA1mmbp+oZGJzUCjjhA4IJ7RS5mW0b0Xsq5UD52hfPSDugu6efqESRdf9N W+e+0m6w9IZzdBw0rA3yOCyF6vIpQZ37GlthqNZJ6RGvFUlYhmWz0/bsDWPUGSksm6MKUzGa TrTxKf1dv0O7kWk+xo4wjWTeIl2nIlnMU+ax+dl2BDQp8xHJrRuUKFWZX8Cocy6qr2QxrB0F 0JTMT7Qu3posxmlKDZPJMLmMelMlaC9/LZIf1D1ShrNI+kAtk+wyevOyaVW7d5J4ZNUWE3uu q7m5M2kuOrNcMT39sejmjX1b2Gu9bHx86f5gR9UJ06Tke8j5h4pk5zNjjblFLDh2OqC6hsg/ AMHXBcLCqIqi7ZYLz+d8XjOFow1j85HvE5iIlFPHfS9LVtY0ujbzyvq3QBnFpisjQ0g1q/wH NYycYCUDAAA= Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Feb 2019 16:16:20 -0000 SGkgQWxhbiwNCg0KT24gMi81LzE5IDU6NDggUE0sIEFsYW4gRGVLb2sgd3JvdGU6DQo+IE9uIEZl YiA1LCAyMDE5LCBhdCAxMDoxOCBBTSwgTW9oaXQgU2V0aGkgTSA8bW9oaXQubS5zZXRoaUBlcmlj c3Nvbi5jb20+IHdyb3RlOg0KPj4gQnV0IHNlc3Npb24gcmVzdW1wdGlvbiBpcyBub3Qgc2ltcGx5 IGFib3V0IGNoYW5naW5nIG9uZSBieXRlIGluIHRoZSBFQVANCj4+IGNvbnZlcnNhdGlvbi4gSWYg eW91IGxvb2sgYXQgRmlndXJlIDIgb2YgZHJhZnQtaWV0Zi1lbXUtZWFwLXRsczEzLTAzDQo+PiAo aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtZW11LWVhcC10bHMxMy0wMyks IGEgc2VydmVyIGlzDQo+PiBpc3N1aW5nIGEgTmV3U2Vzc2lvblRpY2tldCBvbmx5IGFmdGVyIHJl Y2VpdmluZyB0aGUgVExTIEZpbmlzaGVkIGZyb20NCj4+IHRoZSBjbGllbnQsIGF0IHdoaWNoIHBv aW50IGl0IGhhcyBhdXRoZW50aWNhdGVkIHRoZSBjbGllbnQgaWRlbnRpdHkuDQo+ICAgIFllcy4u Lg0KPg0KPj4gV2hhdCB5b3UgYXJlIHN1Z2dlc3RpbmcgaXMgdGhhdCB0aGUgc2VydmVyIHNob3Vs ZCBpc3N1ZSBhDQo+PiBOZXdTZXNzaW9uVGlja2V0IGV2ZW4gYmVmb3JlIHRoZSBjbGllbnQgaGFz IGJlZW4gYXV0aGVudGljYXRlZCAod2hpY2ggaXMNCj4+IHRoZSBjYXNlIGZvciBvdGhlciBUTFMg YmFzZWQgRUFQIG1ldGhvZHMpIGFuZCB0aGVuIG9ubHkgdXNlIHRoYXQgZm9yDQo+PiByZXN1bXB0 aW9uLiBUaGlzIGlzIHNpZ25pZmljYW50IGRpZmZlcmVuY2UuDQo+ICAgIE5vLCB0aGF0J3Mgbm90 IHdoYXQgSSdtIHNheWluZy4gSSdtIG5vdCBzdXJlIHdoeSB0aGVyZSdzIGNvbmZ1c2lvbi4NCj4N Cj4gICAgSSdtIHNheWluZyB0aGlzOg0KPg0KPiAxKSB1c2VyIGlzIGF1dGhlbnRpY2F0ZWQgdmlh IEVBUC1UTFMgYXMgbm9ybWFsDQo+DQo+IDIpIHVzZXIgZ2V0cyBhIHNlc3Npb24gdGlja2V0IGZv ciBmYXN0IHNlc3Npb24gcmVzdW1wdGlvbg0KPg0KPiAzKSB1c2VyIHRyaWVzIHRvIHJlc3VtZSB0 aGUgc2Vzc2lvbiB1c2luZyB0aGUgc2Vzc2lvbiB0aWNrZXQuDQo+DQo+ICAgIE15IHF1ZXN0aW9u cyBoZXJlIGFyZSBhYm91dCAoMykuDQo+DQo+IGEpIENhbiB0aGUgdXNlciByZXN1bWUgdmlhIEVB UC1UTFM/ICBDbGVhcmx5LCB5ZXMuDQo+DQo+IGIpIENhbiB0aGUgdXNlciByZXN1bWUgdmlhIFRU TFM/ICBJbiBwcmFjdGljZSwgdmVyeSBsaWtlbHksIHllcw0KPg0KPiAgICBPSy4uLiBzbyBzaG91 bGQgd2UgZGlzYWxsb3cgKGIpPyAgSWYgc28sIHdoeT8gIElmIG5vdCwgd2h5IG5vdD8NCj4NCj4+ IEFsc28sIGNsaWVudCBhdXRoZW50aWNhdGlvbiB3aXRoIGFuIGVhc3ktdG8tZ3Vlc3MgcGFzc3dv cmQgaW5zaWRlIGEgVExTDQo+PiB0dW5uZWwgaXMgZGlmZmVyZW50IHRoYW4gY2xpZW50IGF1dGhl bnRpY2F0aW9uIHdpdGggYSBjZXJ0aWZpY2F0ZS4gV2hpY2gNCj4+IGlzIHdoeSBJIHN0YXRlZCB0 aGUgZGlmZmVyZW5jZSBpbiBzZWN1cml0eSBwcm9wZXJ0aWVzIGFuZCBwcm9vZnMuDQo+ICAgIFRo YXQncyB0cnVlLCBidXQgaXMgb25seSBvbmUgcGFydCBvZiB0aGUgc2l0dWF0aW9uLg0KPg0KPiAg ICBXaGF0IGFib3V0IGRvaW5nIGFuIEVBUC1UTFMgc2Vzc2lvbiwgYW5kIHRoZW4gcmVzdW1pbmcg dmlhIFRUTFM/ICBUaGF0IGlzIGEgc3Ryb25nIGF1dGhlbnRpY2F0aW9uIHdpdGggYSBjZXJ0aWZp Y2F0ZS4gIEhvdyBpcyB0aGF0IHJlc3VtcHRpb24gKnF1YW50aXRhdGl2ZWx5IGRpZmZlcmVudCog ZnJvbSByZXN1bWluZyB2aWEgRUFQLVRMUz8NClBlZXIvQ2xpZW50IGF1dGhlbnRpY2F0aW9uIGlu IHN0YWdlIDEgb2YgRUFQLVRUTFMgaXMgb3B0aW9uYWwuIFNvIHRoZXJlIA0KaXMgcHJvYmFibHkg bm8gZGlmZmVyZW5jZSBpZiB5b3UgZG8gRUFQLVRMUyBmaXJzdCBhbmQgdGhlbiBwb3NzaWJseSB1 c2UgDQpFQVAtVFRMUyByZXN1bXB0aW9uLiBCdXQgdGhlIG90aGVyIHdheSwgRUFQLVRUTFMvRUFQ LVBFQVAgZmlyc3QgYW5kIHRoZW4gDQpFQVAtVExTIHJlc3VtcHRpb24gaXMgbm90IHRoZSBva2F5 LiBUaGF0IGlzIGJlY2F1c2UgeW91IGNhbid0IGtub3cgaG93IA0KYW5kIHdoZW4gdGhlIGNsaWVu dCB3YXMgYXV0aGVudGljYXRlZCB3aXRoIEVBUC1UVExTL0VBUC1QRUFQLg0KPg0KPiAgICBJbiB0 aGF0IHNpdHVhdGlvbiwgdGhlIGRpZmZlcmVuY2UgKmlzKiBleGFjdGx5IG9jdGV0IDUgb2YgdGhl IEVBUCBwYWNrZXQuICBTbyBhZ2Fpbiwgd2hhdCAqb3RoZXIqIGRpZmZlcmVuY2Ugd291bGQgZm9y YmlkIHRoYXQga2luZCBvZiBzZXNzaW9uIHJlc3VtcHRpb24/DQo+DQo+ICAgIFdlIGFsc28gUEVB UCB3aXRoIGlubmVyIE1TLUNIQVAsIHZlcnN1cyBUVExTIHdpdGggaW5uZXIgTVMtQ0hBUC4gIElu IHRoYXQgY2FzZSwgYm90aCBtZXRob2RzIGhhdmUgc2ltaWxhciBkYXRhIGZvciBpbm5lciBhdXRo ZW50aWNhdGlvbi4gIFNvIHdoeSBmb3JiaWQgY3Jvc3MtbWV0aG9kIHNlc3Npb24gcmVzdW1wdGlv bj8NCj4NCj4gICAgT3IgYXV0aGVudGljYXRpbmcgdmlhIFRUTFMgd2l0aCBjbGllbnQgY2VydHMs IGFuZCByZXN1bWluZyB2aWEgRUFQLVRMUy4gIEZvciB0aGF0IHNpdHVhdGlvbiwgdGhleSBoYXZl IHNpbWlsYXIgc2VjdXJpdHkgcHJvcGVydGllcy4NCj4NCj4gICAgSW4gdGhlIGVuZCwgaWYgYSBz aXRlIGFkbWluaXN0cmF0b3Igc2F5cyAiSSBhbGxvdyBwYXNzd29yZHMgYW5kIHNlc3Npb24gcmVz dW1wdGlvbiIsIHRoYXQgc2hvdWxkIHdvcmsuICBJIHN0aWxsIGRvbid0IHNlZSBhbnkgcXVhbnRp dGF0aXZlIGRpZmZlcmVuY2Ugd2hlbiBzZXNzaW9uIHJlc3VtcHRpb24gaXMgZG9uZSB3aGlsZSBj aGFuZ2luZyBvY3RldCA1IG9mIHRoZSBFQVAgcGFja2V0LiAgU2F5aW5nICJzZWN1cml0eSBwcm9w ZXJ0aWVzIiB3aGVuIG9ubHkgb2N0ZXQgNSBoYXMgY2hhbmdlZCBpc24ndCBhIGNvbnZpbmNpbmcg YXJndW1lbnQuDQo+DQo+ICAgIE1heWJlIHRoZSBhbnN3ZXIgaGVyZSBpcyAid2UgaGF2ZSBubyBp ZGVhIHdoYXQgY3Jvc3MtbWV0aG9kIHNlc3Npb24gcmVzdW1wdGlvbiBtZWFucywgYW5kIHRoZXJl Zm9yZSB3ZSBmb3JiaWQgaXQiLg0KPg0KPiAgICBUaGF0J3MgYSBnb29kIGFuc3dlci4gIEJ1dCBp ZiB0aGVyZSBhcmUgcmVhc29ucyBmb3IgZG9pbmcgc28sIEkgd2lzaCB0byB1bmRlcnN0YW5kIHRo b3NlIHJlYXNvbnMuDQpJIHRoaW5rIHdlIGFyZSBpbiBhZ3JlZW1lbnQgdGhhdCB0aGVyZSBpcyBu b3QgZ29vZCByZWFzb24gdG8gYWxsb3cgc3VjaCANCmNyb3NzIG1ldGhvZCByZXN1bXB0aW9uIGFu ZCB0aGF0IHRoaXMgc2hvdWxkIGJlIGZvcmJpZGRlbiBhcyBzdWNoLg0KDQotLU1vaGl0DQoNCj4N Cj4gICAgQWxhbiBEZUtvay4NCj4NCj4NCg== From nobody Tue Feb 5 08:17:17 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46F5B130E6B for ; Tue, 5 Feb 2019 08:17:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.853 X-Spam-Level: X-Spam-Status: No, score=-8.853 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=IJC3Atqn; dkim=pass (1024-bit key) header.d=ericsson.com header.b=Crt/5z+C Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iUD0F3Nwf0lt for ; Tue, 5 Feb 2019 08:17:14 -0800 (PST) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 582CF130DE4 for ; Tue, 5 Feb 2019 08:17:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1549383432; x=1551975432; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=FxjzpqD12AGz5akvz0PwFyAz6RloAgGC8JUjYF9EhV0=; b=IJC3AtqnWeaSpCalAVYfcLD6MS7idk97ptG3Ygf8Y7YDF0i8tCbS4LctXQ5ehxcE ScnWscyAaBnHOEZ4AY1ZTgKgZN1/q+vX8zMA1n8/qjNIlcNMd8WrcKPMxpq/NjP4 cSQxdLLNGDwYYgKp8fufIDBxAD5rMLH/04ZPOFStxUw=; X-AuditID: c1b4fb30-fabff7000000355c-31-5c59b7084bb9 Received: from ESESSMB503.ericsson.se (Unknown_Domain [153.88.183.121]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id 0A.17.13660.807B95C5; Tue, 5 Feb 2019 17:17:12 +0100 (CET) Received: from ESESBMR503.ericsson.se (153.88.183.135) by ESESSMB503.ericsson.se (153.88.183.191) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Tue, 5 Feb 2019 17:17:12 +0100 Received: from ESESBMB503.ericsson.se (153.88.183.170) by ESESBMR503.ericsson.se (153.88.183.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Tue, 5 Feb 2019 17:17:12 +0100 Received: from EUR02-VE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB503.ericsson.se (153.88.183.170) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Tue, 5 Feb 2019 17:17:11 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FxjzpqD12AGz5akvz0PwFyAz6RloAgGC8JUjYF9EhV0=; b=Crt/5z+CASDIfbS64r8OxvO94p45UgND1JHqvFRoNOJUYZem58pgrLYANolOx2P79ulYYF4Z9vU1pnxrGyb9ax9hdpceTvX8wJIAEeJRKtFWOZBpoCp4huvqxPKfvXWjSMOZyMMWnbQ6IGyFSSN/p3RusvuyBt+l8Vd9R105w+8= Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com (10.168.92.142) by HE1PR0701MB2394.eurprd07.prod.outlook.com (10.168.128.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1601.16; Tue, 5 Feb 2019 16:17:10 +0000 Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::99fa:d557:2cc:787e]) by HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::99fa:d557:2cc:787e%4]) with mapi id 15.20.1601.016; Tue, 5 Feb 2019 16:17:10 +0000 From: Mohit Sethi M To: Alan DeKok CC: John Mattsson , "emu@ietf.org" Thread-Topic: [Emu] TLS 1.3 and other EAP methods Thread-Index: AQHUvRMjF1RaOQQ8kkaDErtqoDuxS6XRL+yAgAAoRwCAAAGLAIAACJcA Date: Tue, 5 Feb 2019 16:17:10 +0000 Message-ID: <31ed9e4a-95dd-cab4-efad-e8bc9efbd958@ericsson.com> References: <6DA031E2-FB48-4A1F-85FB-88A1394C22A2@ericsson.com> <73C5F487-8AEB-412D-89F8-DE9FDE4D3C5C@deployingradius.com> <36a1fd73-ed43-67fa-7ad6-b847d1c7c2fc@ericsson.com> <80884539-DE85-4037-8E9C-FF9B940AE533@deployingradius.com> <43AE4AAF-2ED0-49D6-B6A5-9EE996992671@deployingradius.com> In-Reply-To: <43AE4AAF-2ED0-49D6-B6A5-9EE996992671@deployingradius.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 x-originating-ip: [89.166.49.243] x-clientproxiedby: HE1PR06CA0154.eurprd06.prod.outlook.com (2603:10a6:7:16::41) To HE1PR0701MB2905.eurprd07.prod.outlook.com (2603:10a6:3:4b::14) x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR0701MB2394; 6:9MqsdaceeidozO6wO4f/CnOS0TI6KYeG8WpGK/RXdruCqc7oaYt6HarvVg9/0RoSWjN0sRusVe278ezeDSJ8Yrp5FmxYy+O6HO8GelhjMAmzhmxKcaOzg99L1oyUp4jiYhQsWKVJH1dkY/dNe502AidgDzr60quBlyY24w8XKcZXsJ5ldrwJEMHHUEkkX1QpMD+WB/GqYa4qMizrVFTGx3MsogazFAgXeqbmPnzCX3zuPCMfTxOyQpoqy8G+6D5NjQAfSUgDa/4FzpHokrQHhgbJ5D8xpL41YmYVlRobwU9WRDAg5vz1CbtojmSKAbpRj+5UjxxqddGjoHc22pTmpzz5uIVcI/95/JM1GilZAZjmX0o9Sp9mdUCatw6C/zCregMU3khXKAYtIR1489PM0EawAiOw0mjFDtpuPzGJFPh0byrL+uRhGPwpxSUGvh7J/DUbiuWxVtnBrVJ7qFfeVA==; 5:hLbCf3lGAyQuWLIBRO5RIp8cRC+MGhm/pcuFSqCciP7HNuKuKps3Y+RLAyOC2Y3vZM/pb5pm3ldYQ37CYZQmbq6YWfj46tzBgJLZkJ08o75n+5lOz8MwJN59sY/KRx6FioTOrXtzcmgQyh4SGRdDBzDP1/nBAeJFruu5t8hgM+gDoM5y/d7sTKQgMjnDVj9bcJ5gLS5wIS1o2TiwcbZj2g==; 7:UgJ2bDkY8hmBl8kCPRNWf1/jbue6BQvhjsGSnZydV1o3Yti+2fG4NelapZHAsEpfWZopMQCX8dasoE9SS71+a5egz0pEIyFxbE7M9Lf28Gc0q32Y6rJvqRtHPQ80d9ndEzDtRa8jGT0IZTlwYZAoyw== x-ms-office365-filtering-correlation-id: 823f805a-ab87-4437-8d0a-08d68b8561a2 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600110)(711020)(4605077)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:HE1PR0701MB2394; x-ms-traffictypediagnostic: HE1PR0701MB2394: x-microsoft-antispam-prvs: x-forefront-prvs: 0939529DE2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(136003)(39860400002)(396003)(346002)(376002)(51234002)(199004)(189003)(71200400001)(256004)(6116002)(8936002)(81166006)(106356001)(3846002)(4326008)(6486002)(105586002)(81156014)(52116002)(486006)(6246003)(446003)(476003)(14454004)(229853002)(76176011)(2616005)(8676002)(99286004)(16799955002)(11346002)(6436002)(966005)(316002)(66066001)(97736004)(68736007)(6512007)(71190400001)(54906003)(53936002)(31686004)(6306002)(58126008)(65806001)(25786009)(186003)(65956001)(7736002)(65826007)(93886005)(53546011)(2906002)(478600001)(64126003)(305945005)(6506007)(6916009)(26005)(386003)(4744005)(31696002)(86362001)(102836004)(6346003)(36756003); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2394; H:HE1PR0701MB2905.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=mohit.m.sethi@ericsson.com; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Q1weZNcj3lG95CKOQefoNWSnmelnGVLXmlCQ4pjGtAxPxk6KY0/x24Np7IPBPL3pReM67FUDtkYeRezGvH4e/pkISEwAjGuC96OfnRD7xTlE5+KNT5H2e4CKQ+QyMjjXTxAz5gHVjj2xjliFxgdsxIVA3RBVHLUca++Lhf3kDTJv+IYszTJYSU/0+h5ZLzHn6zR8jbEZZO8LvLslV2zJdrLc+IY38SkuurYpBt0Lo3+mrLR2LoGR0N4OmBVci0CRFeArXrt1sFY6Qfr4wC27Viu5GNoAcg8m0gm1jbEBmotJ1edqGM0IxvnW84GqS/0/R/j9Hmf0kfTwGXQ/KcE7M/YTKxApEGuez0bC3ybHjE0JvCvDc43JcH7bMGpQI8xj8/1fNJb9UwGCcoFqDg2djgngT08d1NxTgorWhg++hbE= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 823f805a-ab87-4437-8d0a-08d68b8561a2 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Feb 2019 16:17:09.8092 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2394 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprEKsWRmVeSWpSXmKPExsUyM2J7pS7H9sgYg6NtshZNn5vYLY6tX8vi wOTRcrSFxWPJkp9MAUxRXDYpqTmZZalF+nYJXBn73p9jLDjEXdF0g7+BcQ53FyMnh4SAicSu hc9Zuhi5OIQEjjBK7D3zHcr5yihx+MliZjjn+dal7CAtQgKLmSQ2vOIASbAITGCW6G78ywRR NY1J4s3cU6wQzmOgYT0fmEFa2AQMJCZPWQHWLiKgJbFg/SIWEJtZwFfiXPt6RhBbGKjmyJVp zBA1hhJ33mxmgrDdJFp+bgOrYRFQkWi4ew6shlfAXmLT0ZOsECc9YpK4e1MFxOYUcJdY+u07 WC+jgJjE91NrmCB2iUvcejKfCeJrAYkle84zQ9iiEi8f/wObIyoQIbHu2yFGiLiixNl3D8E+ kxCYyiix+WQzO0RCR+Ls9SdQRbISl+Z3M0IUtbBLPPv8A2qDr8TVb+dYIRK3GSXuNzxkhune fW4BG4SdL/F1z2m2CYxGs5BcOIuRA8jWlFi/Sx8i7CFx4No7FghbUWJK90P2WeAAEJQ4OfMJ ywJG1lWMosWpxUm56UZGeqlFmcnFxfl5enmpJZsYgSnl4JbfBjsYXz53PMQowMGoxMObsyky Rog1say4MvcQowQHs5IIr85WoBBvSmJlVWpRfnxRaU5q8SFGaQ4WJXHeP0KCMUIC6Yklqdmp qQWpRTBZJg5OqQZGZZe91xJfT/dTWlSdOe1omW9b4M/Zix9Y675tjlAy0Z93Kses2jGHRUWU 88yOtyYfXLUniM7+zXHYSefKi8POX5/smG8te5uvYIv13pa8b2GfC+vXzRawTbv6NJKD/V/K Ox6HoC3/wvKiT1mfmiXg4ZXW/iA859vP7KsJdZVMK5PlZyYcF72uxFKckWioxVxUnAgAPYYp zSUDAAA= Archived-At: Subject: Re: [Emu] TLS 1.3 and other EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Feb 2019 16:17:16 -0000 UHVyZWx5IGEgcGVyc29uYWwgb3BpbmlvbjoNCg0KVHlpbmcgdGhlIGZhdGUgb2Ygb25lIGRvY3Vt ZW50IHRvIGFub3RoZXIgdW5sZXNzIGFic29sdXRlbHkgbmVjZXNzYXJ5IGlzIA0Kbm90IGEgZ29v ZCBpZGVhLiBKdXN0IGxvb2sgYXQgdGhlIFJGQyBlZGl0b3IgcXVldWU6IA0KaHR0cHM6Ly93d3cu cmZjLWVkaXRvci5vcmcvY3VycmVudF9xdWV1ZS5waHANCg0KVGhlcmUgYXJlIGRvY3VtZW50cyB3 aXRoIGEgTUlTU1JFRiB0aGF0IHdlcmUgc3VibWl0dGVkIHRvIHRoZSBSRkMgZWRpdG9yIA0KaW4g MjAxNC4gSSBjZXJ0YWlubHkgZG9uJ3Qgd2FudCBFQVAtVExTIHRvIGxpZSBhcm91bmQgZm9yIHRo YXQgbG9uZy4gDQpNb2R1bGFyIGluZGVwZW5kZW50IHNwZWNzIGFyZSBiZXR0ZXIgaW4gbXkgb3Bp bmlvbi4NCg0KLS1Nb2hpdA0KDQpPbiAyLzUvMTkgNTo0NiBQTSwgQWxhbiBEZUtvayB3cm90ZToN Cj4gT24gRmViIDUsIDIwMTksIGF0IDEwOjQwIEFNLCBNb2hpdCBTZXRoaSBNIDxtb2hpdC5tLnNl dGhpQGVyaWNzc29uLmNvbT4gd3JvdGU6DQo+PiBPbmUgY291bGQgdXNlIHRoZSBzYW1lIGFyZ3Vt ZW50LiBUaG9zZSBvbmx5IGludGVyZXN0ZWQgaW4gaW1wbGVtZW50aW5nDQo+PiBFQVAtVExTIHdp bGwgYmUgZm9yY2VkIHRvIHdhaXQgd2hpbGUgYWxsIG90aGVyIG1ldGhvZHMgYXJlIGJlaW5nIHVw ZGF0ZWQuDQo+ICAgIFllcy4NCj4NCj4gICAgU29ycnksIGJ1dCB0aGF0J3MgYSBnb29kIHRoaW5n LiAgUmV2dmluZyBvbmUgRUFQIG1ldGhvZCB3aGlsZSBpZ25vcmluZyB0aGUgb3RoZXJzIGlzIGEg bWFqb3IgcHJvYmxlbSBJTUhPLg0KPg0KPj4gQW55aG93LCBJIGRvbid0IGV4cGVjdCB0aGUgb3Ro ZXIgZG9jdW1lbnQgdG8gdGFrZSAxOCBtb250aHMuIEkgbG9vaw0KPj4gZm9yd2FyZCB0byB5b3Vy IHN1Ym1pc3Npb24gKGFuZCByZXZpZXdpbmcgaXQgb25jZSBpdCBpcyBhdmFpbGFibGUpLg0KPiAg ICBJdCBzaG91bGQgYmUgc21hbGwuICBBbmQgdGhlIFdHIHNob3VsZCBiZSBpbmNlbnRpdml6ZWQg dG8gcHVibGlzaCBpdCBxdWlja2x5Lg0KPg0KPiAgICBBbGFuIERlS29rLg0KPg0KPg0K From nobody Tue Feb 5 11:59:17 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 43F3013121D for ; Tue, 5 Feb 2019 11:59:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DcVK0yDu8rMF for ; Tue, 5 Feb 2019 11:59:13 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id AB3E7131210 for ; Tue, 5 Feb 2019 11:59:13 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id C72673BB5; Tue, 5 Feb 2019 19:59:11 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: Date: Tue, 5 Feb 2019 14:59:10 -0500 Cc: "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <76C4FCE2-EEE9-40B2-8FD7-6299558AF610@deployingradius.com> References: <13063b6c-3573-9455-4753-1692755a4b1f@ericsson.com> <8D7301E3-890E-4338-B2F4-89DA6632D39C@deployingradius.com> <187468e8-7134-0fff-9c2d-6b6baa6c4f91@ericsson.com> To: Mohit Sethi M X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Feb 2019 19:59:16 -0000 On Feb 5, 2019, at 11:16 AM, Mohit Sethi M = wrote: >=20 > Peer/Client authentication in stage 1 of EAP-TTLS is optional. So = there=20 > is probably no difference if you do EAP-TLS first and then possibly = use=20 > EAP-TTLS resumption. OK. > But the other way, EAP-TTLS/EAP-PEAP first and then=20 > EAP-TLS resumption is not the okay. That is because you can't know how=20= > and when the client was authenticated with EAP-TTLS/EAP-PEAP. Presumably it's the same authentication server for all authentication = methods. Which means that the authentication server is already allowing = session resumption. So by your argument, allowing session resumption for TTLS may be OK. = Allowing session resumption for EAP-TLS is not OK, because octet 5 is = different, and authentication with EAP-TLS is different than = authentication with TTLS. I think we're going in a loop here. I just don't see how there's any = quantitative difference, and your examples aren't really convincing me. > I think we are in agreement that there is not good reason to allow = such=20 > cross method resumption and that this should be forbidden as such. No that is *not* what I said. I don't see an issue with cross-method session resumption. I'm happy = to allow it. I was pretty clear on that. What I'm saying is that if there's no consensus that it should be = allowed, then I'm fine with forbidding it. Alan DeKok. From nobody Tue Feb 5 12:06:55 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 63BE6130EEC for ; Tue, 5 Feb 2019 12:06:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BOoZdPpTaO7Y for ; Tue, 5 Feb 2019 12:06:47 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 670A413120B for ; Tue, 5 Feb 2019 12:06:47 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 45CF33BC7; Tue, 5 Feb 2019 20:06:46 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: <31ed9e4a-95dd-cab4-efad-e8bc9efbd958@ericsson.com> Date: Tue, 5 Feb 2019 15:06:44 -0500 Cc: John Mattsson , "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <3E5C49EF-ECA3-4826-B019-C33575E31B6D@deployingradius.com> References: <6DA031E2-FB48-4A1F-85FB-88A1394C22A2@ericsson.com> <73C5F487-8AEB-412D-89F8-DE9FDE4D3C5C@deployingradius.com> <36a1fd73-ed43-67fa-7ad6-b847d1c7c2fc@ericsson.com> <80884539-DE85-4037-8E9C-FF9B940AE533@deployingradius.com> <43AE4AAF-2ED0-49D6-B6A5-9EE996992671@deployingradius.com> <31ed9e4a-95dd-cab4-efad-e8bc9efbd958@ericsson.com> To: Mohit Sethi M X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] TLS 1.3 and other EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Feb 2019 20:06:49 -0000 On Feb 5, 2019, at 11:17 AM, Mohit Sethi M = wrote: >=20 > Purely a personal opinion: >=20 > Tying the fate of one document to another unless absolutely necessary = is=20 > not a good idea. I would say that it *is* absolutely necessary to issue simultaneous = TLS 1.3 updates for *all* TLS-based EAP methods. Anything else is a = complete and total disaster. > Just look at the RFC editor queue:=20 > https://www.rfc-editor.org/current_queue.php >=20 > There are documents with a MISSREF that were submitted to the RFC = editor=20 > in 2014. I certainly don't want EAP-TLS to lie around for that long.=20= Those missing refs are for large clusters of documents that all depend = on each other. And for whatever reason, some were submitted for = publication in 2014, and the documents they need were submitted in 2019. This isn't happening here, so that comparison is moot. > Modular independent specs are better in my opinion. To be clear, the specs aren't independent. They all leverage TLS over = EAP. And software implements the various methods this way. We can't = just ignore these dependencies. I'm not saying we should hold the EAP-TLS document until the other = TLS-based methods are updated. I've tried to be clear on that. We can = publish EAP-TLS updates quickly. I'm saying that the second document needs to be published nearly = simultaneously with the EAP-TLS document. Since that document is small and hopefully not contentious, this = should be possible. Alan DeKok. From nobody Wed Feb 6 00:54:33 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5823126C7E for ; Wed, 6 Feb 2019 00:54:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.854 X-Spam-Level: X-Spam-Status: No, score=-8.854 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=Lr0A2HaE; dkim=pass (1024-bit key) header.d=ericsson.com header.b=apkdowag Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xnBuoWBN0Mdh for ; Wed, 6 Feb 2019 00:54:29 -0800 (PST) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DA68F12426E for ; Wed, 6 Feb 2019 00:54:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1549443267; x=1552035267; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=SoOan0vZiBJyx9g6SRvWUo0LwOG5mUlb2s3qxT1u00E=; b=Lr0A2HaELxNU1c8jEGuY5M67tm5ny7ExJZyR8inH3mZljx8d36lH3CJ2uRnsqq+S RnUpIz6ZnghlzLSO9x3vJRZeZ5LMYl8w+jUE408pBfJfK3mFatzN9XsKHovvv+Uz L/sL2TwcmYefYKI8ZwP2vWhDKERnAyECkLDOzmOv0jQ=; X-AuditID: c1b4fb2d-db5ff7000000062f-5f-5c5aa0c38725 Received: from ESESBMB504.ericsson.se (Unknown_Domain [153.88.183.117]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id 09.D0.01583.3C0AA5C5; Wed, 6 Feb 2019 09:54:27 +0100 (CET) Received: from ESESBMR502.ericsson.se (153.88.183.134) by ESESBMB504.ericsson.se (153.88.183.117) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Wed, 6 Feb 2019 09:54:26 +0100 Received: from ESESSMB504.ericsson.se (153.88.183.165) by ESESBMR502.ericsson.se (153.88.183.134) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Wed, 6 Feb 2019 09:54:26 +0100 Received: from EUR02-AM5-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB504.ericsson.se (153.88.183.165) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Wed, 6 Feb 2019 09:54:26 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=SoOan0vZiBJyx9g6SRvWUo0LwOG5mUlb2s3qxT1u00E=; b=apkdowagrZEFuFr/E35lAtqiVVcXJeI1e01+hcGPPjyGyhtpOIWbTTKGgRupwuglxTlI5HMEpEAeZzh5HoTlOL6us8QEwfdYdjn6HNLMqvYw56WDkgiAlwJt8MzpZzZ+QEBhqtPbWExQZ6BWZIG8Co5VlLCSiosIcFWeUsM6gQ0= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3065.eurprd07.prod.outlook.com (10.170.244.151) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1622.9; Wed, 6 Feb 2019 08:54:25 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc%5]) with mapi id 15.20.1622.010; Wed, 6 Feb 2019 08:54:25 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: [Emu] Notes on session resumption with TLS-based EAP methods Thread-Index: AQHUvfmPcd1Yu26YrkO1/i9W98XpTQ== Date: Wed, 6 Feb 2019 08:54:25 +0000 Message-ID: <59E37827-A7DE-42FF-8294-777826E2E915@ericsson.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.15.0.190117 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR07MB3065; 6:6T3lDreDJTyJZtbcO5y2to3IdCdrEjryeWXPtVVSFOFeV4Y5PgTWf5LLMuOVNubGRG+XrXyEGirikcDVsScmZlwmyFKWxlxlr98MEVhMXCjb/eiFKtPDOQlhvMGl6H5V6v1ohh7K3nKmr3T6phqZaVz6DxDpmB/qweVyHOeq1E31Ji6SZ/kCc3W8HPi2vKjMCVcK/veEimnR4AgYLXgFzKRgfhBHG9Ugha09ektlsy1kn71seE74n3Us7p9iSbZPIlmzS45UjqsMGS8Sc7Zo51f2qSd33Eb26hQZaE5k4fU6ES9yOW4ZV5vLNyMgnc0MZKB0oPDy91cvAS1LEir1G31G+noSgp0xzEYnX79yIonT2HiqC3mMILCMXITmhSJ1nnFIklbgl1bG13eHq4fQyt+/1iyyfmG/umSVNM1i5TC5LVrntrGHdWPnTJPeAZpblHejwewcOvQJKhPG/fkNMQ==; 5:NaFN3qqBZnsHNOCDm926DgBsb3j3Q6hRzwXvzVS2L8N5OpZlaa/n/JOVhEnWj+YnPHnPlL6hgo7HYbuQzLLuiuEla8ikObOY3w/tHppVcbI1NQBEBQR+L2f1Fxw3/E+Z4uM68zWQe735F8IRprSb06RhTQZEQ+Q+I1ByrQUBIvOJ0LeHeK4cYXjEnpYahHetnucXv+i6HROx1j0kf3d/XQ==; 7:SCGfhpW4FA95VWYo82ME5YwTB+vpHY+ebT9irXk7Ol+h67CVGi+aV/aBiAunqCdVZN+Lmy2jpWiGfzYfbBgTh1HuAznuJw+wEs1sCLui1i6iJbwPukO6EutWew26RA1Dku4W3KLYGsVbPeg4koeBBQ== x-ms-office365-filtering-correlation-id: 9b8b226d-4315-41fd-469e-08d68c10b22d x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3065; x-ms-traffictypediagnostic: HE1PR07MB3065: x-microsoft-antispam-prvs: x-forefront-prvs: 0940A19703 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(366004)(39860400002)(136003)(346002)(376002)(189003)(199004)(6436002)(478600001)(26005)(53936002)(6506007)(102836004)(186003)(8936002)(68736007)(316002)(14454004)(6486002)(3846002)(229853002)(99286004)(6116002)(4744005)(5640700003)(6512007)(58126008)(105586002)(82746002)(106356001)(71190400001)(6916009)(2351001)(97736004)(83716004)(71200400001)(25786009)(86362001)(66066001)(486006)(256004)(14444005)(36756003)(44832011)(33656002)(2501003)(2906002)(81166006)(1730700003)(8676002)(2616005)(476003)(81156014)(7736002)(305945005)(6246003); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3065; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: nDDa3hGAiFlGKBuOE9cDYkK0NJwkwOf+Gs2/R11/HAELNVK2t1KQHhbORje1jjqb64pe3JxAsw+IN0oeTLoPYH47tL/dwqQIM1z1yG+Jk4F/3bhNLajiMcCc5NCGobAgql2N3ge4JHU+Zn6COejXy0fVFMetNL4eO3/X4lZtiM2depu0ImPX8JRfAIC/AYTEzwhNxoqexPAJa9SItCFwBRB7X+aaRiWSz6/7ztAbTQtzJXhciWBffwY4X9UT6YisMwZ42KuajuU8tmVJCUqYmrTOZEKaialBPopGLiXEeKHfSkS8AgKgRlSJuOjHWmQ6b7mLJcgQiP5+ktrrlqADvfgBN81bCQAwp2K5MHpHKQwU74eSWnHQ0vef16aSpOLvb8S25tklsR/lhu6bOSvYM+65wEANkp1qEdXGthlPJwg= Content-Type: text/plain; charset="utf-8" Content-ID: <63604E2182C09042A3002CB406C5D531@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 9b8b226d-4315-41fd-469e-08d68c10b22d X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Feb 2019 08:54:25.4869 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3065 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpnleLIzCtJLcpLzFFi42KZGbG9VPfwgqgYgzfL2SyOrV/L4sDosWTJ T6YAxigum5TUnMyy1CJ9uwSujP/TOtkLrrFXnJy5iKmBcQ97FyMnh4SAicSLSdeYQGwhgSOM EvNPVXUxcgHZXxklutdeZYRzrl9/wQThLGaSOPx2PjOIwyIwgVnizJ0b7BCZSUwSf049ZoFw HjJKfF6yjRlkMpuAgcTcPQ1sILaIgKLEj0ttYHFhAU+JravOQMW9JOac+gjUzAFk60ms+eIC EmYRUJH4s3crO0iYV8BeYldLEUiYUUBM4vupNWB3MwuIS9x6Mp8J4h8BiSV7zjND2KISLx// YwWxRQX0JX4vP80C0Rsr0do6nRWiRlHi9L4VUPWyEpfmd4O9LCHQxC5xc9F2NoiEr8Tv93uZ IBI3GSWedF9mhEhoSezc8QWqO1uid85qFghbRuLyhslsEA13WCVmnnrFDAniVInla1uhmuUk VvU+ZJnAqDsLyRezgB5lFtCUWL9LHyLsIbH8wxlmCFtRYkr3Q3YQm1dAUOLkzCcsCxhZVzGK FqcWF+emGxnrpRZlJhcX5+fp5aWWbGIEJo+DW37r7mBc/drxEKMAB6MSDy93X1SMEGtiWXFl 7iFGCQ5mJRFe8xlAId6UxMqq1KL8+KLSnNTiQ4zSHCxK4rx/hARjhATSE0tSs1NTC1KLYLJM HJxSDYxmzEsbci1Y+sKaF35suXZNQnSHQSf7nPUVXRzvT58LDFPLjvZ/92qVP/+DP1PWhOVO r9n8NI3Fa9GuezYhbH82HJunvP0eJ/eFzRZbbri6y8tWhejyMrc/2XEnslj8TuCzJElxt+79 lQeeKfop2nVvebBoc8qRuxcnfr/rnbatwO5vhYr17oNKLMUZiYZazEXFiQBk3TCVGgMAAA== Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Feb 2019 08:54:31 -0000 SSB0aGluayB0aGlzIGlzIGEgdmVyeSBnb29kIGRpc2N1c3Npb24gdG8gaGF2ZS4gQW55IHByb2Js ZW1zIHdpdGggcGVlciBhdXRoZW50aWNhdGlvbiB3b3VsZCAoYXQgbGVhc3QgaW4gdGhlb3J5KSBh ZmZlY3QgcHVyZSBFQVAtVExTIGFzIHdlbGwuIFJGQyA1MjE2IHN0YXRlcyB0aGF0Og0KDQpSRkMg NTIxNjogIldoaWxlIHRoZSBFQVAgc2VydmVyIFNIT1VMRCByZXF1aXJlIHBlZXIgYXV0aGVudGlj YXRpb24sIHRoaXMgaXMgbm90IG1hbmRhdG9yeSwgc2luY2UgdGhlcmUgYXJlIGNpcmN1bXN0YW5j ZXMgaW4gd2hpY2ggcGVlciBhdXRoZW50aWNhdGlvbiB3aWxsIG5vdCBiZSBuZWVkZWQgKGUuZy4s IGVtZXJnZW5jeSBzZXJ2aWNlcywgYXMgZGVzY3JpYmVkIGluIFtVTkFVVEhdKSwgb3Igd2hlcmUg dGhlIHBlZXIgd2lsbCBhdXRoZW50aWNhdGUgdmlhIHNvbWUgb3RoZXIgbWVhbnMuIg0KDQpTbyBl dmVuIGZvciBFQVAtVExTIHRvIEVBUC1UTFMgcmVzdW1wdGlvbiwgdGhlIEVBUC9UTFMgc2VydmVy IG5lZWRzIHRvIHN0b3JlIGluZm9ybWF0aW9uIGFib3V0IGlmIHRoZSBwZWVyL2NsaWVudCB3YXMg YXV0aGVudGljYXRlZCBvciBub3QuIElmIGNsaWVudCBhdXRoZW50aWNhdGlvbiB3YXMgZG9uZSwg SSBhc3N1bWUgdGhlIEVBUC9UTFMgc2VydmVyIHN0b3JlcyBpbmZvcm1hdGlvbiBhYm91dCB3aG8g dGhlIHBlZXIgd2FzLCBvcj8NCg0KL0pvaG4NCg0KDQo= From nobody Wed Feb 6 04:44:29 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D0007128D0C for ; Wed, 6 Feb 2019 04:44:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uuOuBRZ4bCZM for ; Wed, 6 Feb 2019 04:44:25 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 5BCD1128D09 for ; Wed, 6 Feb 2019 04:44:25 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id CABEF3BD0 for ; Wed, 6 Feb 2019 12:44:23 +0000 (UTC) From: Alan DeKok Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) Date: Wed, 6 Feb 2019 07:44:22 -0500 References: <59E37827-A7DE-42FF-8294-777826E2E915@ericsson.com> To: emu@ietf.org In-Reply-To: <59E37827-A7DE-42FF-8294-777826E2E915@ericsson.com> Message-Id: <4281A8D8-9020-42C1-970D-2E55D8564228@deployingradius.com> X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Feb 2019 12:44:28 -0000 On Feb 6, 2019, at 3:54 AM, John Mattsson = wrote: >=20 > I think this is a very good discussion to have. Any problems with peer = authentication would (at least in theory) affect pure EAP-TLS as well. = RFC 5216 states that: >=20 > RFC 5216: "While the EAP server SHOULD require peer authentication, = this is not mandatory, since there are circumstances in which peer = authentication will not be needed (e.g., emergency services, as = described in [UNAUTH]), or where the peer will authenticate via some = other means." >=20 > So even for EAP-TLS to EAP-TLS resumption, the EAP/TLS server needs to = store information about if the peer/client was authenticated or not. If = client authentication was done, I assume the EAP/TLS server stores = information about who the peer was, or? Yes. Typically the peer information is cached locally, and keyed via = the TLS session ID. Or, the information is encrypted and placed into the TLS session = ticket, and handed to the client. The client uses the ticket to resume = the session, and the server can decrypt it. This practice goes back to the first implementations of session = resumption. Because the alternative is to "resume" a session, when you = have no idea if the person resuming the session is the same one you = originally authenticated. Which seems an obvious security hole. For EAP-TLS, it's likely worth making a note that the server MUST = track the authenticated status of a session, and refuse to resume a = session when authentication had not completed. Alan DeKok. From nobody Thu Feb 7 01:26:58 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 045E7131101 for ; Thu, 7 Feb 2019 01:26:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.853 X-Spam-Level: X-Spam-Status: No, score=-8.853 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=MWr2sLOF; dkim=pass (1024-bit key) header.d=ericsson.com header.b=Uczu+y8A Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O-EQS2NbmGCg for ; Thu, 7 Feb 2019 01:26:55 -0800 (PST) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA0AD12F19D for ; Thu, 7 Feb 2019 01:26:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1549531613; x=1552123613; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=8M5qE3qrzn/yjOjSg2UCGMyl9xpy7+pXXYy2n1hIfWs=; b=MWr2sLOFCkk45LdUBQOO4bKSyXtoQoF6T5/N1Y6L8KFgBwE4DyEAnCL29xsebrD+ YwntFy5YmWgRj57UDtZ8Myou+mqqjm+rEWSdKC8CfwvtFQsQHNXyZesHq9NmhzP+ G6x/G6wDYJxqrzD3i2ZZLXyu4hN3rbY+xe5VVlMBjXw=; X-AuditID: c1b4fb2d-2198b9e00000062f-fd-5c5bf9dd3dff Received: from ESESSMB502.ericsson.se (Unknown_Domain [153.88.183.120]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id 98.95.01583.DD9FB5C5; Thu, 7 Feb 2019 10:26:53 +0100 (CET) Received: from ESESSMB501.ericsson.se (153.88.183.162) by ESESSMB502.ericsson.se (153.88.183.163) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Thu, 7 Feb 2019 10:26:52 +0100 Received: from EUR03-VE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Thu, 7 Feb 2019 10:26:52 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8M5qE3qrzn/yjOjSg2UCGMyl9xpy7+pXXYy2n1hIfWs=; b=Uczu+y8A7kTldJTsHpn9Qx/kz+n56UemNDknGtjJRICMRFqfGNMbMgJcW95AWiganyoZOK1NNfcwFygCKgB6Aotl/vPapVAfJXTODxC4yKQ/YCN/fEvsiNLXssrn1sxOKuBNJ+K1CS+CUzA+J7cJzD3g692sHQRNWOzvEAbUXDk= Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com (10.168.92.142) by HE1PR0701MB2764.eurprd07.prod.outlook.com (10.168.188.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1622.11; Thu, 7 Feb 2019 09:26:49 +0000 Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::99fa:d557:2cc:787e]) by HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::99fa:d557:2cc:787e%4]) with mapi id 15.20.1622.010; Thu, 7 Feb 2019 09:26:49 +0000 From: Mohit Sethi M To: Alan DeKok , "emu@ietf.org" Thread-Topic: [Emu] Notes on session resumption with TLS-based EAP methods Thread-Index: AQHUvsc+Ik5QkQfSVkG/FWGVwO1xjw== Date: Thu, 7 Feb 2019 09:26:49 +0000 Message-ID: References: <59E37827-A7DE-42FF-8294-777826E2E915@ericsson.com> <4281A8D8-9020-42C1-970D-2E55D8564228@deployingradius.com> In-Reply-To: <4281A8D8-9020-42C1-970D-2E55D8564228@deployingradius.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 x-originating-ip: [89.166.49.243] x-clientproxiedby: HE1P192CA0004.EURP192.PROD.OUTLOOK.COM (2603:10a6:3:fe::14) To HE1PR0701MB2905.eurprd07.prod.outlook.com (2603:10a6:3:4b::14) authentication-results: spf=none (sender IP is ) smtp.mailfrom=mohit.m.sethi@ericsson.com; x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR0701MB2764; 6:EBTeJ1DubALQmGjN5Cxbb68BiKgbNw8CGO5CUzMkN9a1O1HC6RlJXoBRRLF8q1tl9VDMZF/Zy1nSlWL6AYqmBuTierzT52pA71Alb7nB3L4pDmQTGPJnOh0zIM9BJ4K78lN1H76UdqOwBeCiK8Xc6UETUUlXPq6jvgSxdwStYwt3yd+Wjmgg3tKy2tDSgL1qALK4GDz2aMYmvgmK/GXOJirVhGzrXiVpcKJYDxYLx/KT5ljVHhlMzeGjy6HtCvNkOZ6RC2bZ2621BhgquMXflk+05Xh0sfqg42NG6tXhri3sCPoIEwO3t/25+yCuEZiJ3uH1bWanZbbNxBukkOXrgCI32AeOwH8H+ANE4WwtiPi8FD7T4cv46gMcO7C6yfa1p3OoEQ/bn6+XTJ2EHqUtqu+azMPhsLpBxch0IKrBpAayaI3aK2lNocPrT/hgU5ulrEIpCneOEnmsd+noTYRvCA==; 5:41BYrUGkHaK6FleLf+Dd88dSQt5UdFuztnGJWnMMJAnRyDfxlOUCjcpTT8aNXCzfyHAR/RDSAVGxGogKXiqGdDJvod+hkZXkItnJrSj1ugUGvTFzTGOl6xQa/htNGoKvGvbb7waHNKOkFOwO+UL9x1mkeBKWRkpE/6z5ytuAGuhjti8ussrk/EOEsZqkUAgFBJRe+9LodjsCyL+PLgHiSg==; 7:xPJGZxqTXfp2EaCyskvQw0zDp0ncIzieYDLtL5fm/KlQ5Wdn/9AgY+94y4jLOx/TISc0LYwFlJcQWac/sRSFdSmW60qsl6UniS0Kz2xDBBlLFJD8gHIi2VAmc4+pfSBMhetKdcP4gICGlE+M+hc0vA== x-ms-office365-filtering-correlation-id: dffde5e0-9da0-4e35-924b-08d68cde6304 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020); SRVR:HE1PR0701MB2764; x-ms-traffictypediagnostic: HE1PR0701MB2764: x-microsoft-antispam-prvs: x-forefront-prvs: 0941B96580 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(366004)(396003)(376002)(136003)(346002)(199004)(189003)(86362001)(6246003)(65806001)(6306002)(6512007)(65956001)(66066001)(65826007)(53936002)(6116002)(6486002)(97736004)(31686004)(3846002)(36756003)(31696002)(229853002)(68736007)(14454004)(6436002)(2906002)(478600001)(71200400001)(71190400001)(186003)(8676002)(2501003)(76176011)(966005)(26005)(102836004)(110136005)(81156014)(25786009)(7736002)(105586002)(14444005)(106356001)(256004)(486006)(58126008)(99286004)(316002)(476003)(2616005)(446003)(81166006)(11346002)(64126003)(386003)(52116002)(53546011)(6506007)(305945005)(8936002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2764; H:HE1PR0701MB2905.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: zsBLdFMMc96WQwZcAINO8DI5X7lXzZ8HCaUwhSMRSwvWR3hFm2sk69IGN52R12lCkcdWbPh7vsOzq9l0KNMPg0QC1B2ONxq0cjZiiBPK0oK/05gP0PcASSTvCrVko/QqvSqof7Fc92uB6ExR7eQxezP6MBGfNGnYtDYK++yjNnEAzrDjNMoJSSt9dJJpgg9+SPMftMI3G85bQ0jiMlUvEI5SG3DLbS20FLtdCe3YYV7fyMY9Lz9UjBclIBSe84I8XpEoaFJGV+NYUNtxCbIp/Aa5weUB4q2Rstlzr/ZmYv9XH21FybYLZeIFRYd9u1LLVr1idB9WusGZAddaFtr58UtmKguJc9dfuzajHxL5nP8zjPMchb7btdlVCdRQElXRVlQi8b6JuP/i5qa4IHvv7gETAk0im3J5rCxaqDDeiXw= Content-Type: text/plain; charset="utf-8" Content-ID: <64E03CA2D47E764AAC4A6B7D4374DA86@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: dffde5e0-9da0-4e35-924b-08d68cde6304 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Feb 2019 09:26:48.5341 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2764 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupjleLIzCtJLcpLzFFi42KZGbG9Qvfuz+gYg99rmCyaPjexWxxbv5bF gcmj5WgLi8eSJT+ZApiiuGxSUnMyy1KL9O0SuDKutZUXnBGtuLvmLmMDY4toFyMnh4SAicS6 id9ZQWwhgSOMEs2tcV2MXED2V0aJeQ03oRKLmST+X5cASbAITGCWeNFzgA2iajqTxNTmTUwQ zmNGib7XcxhBWtgEDCQmT1nBDmKLCHhKLFzyCMwWBrK3rjrDBhH3kphz6iNLFyMHkK0ncXAZ P0iYRUBF4n/PLRYQm1fAXmJD0ydGiCtqJDbNWwR2EaeAu8TKow1MIDajgJjE91NrwGxmAXGJ W0/mM0G8JiCxZM95ZghbVOLl439gvaICERLrvh1ihIgrSpx99xDsfgmBSYwSTRsnMEMMjZX4 8L8fapCOxNnrT6AaZCUuze9mhGhoYZfY2nmMBSLhKzHv1RNWiMRtRol7+74wg3wG0n3wjiBE Tb7EqacPoeplJBoWLGefwGgwC8nhs4A6mAU0Jdbv0ocIe0h8efKGEcJWlJjS/ZB9FjhcBCVO znzCsoCRdRWjaHFqcXFuupGxXmpRZnJxcX6eXl5qySZGYCo5uOW37g7G1a8dDzEKcDAq8fDK fYuOEWJNLCuuzD3EKMHBrCTC6/0DKMSbklhZlVqUH19UmpNafIhRmoNFSZz3j5BgjJBAemJJ anZqakFqEUyWiYNTqoHRJ2BaLt/qaeu7eUvr2ZombTzHs/f9mYJ+Pp6vBTef3qgSa95dEFtb 6uHB+XnuxwW2UwTCT5Sd6X/ua98sdSOsXmJlr87VN9aidfdDfnCvsbEwM9hq6Bln+vWPflnO RMV91rc2+nHbHJpyPvvE7H6tNZ9vdqe5crtLRMazfZvVefO49ioNMy8lluKMREMt5qLiRADU sQ53IQMAAA== Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Feb 2019 09:26:57 -0000 SGkgQWxhbiwgSm9obiwNCg0KT24gMi82LzE5IDI6NDQgUE0sIEFsYW4gRGVLb2sgd3JvdGU6DQo+ IE9uIEZlYiA2LCAyMDE5LCBhdCAzOjU0IEFNLCBKb2huIE1hdHRzc29uIDxqb2huLm1hdHRzc29u QGVyaWNzc29uLmNvbT4gd3JvdGU6DQo+PiBJIHRoaW5rIHRoaXMgaXMgYSB2ZXJ5IGdvb2QgZGlz Y3Vzc2lvbiB0byBoYXZlLiBBbnkgcHJvYmxlbXMgd2l0aCBwZWVyIGF1dGhlbnRpY2F0aW9uIHdv dWxkIChhdCBsZWFzdCBpbiB0aGVvcnkpIGFmZmVjdCBwdXJlIEVBUC1UTFMgYXMgd2VsbC4gUkZD IDUyMTYgc3RhdGVzIHRoYXQ6DQo+Pg0KPj4gUkZDIDUyMTY6ICJXaGlsZSB0aGUgRUFQIHNlcnZl ciBTSE9VTEQgcmVxdWlyZSBwZWVyIGF1dGhlbnRpY2F0aW9uLCB0aGlzIGlzIG5vdCBtYW5kYXRv cnksIHNpbmNlIHRoZXJlIGFyZSBjaXJjdW1zdGFuY2VzIGluIHdoaWNoIHBlZXIgYXV0aGVudGlj YXRpb24gd2lsbCBub3QgYmUgbmVlZGVkIChlLmcuLCBlbWVyZ2VuY3kgc2VydmljZXMsIGFzIGRl c2NyaWJlZCBpbiBbVU5BVVRIXSksIG9yIHdoZXJlIHRoZSBwZWVyIHdpbGwgYXV0aGVudGljYXRl IHZpYSBzb21lIG90aGVyIG1lYW5zLiINCj4+DQo+PiBTbyBldmVuIGZvciBFQVAtVExTIHRvIEVB UC1UTFMgcmVzdW1wdGlvbiwgdGhlIEVBUC9UTFMgc2VydmVyIG5lZWRzIHRvIHN0b3JlIGluZm9y bWF0aW9uIGFib3V0IGlmIHRoZSBwZWVyL2NsaWVudCB3YXMgYXV0aGVudGljYXRlZCBvciBub3Qu IElmIGNsaWVudCBhdXRoZW50aWNhdGlvbiB3YXMgZG9uZSwgSSBhc3N1bWUgdGhlIEVBUC9UTFMg c2VydmVyIHN0b3JlcyBpbmZvcm1hdGlvbiBhYm91dCB3aG8gdGhlIHBlZXIgd2FzLCBvcj8NCj4g ICAgWWVzLiAgVHlwaWNhbGx5IHRoZSBwZWVyIGluZm9ybWF0aW9uIGlzIGNhY2hlZCBsb2NhbGx5 LCBhbmQga2V5ZWQgdmlhIHRoZSBUTFMgc2Vzc2lvbiBJRC4NCj4NCj4gICAgT3IsIHRoZSBpbmZv cm1hdGlvbiBpcyBlbmNyeXB0ZWQgYW5kIHBsYWNlZCBpbnRvIHRoZSBUTFMgc2Vzc2lvbiB0aWNr ZXQsIGFuZCBoYW5kZWQgdG8gdGhlIGNsaWVudC4gIFRoZSBjbGllbnQgdXNlcyB0aGUgdGlja2V0 IHRvIHJlc3VtZSB0aGUgc2Vzc2lvbiwgYW5kIHRoZSBzZXJ2ZXIgY2FuIGRlY3J5cHQgaXQuDQo+ DQo+ICAgIFRoaXMgcHJhY3RpY2UgZ29lcyBiYWNrIHRvIHRoZSBmaXJzdCBpbXBsZW1lbnRhdGlv bnMgb2Ygc2Vzc2lvbiByZXN1bXB0aW9uLiAgQmVjYXVzZSB0aGUgYWx0ZXJuYXRpdmUgaXMgdG8g InJlc3VtZSIgYSBzZXNzaW9uLCB3aGVuIHlvdSBoYXZlIG5vIGlkZWEgaWYgdGhlIHBlcnNvbiBy ZXN1bWluZyB0aGUgc2Vzc2lvbiBpcyB0aGUgc2FtZSBvbmUgeW91IG9yaWdpbmFsbHkgYXV0aGVu dGljYXRlZC4gIFdoaWNoIHNlZW1zIGFuIG9idmlvdXMgc2VjdXJpdHkgaG9sZS4NCj4NCj4gICAg Rm9yIEVBUC1UTFMsIGl0J3MgbGlrZWx5IHdvcnRoIG1ha2luZyBhIG5vdGUgdGhhdCB0aGUgc2Vy dmVyIE1VU1QgdHJhY2sgdGhlIGF1dGhlbnRpY2F0ZWQgc3RhdHVzIG9mIGEgc2Vzc2lvbiwgYW5k IHJlZnVzZSB0byByZXN1bWUgYSBzZXNzaW9uIHdoZW4gYXV0aGVudGljYXRpb24gaGFkIG5vdCBj b21wbGV0ZWQuDQoNCkZvciBtZSwgYW4gRUFQLVRMUyBzZXJ2ZXIgc2hvdWxkIG5vdCBvbmx5IHJl ZnVzZSByZXN1bXB0aW9uIGlmIGEgY2xpZW50IA0Kd2FzIG5vdCBhdXRoZW50aWNhdGVkLCBpdCBz aG91bGQgYWxzbyByZWZ1c2UgcmVzdW1wdGlvbiBpZiB0aGUgY2xpZW50IA0Kd2FzIGF1dGhlbnRp Y2F0ZWQgd2l0aCBvdGhlciBtZXRob2RzIHRoYW4gY2VydGlmaWNhdGVzIChzdWNoIGFzIHBhc3N3 b3JkcykuDQoNCkRvIHlvdSBhZ3JlZT8NCg0KLS1Nb2hpdA0KDQo+DQo+ICAgIEFsYW4gRGVLb2su DQo+DQo+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+ IEVtdSBtYWlsaW5nIGxpc3QNCj4gRW11QGlldGYub3JnDQo+IGh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vZW11DQo= From nobody Thu Feb 7 02:59:38 2019 Return-Path: X-Original-To: emu@ietf.org Delivered-To: emu@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id BEAFC13107E; Thu, 7 Feb 2019 02:59:35 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Meeting Session Request Tool To: Cc: mohit.m.sethi@ericsson.com, ekr@rtfm.com, emu-chairs@ietf.org, emu@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.91.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <154953717570.23499.5561411174156364670.idtracker@ietfa.amsl.com> Date: Thu, 07 Feb 2019 02:59:35 -0800 Archived-At: Subject: [Emu] emu - Update to a Meeting Session Request for IETF 104 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Feb 2019 10:59:36 -0000 An update to a meeting session request has just been submitted by Mohit Sethi, a Chair of the emu working group. --------------------------------------------------------- Working Group Name: EAP Method Update Area Name: Security Area Session Requester: Mohit Sethi Number of Sessions: 1 Length of Session(s): 2 Hours Number of Attendees: 50 Conflicts to Avoid: First Priority: saag tls cfrg lwig Second Priority: curdle uta secdispatch oauth 6lo mls Third Priority: sacm quic kitten bier acme t2trg People who must be present: Eric Rescorla Jari Arkko Joseph A. Salowey John Mattsson Mohit Sethi Resources Requested: Special Requests: If possible, please schedule on Monday/Tuesday during the week. --------------------------------------------------------- From nobody Thu Feb 7 04:06:28 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7EC4131111 for ; Thu, 7 Feb 2019 04:06:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DrRzRyU_mEMy for ; Thu, 7 Feb 2019 04:06:24 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id B6C6212D4F2 for ; Thu, 7 Feb 2019 04:06:24 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id D72111B55; Thu, 7 Feb 2019 12:06:22 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: Date: Thu, 7 Feb 2019 07:06:21 -0500 Cc: "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <106D1F4C-7A27-40CE-AEAA-2C523C3D65C4@deployingradius.com> References: <59E37827-A7DE-42FF-8294-777826E2E915@ericsson.com> <4281A8D8-9020-42C1-970D-2E55D8564228@deployingradius.com> To: Mohit Sethi M X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Feb 2019 12:06:27 -0000 On Feb 7, 2019, at 4:26 AM, Mohit Sethi M = wrote: >=20 > Hi Alan, John, > ... > For me, an EAP-TLS server should not only refuse resumption if a = client=20 > was not authenticated, it should also refuse resumption if the client=20= > was authenticated with other methods than certificates (such as = passwords). >=20 > Do you agree? You already asked that question, and my answer was "no". Asking again = won't change that answer. If the server decides that a particular user is authenticated, the = server can choose to allow session resumption. I fail to see how changing octet 5 of the EAP packet changes any of = the security properties. And the explanations so far don't address any = of my questions about this topic. Alan DeKok. From nobody Thu Feb 7 04:46:03 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6837913112B for ; Thu, 7 Feb 2019 04:45:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VutgN8Akxz7V for ; Thu, 7 Feb 2019 04:45:53 -0800 (PST) Received: from xenon44.um.es (xenon44.um.es [IPv6:2001:720:1710:601::44]) by ietfa.amsl.com (Postfix) with ESMTP id 4593812D4F2 for ; Thu, 7 Feb 2019 04:45:53 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by xenon44.um.es (Postfix) with ESMTP id 00732206F5; Thu, 7 Feb 2019 13:45:52 +0100 (CET) X-Virus-Scanned: by antispam in UMU at xenon44.um.es Received: from xenon44.um.es ([127.0.0.1]) by localhost (xenon44.um.es [127.0.0.1]) (amavisd-new, port 10024) with LMTP id gpNdGk9wMNqs; Thu, 7 Feb 2019 13:45:51 +0100 (CET) Received: from [172.22.79.150] (unknown [155.54.213.146]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: eduardo.ingles) by xenon44.um.es (Postfix) with ESMTPSA id 9D3E920660; Thu, 7 Feb 2019 13:45:50 +0100 (CET) From: =?UTF-8?Q?Eduardo_Ingl=c3=a9s_UM?= To: Aura Tuomas , "emu@ietf.org" References: <22656_1547058305_5C363C81_22656_1793_1_ce8214ef-a23c-4d73-eaa3-18fd344c0ba7@um.es> <45660782b2054a20bcd501e2e1d80bf2@aalto.fi> Message-ID: Date: Thu, 7 Feb 2019 13:45:48 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.0 MIME-Version: 1.0 In-Reply-To: <45660782b2054a20bcd501e2e1d80bf2@aalto.fi> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: es-ES Archived-At: Subject: Re: [Emu] Questions about EAP-NOOB draft X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Feb 2019 12:46:00 -0000 Hi Tuomas, Thanks for taking the time to respond. In the first question I was wondering if there was any debate about the inclusion of other algorithms. Especially in terms of interoperability with, for example, TLS. You're right that low-end devices can do ECDHE. Therefore, it would not make sense to decrease the level of security. In addition, I have seen that the new version TLS 1.3 includes a derivation function with HKDF [RFC5869], which is could be compatible with ECDH. Regarding the problem of the proposed scenario, it is a very interesting solution. A good option to take into account. Best regards. El 30/01/2019 a las 11:35, Aura Tuomas escribió: > Hi Eduardo, > > 1. > I' not sure what kind of alternative key derivation you are suggesting. Are you thinking about alternative ECDH curves, or RSA maybe? I believe even the low-end devices can do ECDHE these days so it is not obvious to me why that should be sometimes avoided. > > 2. > This is a valid scenario for real-world deployments. Thank you for bringing it up. > > Managed handovers where the previous authentication / management server is still online and co-operative, are already supported. After copying the EAP-NOOB associations for the peer devices to the new server, the old server can send a new Realm field in the next Reconnect Exchange and then be taken offline. Alternatively, Radius routing can be set at the access networks to capture the old realm, and the new server can send the new Realm in Reconnect. We should check the EAP-NOOB spec though to make sure that there is nothing to prevent such usage. > > Unmanaged handovers where the old server just goes out of business are messier. We simply need to copy the server-side EAP-NOOB association database because there is nothing else for re-bootstrapping the security association - except of course a new user-assisted OOB step. > > Regards, > Tuomas > > > > -----Original Message----- > From: Emu On Behalf Of Eduardo Inglés UM > Sent: Wednesday, 9 January, 2019 20:25 > To:emu@ietf.org > Subject: [Emu] Questions about EAP-NOOB draft > Importance: High > > Dear Tuomas, > > First of all, I would like to say that EAP-NOOB draft is very complete and understandable. Also, with regard to the rest of the solutions I have found, I think it is a great solution so far and I like the way to approach the problems. > > I am working on implementing EAP-NOOB on resource-constrained devices for our use case. But I have the following 2 questions: > > 1. Regarding the key derivation section. There, it is explained the use of ECDHE for the key exchange. Do you have in mind to accept any alternatives besides the one explained in the draft? Maybe weaker methods or stronger but not so constrained. > > 2. I have a concrete use case. Specifically, I am interested in knowing how the Reconnect State works. > In the scenario there are some devices that are going to be installed and then they will be inaccessible to be able to repeat the OOB step. > These devices already have the corresponding security associations with a specific RealM. For example, a device from the University of Murcia is managed by a company called Odins. > > Now we assume that Odins stops managing those devices and Ericsson becomes the new manager with his own AAA Infrastructure. To establish the new RealM, I understand that the device should be restarted and the entire process done. Is there a mechanism to allow migration without having to repeat the OOB step? > > > Regards, > Eduardo Inglés. > > _______________________________________________ > Emu mailing list > Emu@ietf.org > https://www.ietf.org/mailman/listinfo/emu From nobody Thu Feb 7 09:15:28 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8461C12D4ED for ; Thu, 7 Feb 2019 09:15:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BVnhEKYNMrp3 for ; Thu, 7 Feb 2019 09:15:24 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 2305A12D826 for ; Thu, 7 Feb 2019 09:15:24 -0800 (PST) Received: from [192.168.20.63] (ottawa.ca.networkradius.com [72.137.155.194]) by mail.networkradius.com (Postfix) with ESMTPSA id B75E71B55; Thu, 7 Feb 2019 17:15:22 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: <752C2FF0-46B7-4A33-BF9E-D2AC9B52C8B2@ericsson.com> Date: Thu, 7 Feb 2019 12:15:21 -0500 Cc: "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <73B91FD2-DC2D-4A29-8CC0-616DBDA43AEF@deployingradius.com> References: <752C2FF0-46B7-4A33-BF9E-D2AC9B52C8B2@ericsson.com> To: John Mattsson X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] Question about draft-ietf-emu-eap-tls13-03 && application data X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Feb 2019 17:15:26 -0000 On Feb 1, 2019, at 7:20 AM, John Mattsson = wrote: > If we cannot come up with a good reason to have the requirement, I = think we should consider removing it in draft-ietf-emu-eap-tls13. = draft-ietf-emu-eap-tls13 already has a whole paragraph just trying to = motivate why the use of an empty application data record does not = violate this RFC 5216 requirement, and as you say, it gives the idea = that other TLS-based EAP methods like TTLS / FAST / PEAP / TEAP is doing = somebody bad. I agree, thanks. >> I'll also note that RC 5216 Section 2.4 mentions mandatory to = implement ciphers, and this draft doesn't. It might be worth adding = that, or adding a note referencing an appropriate section of RFC 8446. >=20 > draft-ietf-emu-eap-tls13-03 has the following paragraph in Section = 2.4: >=20 > OLD:"When EAP-TLS is used with TLS version 1.3 or higher, the EAP-TLS > peers and servers MUST comply with the requirements for the TLS > version used. For TLS 1.3 the compliance requirements are defined in > Section 9 of [RFC8446]." >=20 > Section 9 of RFC8446 list mandatory-to-implement cipher suites, = signature algorithms, key exchange algorithms, and extensions. We could = add some additional text be added draft-ietf-emu-eap-tls13 to clarify = that the compliance requirements include cipher suites. >=20 > NEW: "When EAP-TLS is used with TLS version 1.3 or higher, the EAP-TLS = peers and servers MUST comply with the compliance requirements (cipher = suites, signature algorithms, key exchange algorithms, extensions, etc.) = for the TLS version used. For TLS 1.3 the compliance requirements are = defined in Section 9 of [RFC8446]." Looks good, thanks. Alan DeKok. From nobody Fri Feb 8 04:21:37 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1AEFF12F19D for ; Fri, 8 Feb 2019 04:21:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.302 X-Spam-Level: X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=KNQA8gN7; dkim=pass (1024-bit key) header.d=ericsson.com header.b=axEFzKUm Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xcqwNmejVrJ7 for ; Fri, 8 Feb 2019 04:21:33 -0800 (PST) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE27612867A for ; Fri, 8 Feb 2019 04:21:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1549628490; x=1552220490; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=SweQ0oNNl6EbNtjcqV/HUBihxCySIvtV3fBsl9HB2vQ=; b=KNQA8gN7aK4eVa6zxgz5D7DweNf6sNJ7Q+lFiNCwGNumsiGF+ntgBpkc+637n5Nn ohNk9twt48K8uESCvM7OK+4pdW2STyHbxkciCQtpwAkfcBUVMv/MNAgrqPLdx8eE t7sLW2ia5C8h4VlfdXn+2ikbdy1NoO8kVeX2/DukhQY=; X-AuditID: c1b4fb3a-14fff7000000672c-04-5c5d744a79d5 Received: from ESESBMB501.ericsson.se (Unknown_Domain [153.88.183.114]) by sessmg22.ericsson.net (Symantec Mail Security) with SMTP id A3.71.26412.A447D5C5; Fri, 8 Feb 2019 13:21:30 +0100 (CET) Received: from ESESSMB501.ericsson.se (153.88.183.162) by ESESBMB501.ericsson.se (153.88.183.168) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Fri, 8 Feb 2019 13:21:30 +0100 Received: from EUR02-HE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Fri, 8 Feb 2019 13:21:29 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=SweQ0oNNl6EbNtjcqV/HUBihxCySIvtV3fBsl9HB2vQ=; b=axEFzKUmPcGtd+eXqZLp0VMwKP1qTBSeDWlZa0edqhvUNHWI/geparm8eh7Irxb6Ik1fL1s07sttkzT66YwipInonOkDSVxx0b0ZcV6dpxxYWJhCTIXeLNKULEXsgQgbbBXGk1v1prDedZfcmlGluEGmCBx68qhrhlGjssDPbKs= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB4444.eurprd07.prod.outlook.com (20.176.167.149) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1601.14; Fri, 8 Feb 2019 12:21:26 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc%5]) with mapi id 15.20.1622.010; Fri, 8 Feb 2019 12:21:26 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: [Emu] Notes on session resumption with TLS-based EAP methods Thread-Index: AQHUv6jPxQ7xbHqW/Euy3f06PToZUQ== Date: Fri, 8 Feb 2019 12:21:26 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.15.0.190117 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [192.176.1.85] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR07MB4444; 6:hhpZAzF1ejG9QSyozP6hSS/gN5nJwSyEPaWX9kFDG94Ljr+sZDsCuH19JgXiSAbuHohs1T5LrxkjXSGI4AQyQKa5fJ3DX7AMTxE86etw7agj8mjYFihTUZ+V9ncnSyfXoyqjfzxHq5qAQFwWPlMzZ5ZFZw0LBgl3FHoVhLU8yqvE6uq7Me7T3RK8m6kDHkmCCmPhFo3CwVgcjhkANAFdnm3CmPf6+h3xiuSDkOncY7ukwaM3GTH4/eTme4OdQyo94GU1QGDPDDVIDXeql9+WEjiWKyHfSC84CisaxDIkq30rjoztG16IjLHwzk9WMYwNS/5rcewzjNrYj+WFjbcoLYl0IQ4TBs+etWQr6ZTx0vtcxDa9EwLq2tlJNLXO7q6ohQInNtdQGAFxgcy1RWaUcRzTD2Vs2YtCyB+4QA3qwy3/813buXdkOnBQ9sOTyZrGaNp5IGG14iy+frjViy5Fpg==; 5:k+SLPZtnQKJqXc/QNw/8GeXGvTzOQqyr9pvt7PXUJIFhlPwC6RhvG1VO8mC3hRoMGIlS+uOD31tibi/DYJY0ByQ5Dz3AHVctXVk2Yg7A+MIywvZ0AmQSZmI3ygZ//eGkA5NQ7UgOW3RuD5CG1ehBJ34W9fb3JjshCINV73+IZFpVteWwX29cdDLLjY23R4m0BHTiegiXdOWbNe6D8YoaaA==; 7:p2eBjoBi8INTNjAtZO3C6gimyB5jqHcWGZx1TYvfWpI7hrdnVsMKaQzFJLHIYsOS03ZabMhHNEExa7W5o6H7yHRLTK/nqJC9YAzHQYFl3Nv5rWErUkSpuiXs2Y/HsZX5ckoiUQFMTXWPM+XUxEV6Sw== x-ms-office365-filtering-correlation-id: 1882ade9-eb43-4672-9c52-08d68dbff288 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB4444; x-ms-traffictypediagnostic: HE1PR07MB4444: x-microsoft-antispam-prvs: x-forefront-prvs: 094213BFEA x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(376002)(346002)(396003)(366004)(136003)(199004)(189003)(6246003)(8936002)(14454004)(186003)(106356001)(105586002)(97736004)(102836004)(36756003)(6116002)(58126008)(3846002)(316002)(53936002)(82746002)(7736002)(86362001)(6506007)(486006)(6512007)(25786009)(2616005)(6916009)(83716004)(68736007)(2906002)(476003)(71190400001)(71200400001)(44832011)(5640700003)(99286004)(6486002)(2501003)(256004)(14444005)(66066001)(1730700003)(6436002)(26005)(81166006)(305945005)(81156014)(478600001)(8676002)(2351001)(229853002)(33656002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB4444; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: wlY8R4HfRSF01boTuZtzDGjc6V/CNzNuqDgoQvXP1wiXtjrqWaxaZ8+8dTT+eoi7aflAn1ca37SGCimHEOZ7UwHerJFMemjWwO8PULcrv+kRHtcUAqvFQDZ47tfSxg7eKH3g54Y65UpfzVbUlON7pHdLs9T2jhsbT1Bd3ye5TXZBciKmbOJEFkHOAbEDn5KSjEHGkAPdNj0iQxO3RVzlRKcl0lovHb53xBReqzIdPNRQrw8mGq0I10O5zjAQD658sVsxgWvjI3Oh8wLEFlu2NtIGUzZEhe/rBypmyKUJSRRCbhiMYTcaa/HMypmnAkvZABVJiK4GayOU/3w5favrQjFxUGeXuLI6RaFphvnkY+Jh/cFqlV5S0eNd4caulK5gXHSsl4rZIfT2nkAYe8hCB67l4XBP4UCYakgL3ZujMtc= Content-Type: text/plain; charset="utf-8" Content-ID: <9A92264CE006FD49AB520B4FFB339796@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 1882ade9-eb43-4672-9c52-08d68dbff288 X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Feb 2019 12:21:26.5792 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB4444 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpnleLIzCtJLcpLzFFi42KZGbG9SNerJDbG4HOvgMWx9WtZHBg9liz5 yRTAGMVlk5Kak1mWWqRvl8CV0TK/jaVgmWjFp6/f2RsYH4h0MXJySAiYSLQ/u8oIYgsJHGGU OL/Cp4uRC8j+yigxsecYG4SzmEmiYek2dhCHRWACs8SnNRMZITKTmSQmP2+Cch4ySsya84QJ ZBibgIHE3D0NbCC2iICixI9LbcwgtrCAp8TWVWeg4l4Sc059ZIGw9SQuvtsHVsMioCLx6u48 sDivgL3EtGeTweKMAmIS30+tAZvPLCAucevJfCaIJwQkluw5zwxhi0q8fPyPFcQWFdCX+L38 NAtEb6xEa+t0oDgHUI2CxMOtfhDlshKX5neD3S8h0MQu0XV8LSNEwlei5U0zC0TiJqPEoQdd UAu0JJ5vucIIMShb4vv5YIiwjERn32s2iPrLrBKPZ35ih4RqqsTyta1QQ+UkVvU+hBp6nlni UcdatgmMOrOQPDQLaC6zgKbE+l36EGEPiZVPrzBB2IoSU7ofss8Ch4ugxMmZT1gWMLKuYhQt Ti0uzk03MtJLLcpMLi7Oz9PLSy3ZxAhMHge3/LbawXjwueMhRgEORiUeXv2c2Bgh1sSy4src Q4wSHMxKIrx2hUAh3pTEyqrUovz4otKc1OJDjNIcLErivH+EBGOEBNITS1KzU1MLUotgskwc nFINjLZtvxkPCTsK9X62XGVZsuuV0+25wg9W3ZzMZsZwJnkmn8Ub3aQ7XsprJhn8kJZdEzlP fhXHj8gdf7oX9ZryC8rmb9LWs30t8Mus2ft2s9Cl2plfb5Vm/13AJGW0eKrHx39qzGHCuTFr hd0LXtXVSenKSp3rkXqnf2eS55743sxemTNRKlrblViKMxINtZiLihMB2EH4uhoDAAA= Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Feb 2019 12:21:35 -0000 DQpSZTogW0VtdV0gTm90ZXMgb24gc2Vzc2lvbiByZXN1bXB0aW9uIHdpdGggVExTLWJhc2VkIEVB UCBtZXRob2RzDQoNCk1vaGl0IFNldGhpIE0gPG1vaGl0Lm0uc2V0aGlAZXJpY3Nzb24uY29tPjsg d3JvdGU6DQo+DQo+Rm9yIG1lLCBhbiBFQVAtVExTIHNlcnZlciBzaG91bGQgbm90IG9ubHkgcmVm dXNlIHJlc3VtcHRpb24gaWYgYSBjbGllbnQgDQo+d2FzIG5vdCBhdXRoZW50aWNhdGVkLCBpdCBz aG91bGQgYWxzbyByZWZ1c2UgcmVzdW1wdGlvbiBpZiB0aGUgY2xpZW50IA0KPndhcyBhdXRoZW50 aWNhdGVkIHdpdGggb3RoZXIgbWV0aG9kcyB0aGFuIGNlcnRpZmljYXRlcyAoc3VjaCBhcyBwYXNz d29yZHMpLg0KDQo+RG8geW91IGFncmVlPw0KDQooRXZlcnl0aGluZyBiZWxvdyBpcyBmcm9tIGEg cHVyZSBFQVAtVExTICgweDBkKSBwZXJzcGVjdGl2ZSB3aXRob3V0IGNvbnNpZGVyaW5nIGFueSBj cm9zcy1tZXRob2QgdGhpbmdzKQ0KDQotIEZyb20gYW4gRUFQLVRMUyBwZXJzcGVjdGl2ZSwgSSB0 aGluayB0aGVzZSB0d28gY2FzZXMgKCJub3QgYXV0aGVudGljYXRlZCIgYW5kICJhdXRoZW50aWNh dGUgdmlhIHNvbWUgb3RoZXIgbWVhbnMiKSBhcmUgdGhlIHNhbWUsIHRoZSBwZWVyIGlzIG5vdCBh dXRoZW50aWNhdGVkIGFzIGZhciBhcyBFQVAtVExTIGlzIGNvbmNlcm5lZC4gSSByZWFkIHRoZSBz ZW50ZW5jZSAib3RoZXIgbWVhbnMiIGFzIG91dHNpZGUgb2YgVExTLg0KDQotIFJGQyA1MjE2IGFs bG93cyBkZXBsb3ltZW50cyB3aXRoIG9ubHkgc2VydmVyIGF1dGhlbnRpY2F0aW9uOg0KDQpSRkMg NTIxNjogIldoaWxlIHRoZSBFQVAgc2VydmVyIFNIT1VMRCByZXF1aXJlIHBlZXIgYXV0aGVudGlj YXRpb24sIHRoaXMgaXMgbm90IG1hbmRhdG9yeSwgc2luY2UgdGhlcmUgYXJlIGNpcmN1bXN0YW5j ZXMgaW4gd2hpY2ggcGVlciBhdXRoZW50aWNhdGlvbiB3aWxsIG5vdCBiZSBuZWVkZWQgKGUuZy4s IGVtZXJnZW5jeSBzZXJ2aWNlcywgYXMgZGVzY3JpYmVkIGluIFtVTkFVVEhdKSwgb3Igd2hlcmUg dGhlIHBlZXIgd2lsbCBhdXRoZW50aWNhdGUgdmlhIHNvbWUgb3RoZXIgbWVhbnMuIg0KDQpJIGRv bid0IGtub3cgaWYgdGhlcmUgZXhpc3RzIEVBUC1UTFMgKDB4MGQpIGRlcGxveW1lbnRzIHdoZXJl IHRoZSAicGVlciBhdXRoZW50aWNhdGlvbiB3aWxsIG5vdCBiZSBuZWVkZWQiIG9yICJwZWVyIHdp bGwgYXV0aGVudGljYXRlIHZpYSBzb21lIG90aGVyIG1lYW5zIiwgYnV0IGlmIHRoZXkgZG8gZXhp c3QsIHdlIHNob3VsZCBwcm9iYWJseSBub3QgZm9yYmlkIHRoZW0gdG8gZG8gcmVzdW1wdGlvbiB1 bmxlc3Mgd2UgaGF2ZSBnb29kIHJlYXNvbnMuDQoNCi0gTG9va2luZyBhdCBlLmcuIGVtZXJnZW5j eSBzZXJ2aWNlcyAoUkZDIDc0MDYpLCB0aGUgcGVlciB3b3VsZCBpbmRpY2F0ZSBlbWVyZ2VuY3kg YnkgZm9ybWluZyBhIHNwZWNpZmljIE5BSSwgdGhlIG5ldHdvcmsgYWNjZXNzIHdvdWxkIHRoZW4g aGF2ZSB0byBiZSByZXN0cmljdGVkIGJhc2VkIG9uIHRoZSBmYWN0IHRoYXQgdGhlIHBlZXIgaXMg dW5hdXRoZW50aWNhdGVkLiBXaXRoIHRoaXMgZnVuY3Rpb25hbGl0eSBpbiBwbGFjZSwgSSBkbyBu b3Qgc2VlIHRoYXQgcmVzdW1wdGlvbiBhcyBzdWNoIGlzIHRoZSBwcm9ibGVtLg0KDQpJIHRoaW5r IGRyYWZ0LWlldGYtZW11LWVhcC10bHMxMyBuZWVkcyBzb21lIHNlbnRlbmNlIGFib3V0IHRoZSBw ZWVyIGNhbiB1c2Ugc3BlY2lmaWMgTkFJcyB0byBhZmZlY3QgdGhlIHNlcnZlcidzIGJlaGF2aW91 ci4gRW1lcmdlbmN5IHNlcnZpY2VzIGJlaW5nIG9uZS4gV2FzIHRoZXJlIGFueXRoaW5nIGluIHRo ZSBkaXNjdXNzaW9uIGJldHdlZW4gQWxhbiBEZUtvayBhbmQgRHIuIFBhbGEgYWJvdXQgaWRlbnRp dGllcyB0aGF0IHNob3VsZCBiZSBhZGRlZCB0byBkcmFmdC1pZXRmLWVtdS1lYXAtdGxzMTM/IEkg bmVlZCB0byBnZXQgYmFjayB0byB0aGF0IHRocmVhZC4NCg0KQ2hlZXJzLA0KSm9obg0KDQo= From nobody Fri Feb 8 09:17:20 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 456CF128766 for ; Fri, 8 Feb 2019 09:17:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sQzYUfrh_a7Z for ; Fri, 8 Feb 2019 09:17:16 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id CA18B1200ED for ; Fri, 8 Feb 2019 09:17:15 -0800 (PST) Received: from [192.168.20.58] (ottawa.ca.networkradius.com [72.137.155.194]) by mail.networkradius.com (Postfix) with ESMTPSA id 33014BB; Fri, 8 Feb 2019 17:17:14 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: Date: Fri, 8 Feb 2019 12:17:12 -0500 Cc: "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <63B02DB3-38D7-441C-8149-592FB1B171A6@deployingradius.com> References: To: John Mattsson X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Feb 2019 17:17:18 -0000 On Feb 8, 2019, at 7:21 AM, John Mattsson = wrote: > (Everything below is from a pure EAP-TLS (0x0d) perspective without = considering any cross-method things) >=20 > - =46rom an EAP-TLS perspective, I think these two cases ("not = authenticated" and "authenticate via some other means") are the same, = the peer is not authenticated as far as EAP-TLS is concerned. I read the = sentence "other means" as outside of TLS. >=20 > - RFC 5216 allows deployments with only server authentication: >=20 > RFC 5216: "While the EAP server SHOULD require peer authentication, = this is not mandatory, since there are circumstances in which peer = authentication will not be needed (e.g., emergency services, as = described in [UNAUTH]), or where the peer will authenticate via some = other means." >=20 > I don't know if there exists EAP-TLS (0x0d) deployments where the = "peer authentication will not be needed" or "peer will authenticate via = some other means", but if they do exist, we should probably not forbid = them to do resumption unless we have good reasons. I agree. I can't think of any deployment which allows unauthenticated EAP-TLS. = Or authenticated only via the NAI. > - Looking at e.g. emergency services (RFC 7406), the peer would = indicate emergency by forming a specific NAI, the network access would = then have to be restricted based on the fact that the peer is = unauthenticated. With this functionality in place, I do not see that = resumption as such is the problem. I agree. > I think draft-ietf-emu-eap-tls13 needs some sentence about the peer = can use specific NAIs to affect the server's behaviour. Emergency = services being one. Was there anything in the discussion between Alan = DeKok and Dr. Pala about identities that should be added to = draft-ietf-emu-eap-tls13? I need to get back to that thread. There wasn't any discussion about that use-case. Alan DeKok. From nobody Mon Feb 11 10:13:45 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 265021271FF for ; Mon, 11 Feb 2019 10:13:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cbl3iv7Ql_bL for ; Mon, 11 Feb 2019 10:13:40 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 4C07B131113 for ; Mon, 11 Feb 2019 10:13:39 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id B13AF333; Mon, 11 Feb 2019 18:13:38 +0000 (UTC) From: Alan DeKok Content-Type: multipart/alternative; boundary="Apple-Mail=_E0790857-FFF1-448D-BFDF-CA8245860B32" Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) Date: Mon, 11 Feb 2019 13:13:37 -0500 References: <154990875459.29600.72121820354811506.idtracker@ietfa.amsl.com> To: emu@ietf.org Message-Id: <0DEF63A4-E601-4E9D-9559-7B95B41FB753@deployingradius.com> X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: [Emu] Fwd: New Version Notification for draft-dekok-emu-tls-eap-types-00.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Feb 2019 18:13:44 -0000 --Apple-Mail=_E0790857-FFF1-448D-BFDF-CA8245860B32 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii This is a first draft, and is very rough. I've done things which make = sense to me. But, for FAST and TEAP, I have no idea. Reviews / = comments / etc. are welcome. Alan DeKok. > Begin forwarded message: >=20 > From: internet-drafts@ietf.org > Subject: New Version Notification for = draft-dekok-emu-tls-eap-types-00.txt > Date: February 11, 2019 at 1:12:34 PM EST > To: "Alan DeKok" >=20 >=20 > A new version of I-D, draft-dekok-emu-tls-eap-types-00.txt > has been successfully submitted by Alan DeKok and posted to the > IETF repository. >=20 > Name: draft-dekok-emu-tls-eap-types > Revision: 00 > Title: TLS-based EAP types and TLS 1.3 > Document date: 2019-02-11 > Group: Individual Submission > Pages: 9 > URL: = https://www.ietf.org/internet-drafts/draft-dekok-emu-tls-eap-types-00.txt > Status: = https://datatracker.ietf.org/doc/draft-dekok-emu-tls-eap-types/ > Htmlized: = https://tools.ietf.org/html/draft-dekok-emu-tls-eap-types-00 > Htmlized: = https://datatracker.ietf.org/doc/html/draft-dekok-emu-tls-eap-types >=20 >=20 > Abstract: > EAP-TLS [RFC5216] is being updated for TLS 1.3 in [EAPTLS]. Many > other EAP [RFC3748] and [RFC5247] types also depend on TLS, such as > FAST [RFC4851], TTLS [RFC5281], TEAP [RFC7170], and possibly many > vendor specific EAP methods. This document updates those methods in > order to use the new key derivation methods available in TLS 1.3. > Additional changes necessitated by TLS 1.3 are also discussed. >=20 >=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > The IETF Secretariat >=20 --Apple-Mail=_E0790857-FFF1-448D-BFDF-CA8245860B32 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii   This is a first draft, and is very rough.  I've = done things which make sense to me.  But, for FAST and TEAP, I have = no idea.  Reviews / comments / etc. are welcome.

  Alan DeKok.


Begin = forwarded message:

From: = internet-drafts@ietf.org
Subject: = New Version = Notification for draft-dekok-emu-tls-eap-types-00.txt
Date: = February 11, 2019 at 1:12:34 PM = EST
To: = "Alan DeKok" <aland@freeradius.org>


A new version = of I-D, draft-dekok-emu-tls-eap-types-00.txt
has been = successfully submitted by Alan DeKok and posted to the
IETF = repository.

Name: = draft-dekok-emu-tls-eap-types
Revision: 00
Title:= = TLS-based EAP types and TLS 1.3
Document date: = 2019-02-11
Group: Individual Submission
Pages:= = 9
URL: =            https://www.ietf.org/internet-drafts/draft-dekok-emu-tls-eap-ty= pes-00.txt
Status: =         https://datatracker.ietf.org/doc/draft-dekok-emu-tls-eap-types/=
Htmlized:       https://tools.ietf.org/html/draft-dekok-emu-tls-eap-types-00
Htmlized:       https://datatracker.ietf.org/doc/html/draft-dekok-emu-tls-eap-t= ypes


Abstract:
  EAP-TLS [RFC5216] is being updated for TLS 1.3 = in [EAPTLS].  Many
  other EAP [RFC3748] = and [RFC5247] types also depend on TLS, such as
=   FAST [RFC4851], TTLS [RFC5281], TEAP [RFC7170], and possibly = many
  vendor specific EAP methods.  This = document updates those methods in
  order to = use the new key derivation methods available in TLS 1.3.
=   Additional changes necessitated by TLS 1.3 are also = discussed.




Please note that it may take a couple of minutes from the = time of submission
until the htmlized version and diff are = available at tools.ietf.org.

The IETF = Secretariat


= --Apple-Mail=_E0790857-FFF1-448D-BFDF-CA8245860B32-- From nobody Tue Feb 12 09:36:38 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 76528128B33 for ; Tue, 12 Feb 2019 09:36:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.889 X-Spam-Level: X-Spam-Status: No, score=-1.889 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_HK_NAME_DR=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OhhrEIxc1mzW for ; Tue, 12 Feb 2019 09:36:34 -0800 (PST) Received: from mail.katezarealty.com (mail.katezarealty.com [104.168.158.213]) by ietfa.amsl.com (Postfix) with ESMTP id 66BDE127287 for ; Tue, 12 Feb 2019 09:36:34 -0800 (PST) Received: from localhost (unknown [127.0.0.1]) by mail.katezarealty.com (Postfix) with ESMTP id 068B637413B4; Tue, 12 Feb 2019 17:36:34 +0000 (UTC) X-Virus-Scanned: amavisd-new at katezarealty.com Received: from mail.katezarealty.com ([127.0.0.1]) by localhost (mail.katezarealty.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id NcoyGIwqCZiq; Tue, 12 Feb 2019 12:36:32 -0500 (EST) Received: from Maxs-MBP.cablelabs.com (unknown [192.160.73.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.katezarealty.com (Postfix) with ESMTPSA id A4D9237408A3; Tue, 12 Feb 2019 12:36:32 -0500 (EST) To: Mohit Sethi , EMU WG From: "Dr. Pala" Organization: OpenCA Labs Message-ID: Date: Tue, 12 Feb 2019 10:36:32 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.5.0 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------CE30D82A011CF7C143FBDD9F" Content-Language: en-US Archived-At: Subject: [Emu] EAP and Fragmentation X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Feb 2019 17:36:36 -0000 This is a multi-part message in MIME format. --------------CE30D82A011CF7C143FBDD9F Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable Hi all, I am working on a draft for credentials management via EAP. When looking = at the different specifications, it seems a bit weird that EAP does not=20 provide Fragmentation control and requires each method to define their=20 own way. /*This, led me to my first question:*/ is there a de-facto "standard"=20 way to add Fragmentation support we can just use (without having to=20 re-invent the wheel all the time) ? If we had such a mechanism, then we=20 could just say "implement the mechanism as defined in ... ". This would=20 definitely help developers that could safely re-use code/libraries. The=20 other approach would be to modify EAP to add Fragmentation support=20 there. The main reason to have a standard behavior is to have also=20 better management for ack and nak packets. As far as the solution goes,=20 the main ones I looked at are the ones mentioned in EAP-TTLS and=20 EAP-TEAP. They are both practically the same, active ACK-based - are=20 there other methods that have been implemented ? Has anybody ever looked = at how fragmentation is handled in practice and if there are better=20 solutions than others ? /*Further thinking let me to my second question:*/ the method we are=20 going to propose requires some form of authentication for the server,=20 therefore I can see its use mainly as a tunneled method where the=20 communication with the server is assumed to be already secure. If we go=20 down the route of requiring the use of an outer method that provides=20 authenticity and, optionally, confidentiality we would also not need to=20 provide support for Fragmentation control, since the records would be=20 encapsulated within the outer-method messages that already provide=20 fragmentation support. Would this be acceptable ? Or should the method=20 not have such assumptions and provide support for explicit fragmentation = control ? What would be the preferred path here ? I personally would=20 like to have a method that could be used independently, but I would also = like to focus on simplicity of implementation so that if you already=20 have EAP-TTLS/EAP-TEAP support, adding support for EAP-CREDS would be=20 very simple. Looking forward to some great guidance and advice :D Also, if you would=20 like to collaborate/contribute, please let me know! --=20 Best Regards, Massimiliano Pala, Ph.D. OpenCA Labs Director OpenCA Logo --------------CE30D82A011CF7C143FBDD9F Content-Type: multipart/related; boundary="------------8B1422147023576FB433EE71" --------------8B1422147023576FB433EE71 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

Hi all,

I am working on a draft for credentials management via EAP. When looking at the different specifications, it seems a bit weird that EAP does not provide Fragmentation control and requires each method to define their own way.

This, led me to my first question: is there a de-facto "standard" way to add Fragmentation support we can just use (without having to re-invent the wheel all the time) ? If we had such a mechanism, then we could just say "implement the mechanism as defined in ... ". This would definitely help developers that could safely re-use code/libraries. The other approach would be to modify EAP to add Fragmentation support there. The main reason to have a standard behavior is to have also better management for ack and nak packets. As far as the solution goes, the main ones I looked at are the ones mentioned in EAP-TTLS and EAP-TEAP. They are both practically the same, active ACK-based - are there other methods that have been implemented ? Has anybody ever looked at how fragmentation is handled in practice and if there are better solutions than others ?

Further thinking let me to my second question: the method we are going to propose requires some form of authentication for the server, therefore I can see its use mainly as a tunneled method where the communication with the server is assumed to be already secure. If we go down the route of requiring the use of an outer method that provides authenticity and, optionally, confidentiality we would also not need to provide support for Fragmentation control, since the records would be encapsulated within the outer-method messages that already provide fragmentation support. Would this be acceptable ? Or should the method not have such assumptions and provide support for explicit fragmentation control ? What would be the preferred path here ? I personally would like to have a method that could be used independently, but I would also like to focus on simplicity of implementation so that if you already have EAP-TTLS/EAP-TEAP support, adding support for EAP-CREDS would be very simple.

Looking forward to some great guidance and advice :D Also, if you would like to collaborate/contribute, please let me know!

--
Best Regards,
Massimiliano Pala, Ph.D.
OpenCA Labs Director
OpenCA Logo
--------------8B1422147023576FB433EE71 Content-Type: image/png; name="hcfiklccgjlnbnjj.png" Content-Transfer-Encoding: base64 Content-ID: Content-Disposition: inline; filename="hcfiklccgjlnbnjj.png" iVBORw0KGgoAAAANSUhEUgAAAGQAAAA2CAMAAAAGesyaAAADAFBMVEUsJiEAAQAKAwMABwoX BwESCQAqDgEkEQItFQESGykaGh0WGyE1FwE9GwJHHwElJiY4JBQmKDE1KCAfLUQ8KygoMEAq MjpXKgs/MilMMR0pOFEyOUo4OTo1OkRqMgpjOBlpNxUwQV1DPz48QExdOyM4QVV+OQRRQzo1 SGdDR0lDSFJfRDFASVyaPwF+RRpNT1I9UXlwSi8+UnNDUm6hQgCPRhBdUEZTUlBKVGlPVF27 PgCaSANtUT57VBerSQOMUgxHW4KMUiepTwmJVDh6WT6KVjGCWDpRYH21TwFiYF57YgJXYXae VR+lVRZrYld1ZiB7YEuSYQBgZW+8VAlkZWjBVQCfXiqqXwG1WhPLVgedYDazXiDZVgCWZEDV WQJ1blapYjbXWgDRXACMaU6WbgCiZjnIXw9mcIixZC6pZjJ/cUeLbFdycmZ4cGnnWwNwc3Wq aS6BcGeobwndXwzkXwLgYgDaYwyMeCq/bQHJaBi9ajDMagWVegvRZxzVaAvXaQDLainqZAuv cEPrZQDQaSyockrFbSvmZwnabQLvZwDpaQB0fpPkaxGld1d+f3/3aACfeV6RfG2JfnLebSF7 gYy2fQmugQCigxW8d0K3eEr1bQXaciTicRqKgnzNewHuchbUdzKYiDzrdwKah1erjAvOfEXl eSq5g1qYjGikiHO2kADigwC2hmSZjIGGj6aHkJzQiwCximixim/EkAORkZGVkYrOh0rPiVL5 giTvhDKkk4LMjF23mR+zmTrhikrviDzsi0TAlHDCnwvKlGqpnJLdlF2boKy+m324nImkoZ+e o6XKpgrloATwl1WypZPOn3zfqQjYrgLBrVDdo3nGq5mysa/SrI7dq4bqqXTOrpWttL+6s6uw tbe/t4rhvALetpjQuqnuwwe9v8LAv7vauqD3xA68w9XBw83rvJfRwbXFyMvbxbPNyMP8zgTc zMDr0mb91xLM1ODQ1NfS1c7p0sD70bPd19PX4qj83cje4+Xr4tv54NLp7/Hy9PHw9fj6/v3Y ktvJAAAAAXRSTlMAQObYZgAAAAFiS0dEAIgFHUgAAAjrSURBVFjDtVcNWFPXGT6E+l9BZ0EF sTKEIQaUAIrTZdYqxqG0I3UjIuiDM0ipoyO5l0rFh2PE472EoIJKL9hQV2OxqM+USgFL4r9g EaIoQxgqKBZBR+nGGhXYdwNro0Kfkcp3ntzce/7e8/2e70PoJVDl3bMlZyurUSsaKnqESrMp lYrByozCjUOEUZORodMRVsViTjJc8GbLUGCUUstLv1SyLCGch8DGRiDPe/kY5/2HCQQTxZEE y4fb2gDI8KjjLxsjfyyc3lZgM3KixwgeY4TEzk7+kjHODbeb6u0xAhiw8XgFMOxolpP6J75U jLZfp6dzHIcBYCQbIBB4sCxDOLK6eMAVT39it57+e09ysCnDUtnrJ0vS5ZMW0PBFWDbd40G/ 85sH2KeXvj94u/flX8/2J6kYQkhkHbzWbkdH0N0UDN8sURS8uMd9dMzPL7BxIIjOayuWLBIf 70RPUPjxLouBEgVhMaYuWXQlMjwsN+eFTR4cDZ4werRDYOoAIFkrptm/Ni0gthOt9Q4yWQxc AwyWTbacW0sTDGoJen4P002/2S7LjgV6BpY1N6OO5g5eeiZTY/P9b1FzRwfKWuk9p/72ct+N puKpq32qLVaexOCCJB91aezt5y6zt7fXILSdJZjlVr1w0mCR66x6FL3QOXiUQ2a0k/sFlDlq 1LzUMQ4uxxycjl0LWO1bBsY6yXR3wSTJGxqLhdsJHDsS9cwF47XlvcQGQiXhRbih/HkQv4XO cajZb6GDu7PTFEdPkVu0k4vQyd3Jc/SUwNnB+RJ/XsI9ptZDIxMly3dbLNwGnGBJF+Id3cZM 9ui8Gjq5P/TDiRCegbOFgSKRo5e7yNHV2dnPdVb0bHfHQCevNIV/rxqrX48oFQdYcpKMtYRb juxtfqRypNACK28+j3FsqcilAD0ADuIWCt0yRa7zRNEOY2YELhW5CV2dXVKixH8BC+s8GDN9 wWKxf94zpsRiJuWmBYjgndsKFmu5Bc+D3HQXCcu7QTFTMl3HF0SLxruLvGa4zUqdMGFWqqfX 3GSxN0y6NT154i+v75zvH2thXiWgY2YVElhwYl9NYxarlr0grlQn92DQt1vBUk+nUFeHGZme gUIvl1RXr1AnV/fx6zd4v3HptM/YaXbrzmYFePu2WpowYRlJo+2PGLb2d9WE5bw1L4DcnOco 9HIcH3o02HOecMqMJhQqdLPXpArHl2uEo+Na8qZPXxw0+bVx46bFzhw3eZylM2dgwkbWW3Iy Jp9lMDe9H2/raiqPCy5/fHSCu+M7mkffoQuzQhvRhWVlj1FcWTfq6dwdElJmarxedr/u3P6C Nn7Fk95ol8wRjIMsOLGJSwLm/OMGjlFHJ7hqelDuxdMlpbU16JvqlJTamivoBjrfUgNB69zf b6Fr1TWPKmtOw9xCdLayEFWvBlaSfmEBsk6LSdTMNnQaldTe7Qfj20yveddR2toVEevCi9/f fmntR7ErtvompmyICM9qyYpZsG3FhqwNYRH5KUtyW7eGRRxfH1OHDv0ZXH6ihbSyVYzSY3Fu BkVR9LaS2wPxUxyTFpu2eGverr+dezvi0ttpOy/tTKlL2ZkWs6p4VV1Kyq60nevS8iLyi1tW hfNWzMfhYT+ArAQ+5odRBENjlRW5F/vH6O7u7urpXtvR/bQbmX/dPd3w7Ok+2Ij4ry5o0N/d Y1p7qA21FodhFRc1ctjIsXZ2Y18VcwCixNgcWlgVbUiue3b3J33te7497vv/oT1Bj5/7br1R grYlfrReSqmwPDyK0GqOUHKWj/RwP0J0ZlmsK3o2HP+7Qt9HBr3BYH5aNL3FG/+ul8sjKcxH dRJFGJkhfKxgmM2rUoaSg5h4GAwXJsF00dRGq+/21k2EF7o50oNswrNfsYUQKRBIZWIFh3lu aLNe1F++bjXGyWyzZiGoYFYLx5Ys4v0R3GWRdBHNErBiSiqVRhHMyeaYrMQ4SENWCvEcfhCm GIzpqKlm27KTSWUcAX1goBw5oATctDb33aLTYV5SWoaXP5+gyqlFdnZ23nB+plcnREv0RWJC BVkrrBJ1BewMmlVpgRUQF7wpItMJTcsJ34GBRVaFdQZaqoqxFmSb3qDQgu1A2GI4YAnODkQY IOhklDKzo2C1IV2sijzdhjorqwefNdL6ihxzegU7SynexHgBMXy+xWFG8qvdf91D8WpRi41q KFl02YaswYNkULTeLC9CFFK4bDHDMmZbhnuXSOdAsnN1LxgfVu7ZvG8LpSJUlO/gnaWQFwYv JpZeKdUaSC8ApuhIShYQYp5yWQ0oPgVXPtkcHz/fx5rqqzosHSSlBYHIxKSolJcUsIIpnzkh mt4b7Z/tOzBRQWaA6uNCNdet0nxLkL8CgzeQKIlCXaHjXR9MlqQn9Y1fNd5RE0zF/ryKwVR/ JMnsI3S8Umcw6NRYxRuUKqk3lfnKeGcTySAx5hy+7WfgZOv4uLLl0w8wUah71QLBpJeXq/eM VVivV8jz6lB2ofWF6i1dEYRZfMJ4piE+ZweNeb7A2VVyKEx6vjt1z/ghMehVKiUpyt1VYBXC N6j0Q4Mazp7TvvndhIaGhqqvP1bwFk0YRYR5RoLR+PkWmlIpV/oEDQ6jB9Wc3Z6bm6zLTtLl gLC4LVWXz5Q1ffbV5oZ24wmsV/NeKTlirmg+u/q7w7/38PDdeKF8UBgXs2kV4WUC0YR/KOLv Pby3L5O30yvG9vY/6vX8JSbb2je96coXX5QPznqfokKKEPWBAwd20ApaTWsP7LnTfsd42at3 +B+H7+zRUfwZZMutN6baHCX5+Ou9Zy4f3nuiKr7KaHxoNDbsSwhp6htvfyg3Zw901G+ttVlT Ja34/E+fvrXmvY3713xy6tSZfadOJby7X1P/vwn/MeaYr0mF7IMEq690Gu95KwQq5L5K+f59 qGUtaZMSciHMKjdVbY6zFqRC/pv3LgxY5tcW0pjIpGGJ7+89kxBnbXZSmjuz7CeyihyG8fbd XXYdrWlqQg+sZWTdzPqBB68VEdnkzDY0lHSjSD9/GRpaMt3OWqLpQENOTf/PpP8CK9ZVVe2a 8XoAAAAASUVORK5CYII= --------------8B1422147023576FB433EE71-- --------------CE30D82A011CF7C143FBDD9F-- From nobody Tue Feb 12 10:26:24 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6229312D4F0 for ; Tue, 12 Feb 2019 10:26:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gXJ6yTbDOjdN for ; Tue, 12 Feb 2019 10:26:19 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 82B2912785F for ; Tue, 12 Feb 2019 10:26:19 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id B9D8F51B; Tue, 12 Feb 2019 18:26:17 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Alan DeKok In-Reply-To: Date: Tue, 12 Feb 2019 13:26:14 -0500 Cc: Mohit Sethi , EMU WG Content-Transfer-Encoding: quoted-printable Message-Id: <894F23B3-59EA-4DE6-BC12-417C79850CC4@deployingradius.com> References: To: "Dr. Pala" X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [Emu] EAP and Fragmentation X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Feb 2019 18:26:22 -0000 On Feb 12, 2019, at 12:36 PM, Dr. Pala wrote: > I am working on a draft for credentials management via EAP. When = looking at the different specifications, it seems a bit weird that EAP = does not provide Fragmentation control and requires each method to = define their own way.=20 IIRC, EAP was designed to be a protocol to carry other protocols, and = nothing more than that. Hence then 5 octet header, followed by (to be = non-technical) data composed of "Uh... we're not sure... whatever..." = :) > This, led me to my first question: is there a de-facto "standard" way = to add Fragmentation support we can just use (without having to = re-invent the wheel all the time) ? No. > If we had such a mechanism, then we could just say "implement the = mechanism as defined in ... ". This would definitely help developers = that could safely re-use code/libraries. The other approach would be to = modify EAP to add Fragmentation support there. I suspect that it's difficult to "modify EAP". However, adding a = standard fragmentation method would be definitely useful. > The main reason to have a standard behavior is to have also better = management for ack and nak packets. As far as the solution goes, the = main ones I looked at are the ones mentioned in EAP-TTLS and EAP-TEAP. = They are both practically the same, active ACK-based - The TLS-based EAP methods do pretty much the same thing: EAP header EAP type (TTLS, PEAP, TEAP, FAST) TLS The rest is largely window-dressing. Since TLS provides it's own fragmentation layer, the above methods = just use that. There is very little method-specific code involved. > are there other methods that have been implemented ? Has anybody ever = looked at how fragmentation is handled in practice and if there are = better solutions than others ? EAP-PWD does multi-round authentication, and adds it's own = fragmentation layer: https://tools.ietf.org/html/rfc5931#section-4 The method used is somewhat similar to TLS. > Further thinking let me to my second question: the method we are going = to propose requires some form of authentication for the server, = therefore I can see its use mainly as a tunneled method where the = communication with the server is assumed to be already secure. If we go = down the route of requiring the use of an outer method that provides = authenticity and, optionally, confidentiality we would also not need to = provide support for Fragmentation control, since the records would be = encapsulated within the outer-method messages that already provide = fragmentation support. Would this be acceptable ? I think so, yes. Once you have a TLS tunnel set up, TLS largely takes = care of fragmenting the application data. So from the point of view of = the application, it just sends and receives blocks of data, irrespective = of the outer fragment size. > Or should the method not have such assumptions and provide support for = explicit fragmentation control ? I have no idea how that would work. The inner application data has no = real way of knowing about the external fragment size, or even how much = data is being added by the TLS layer. > What would be the preferred path here ? I personally would like to = have a method that could be used independently, but I would also like to = focus on simplicity of implementation so that if you already have = EAP-TTLS/EAP-TEAP support, adding support for EAP-CREDS would be very = simple. If it's an EAP type that only appears inside of a TLS tunnel, then = don't worry too much about fragmentation. If the data you're sending will be larger than 64K, you *will* need to = provide your own fragmentation support. But that's only because the EAP = header has a 16-bit "Length" field. > Looking forward to some great guidance and advice :D Also, if you = would like to collaborate/contribute, please let me know! I've been known to have opinions. :) Plus, it's useful to have = credential provisioning methods. Alan DeKok. From nobody Wed Feb 13 06:11:02 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD183128D0B for ; Wed, 13 Feb 2019 06:10:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HL8xCdO0laii for ; Wed, 13 Feb 2019 06:10:57 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 156C5130DEA for ; Wed, 13 Feb 2019 06:10:57 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id CBDE6356 for ; Wed, 13 Feb 2019 14:10:55 +0000 (UTC) From: Alan DeKok Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) Message-Id: <7D05FC3F-54A0-4C18-A360-B4486E6D4DBC@deployingradius.com> Date: Wed, 13 Feb 2019 09:10:53 -0500 To: EMU WG X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: [Emu] Review of draft-pala-eap-creds-00 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Feb 2019 14:11:00 -0000 This is a short review of draft-pala-eap-creds-00. In short, the idea = looks good. Section 2: This specification addresses the problem of providing a simple-to-use and simple-to-deploy system for credentials management by extending the EAP protocol to support credentials provisioning and management functionality. In particular, the EAP-CREDS method defined here provides a generic framework that can carry the messages for provisioning different types of credentials. The method can be use as a stand-alone method or it can be used as an inner method of EAP- TTLS or EAP-TEAP which can provide the required encryption and server-side authentication to deliver server-side generated secrets (e.g., private keys, passwords, secret keys, etc.) My $0.02 is to forbid use of it as a stand-alone method. There's just = no reason to send credentialing information in cleartext. I'd also remove the explicit references to TTLS and PEAP. Just say it = can be used inside of another secure EAP method. Section 5.1: |------------ EAP-Response/Identity -------------->| | (NAI=3Dregister@realm|NAI=3Dmanage@realm) | That will need to change. RFC 7542 suggests that the "name" portion = of an NAI is completely under the control of the local realm. i.e. we = just can't standardize names in someone else's space. There is a solution though. We may be able to use "arpa", as with = "home.arpa": https://www.iana.org/domains/arpa We could define "provisioning.arpa" or something similar for this = purpose. And then since it's owned by the IETF, we can define new = things in it. Sections 8.1 and 8.2 can likely be deleted. We don't need to see = additional protocol flows for those EAP methods. If we do need to discuss other EAP methods, the text should say how = CREDS interacts with them. e.g. how it's different from the flows = normally carried by those protocols. I think this anonymous provisioning is very useful. It's been = re-invented a few times in non-standard ways, which is an issue. The document should also discuss fragmenting. A fragmentation method = as done with TLS or EAP-PWD is relatively simple, and well known. It should also note that sending more than 64K of data as part of = CREDS is likely to not work. The outer EAP methods / access points will = likely give up before 64K of data have been exchanged. The document could also discuss security and bootstrapping in more = detail. i.e. an EAP SUCCESS here does not mean that the user has gained = network access, and should be allowed unrestricted access to the net. = It could be useful instead to suggest that the credential negotiation is = part of "CREDS", and the "EAP" portion *always* returns FAIL. This is = so that the user never gains unrestricted network access as a result of = CREDS negotiation. The client should also know it's talking to a known and trusted = authentication server. Perhaps the document could suggest that the = outer EAP method uses a certificate signed by a known root CA. It may also be useful to discuss limited network access via domain = names, as was discussed with EAP-TLS. If we can define a = "provisioning.arpa" domain, then we can standardize "walled gardens" = based on that. i.e. someone requests anonymous access, and then gets a real IP = network, where they can run any standard provisioning protocol. That = simplifies the problem we're trying to solve, and may avoid the need for = yet another protocol. These issues need to be discussed in a lot more detail before the = problem statement, and solution, are clear. Alan DeKok. From nobody Wed Feb 13 12:42:51 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8141A1310A2 for ; Wed, 13 Feb 2019 12:42:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nlgxhKmz61QM for ; Wed, 13 Feb 2019 12:42:41 -0800 (PST) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 15ABC130DC0 for ; Wed, 13 Feb 2019 12:42:41 -0800 (PST) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 40CF93826A for ; Wed, 13 Feb 2019 15:39:30 -0500 (EST) Received: by sandelman.ca (Postfix, from userid 179) id B70842F2F; Wed, 13 Feb 2019 15:42:38 -0500 (EST) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id B5554804 for ; Wed, 13 Feb 2019 15:42:38 -0500 (EST) From: Michael Richardson To: EMU WG In-Reply-To: <7D05FC3F-54A0-4C18-A360-B4486E6D4DBC@deployingradius.com> References: <7D05FC3F-54A0-4C18-A360-B4486E6D4DBC@deployingradius.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Emu] Review of draft-pala-eap-creds-00 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Feb 2019 20:42:49 -0000 --=-=-= Content-Type: text/plain Alan DeKok wrote: > This specification addresses the problem of providing a simple-to-use > and simple-to-deploy system for credentials management by extending > the EAP protocol to support credentials provisioning and management > functionality. In particular, the EAP-CREDS method defined here What do you mean by credentials? Are you talking about certificates or something else? It seems that certificates are mentioned. EST inside of TLS-EAP already is being discussed, with BRSKI as the introducer. This protocol seems to re-invent EST (RFC7030). -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | IoT architect [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails [ --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAlxkgT4ACgkQgItw+93Q 3WVcYAgAmHUldjnrreCKLe/ZHSHAmTY6EiQ2EExadsdQv36QhsyrGUj2TGsRU6+D m7fdAtNUYEdz5QOsorzhWa3GJZ+gpPMC+mTbf3Bi5UGc0IAvkbA6yS31bV0AHoqi ukBBcyWVeZpup6EgYqU05mqsCZLdGcFu9WFKIrkrQLEsTZOhfbD4xu3UktOhy+eq /i5CQrmYjMRXT4edc8iJug2+lbT30M8ROPfqrNPfSOxw/DOrhpcuP8QYkY3mXbva 9/t9FUA9kv0MV8JvQ7r7SYM7zd6A9NHG5/iPlYb5FkZnWLF8futgAP00kPuUxG5Q cHPNaHG3pyFXg1wsppDye6PLGfvp3g== =W0/s -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Feb 13 17:58:48 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 966BE130E66 for ; Wed, 13 Feb 2019 17:58:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=salowey-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HbSo5wuwU8Zo for ; Wed, 13 Feb 2019 17:58:44 -0800 (PST) Received: from mail-qt1-x82d.google.com (mail-qt1-x82d.google.com [IPv6:2607:f8b0:4864:20::82d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 79ED4130E98 for ; Wed, 13 Feb 2019 17:58:44 -0800 (PST) Received: by mail-qt1-x82d.google.com with SMTP id 2so5173070qtb.5 for ; Wed, 13 Feb 2019 17:58:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=salowey-net.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=EUiuP7dYKg/Oozk2+jeYeAHIgJru1pZHTe/qbyct/RQ=; b=Cf5e/5HsQf8DFEbJtQPGphmUcbughC7Jcgk3kx4aLGoRzlCW1QZFirGuZ5GBgOgIku ssKnYJwddluWnPSZS1a70tzRYHxN5SI/FtiAu59zjEpzZjtjTZx7bl9V1YMYepIkw82s taiw6Kw3A/miQID6x8hTT2FKDb9SWLf9YVSVHW2ULmgXWUbZ9lV9MvcsCb7H4/g9HIw4 59JNiJwCzMncFjgkJtChj+/DtNwa7HHCPa4UWMEZjAoXSAFJE9hhXEVYmd5utBehjROP PMpu2i8Vxoj4M4S/C4rtXMiPzp3gPt/+ZCC6Mcel+cTKjIpK56lHom/E1Sg3AmlqOhQa ny/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=EUiuP7dYKg/Oozk2+jeYeAHIgJru1pZHTe/qbyct/RQ=; b=HTGMcBhIX60bRrM8pWeASpD1OX8eqA4sYiPK+TtA/p5UeCFmo5wPJd94DxpDws+dML nHk9uVODUGJ+Uw0gZbpTDpWp2+L7q8v6Ib6NSmxkM4o5joEZthYNJAMSnI9EOpv9kBKL 1tdGP29BdDOIfgSdqfU+zGCsddiHGOCTp0WeoR5ugaXjxlJDE9mAzno5ME+NzhnOzq2M h6olw3CihrVygYKq8GhMa1XyPz0t93+rYGM32UE/48QOIBQ14sgsrIor3HUW/2zwvAyg 9I5Zy73NsDo8FUxlLTGoo2FxNl7IonaBt1PQ8jCHA1mNMo/yVL1xke7l6OjvyrdiXCZj HbPw== X-Gm-Message-State: AHQUAuaGKDwZOv+CojOZMAVfVGjhkngdVlJxRoBE++8cAsJ0egqGVcUo HX0leiZHf3bQVBZNVl6bIsW3QD9Eic+Wt24KSuVnbQinH+o= X-Google-Smtp-Source: AHgI3IZ5oG3bLeYPbmIM+KrzNVYFx4nr2u/1b0O4aw4QqLW/5GGY3JSmlSwXwsGuwd8vP2iZMCp1EnBJ3JUMU7bQbL0= X-Received: by 2002:ac8:601:: with SMTP id d1mr951011qth.155.1550109523241; Wed, 13 Feb 2019 17:58:43 -0800 (PST) MIME-Version: 1.0 From: Joseph Salowey Date: Wed, 13 Feb 2019 17:58:32 -0800 Message-ID: To: emu@ietf.org Content-Type: multipart/alternative; boundary="0000000000007f02760581d0ff17" Archived-At: Subject: [Emu] WGLC for RFC5448bis X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Feb 2019 01:58:47 -0000 --0000000000007f02760581d0ff17 Content-Type: text/plain; charset="UTF-8" This is the working group last call for draft-ietf-emu-rfc5448bis-04 . Please send your comments to the list by 3/1/2019. Thanks, Joe and Mohit --0000000000007f02760581d0ff17 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
This is the working group last call for=C2=A0draft-ietf-emu-rfc5448bis-04.=C2=A0=C2=A0Please send your comments= to the list by 3/1/2019.=C2=A0

Thanks,
=
Joe and Mohit
--0000000000007f02760581d0ff17-- From nobody Thu Feb 14 03:54:51 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A81B130EB3 for ; Thu, 14 Feb 2019 03:54:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=Hm10ULXl; dkim=pass (1024-bit key) header.d=ericsson.com header.b=QDkWb0bn Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 92Qf4xFzqp5H for ; Thu, 14 Feb 2019 03:54:46 -0800 (PST) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ACFAB131164 for ; Thu, 14 Feb 2019 03:54:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1550145283; x=1552737283; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=+uLtb8jYMUzwCqF9+jZhgehG+wZ2uqeKbzdQ5xwpCwU=; b=Hm10ULXls5QgOhDK56UnOYiiBiPboYC+AGHpW7gAleL2lvm5HMDaAjLWGZPFKtfq eyjtaWm3LR52UqwASCikCKCYWls1exROqa3BK7jJ0rP61Bk+BMZlTTe3KDjs0gHh rdjWJ2m6SgwA3lvYrWf/nsT5KAH8FXbKf6fPQmxChKw=; X-AuditID: c1b4fb3a-5c9c29e00000672c-63-5c655703a0a5 Received: from ESESBMB504.ericsson.se (Unknown_Domain [153.88.183.117]) by sessmg22.ericsson.net (Symantec Mail Security) with SMTP id 1A.9F.26412.307556C5; Thu, 14 Feb 2019 12:54:43 +0100 (CET) Received: from ESESSMR502.ericsson.se (153.88.183.110) by ESESBMB504.ericsson.se (153.88.183.171) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Thu, 14 Feb 2019 12:54:42 +0100 Received: from ESESSMB501.ericsson.se (153.88.183.162) by ESESSMR502.ericsson.se (153.88.183.110) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Thu, 14 Feb 2019 12:54:42 +0100 Received: from EUR04-VI1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Thu, 14 Feb 2019 12:54:42 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+uLtb8jYMUzwCqF9+jZhgehG+wZ2uqeKbzdQ5xwpCwU=; b=QDkWb0bna8GlwtAovaYjqSW1RLD4ayin6+200R1f9HlfHliXgXc8LMaHgAffWcKYiUPsR/puSk5FfwNpHp7NxFtUtH+vd6+rO4lGeiYrITeOkyqDdbQvN75LvqziIE7w2OSA5NgocH9hyGdy/dl8EKk/iyMvfe1cq6+a+s7oqjg= Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com (10.168.98.146) by HE1PR0701MB2713.eurprd07.prod.outlook.com (10.168.188.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1643.7; Thu, 14 Feb 2019 11:54:41 +0000 Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::1cbb:43e1:d406:1a0a]) by HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::1cbb:43e1:d406:1a0a%6]) with mapi id 15.20.1643.004; Thu, 14 Feb 2019 11:54:41 +0000 From: Mohit Sethi M To: "Dr. Pala" , Mohit Sethi M , EMU WG Thread-Topic: [Emu] EAP and Fragmentation Thread-Index: AQHUxFwPnkPBm43f0kqflrUiCzSSKA== Date: Thu, 14 Feb 2019 11:54:41 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 x-originating-ip: [89.166.49.243] x-clientproxiedby: HE1PR05CA0183.eurprd05.prod.outlook.com (2603:10a6:3:f8::31) To HE1PR0701MB2905.eurprd07.prod.outlook.com (2603:10a6:3:57::18) authentication-results: spf=none (sender IP is ) smtp.mailfrom=mohit.m.sethi@ericsson.com; x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 584068ba-c417-43ca-0e78-08d6927333bc x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(49563074)(7193020); SRVR:HE1PR0701MB2713; x-ms-traffictypediagnostic: HE1PR0701MB2713: x-ms-exchange-purlcount: 1 x-microsoft-exchange-diagnostics: =?utf-8?B?MTtIRTFQUjA3MDFNQjI3MTM7MjM6elJGTjd2L1FuMkRVVk9XdjA4RkJxOC9C?= =?utf-8?B?dytERUhTUjdnL25qM2hWUWNPYU9kLzlCaWo5Z3lETHplaDJUdThlTUR2d3RC?= =?utf-8?B?TVhIdWtnTFRFZ1BTSkorN3FTY0QvcmxEWWUyWUw2ZCticXNQamlJOVRrcytF?= =?utf-8?B?NDJvZ2FhQ0VLWlhNM2ZNbnpmeGxKTGJxNzhOLzV3TzRRcnJnR2Z6ZS9TeGtS?= =?utf-8?B?RjJ4N0t0TmlpazN5NTJDZFZSMFFuZEJGY0xIZzlpZE5sV0JKUDVoR3Q3MUll?= =?utf-8?B?UlQ1aWtMaHVKM0JMM2R4TS9CMjArT1BaVGREUDBRSHBrRG5XRXpNZytITnhB?= =?utf-8?B?QUVwcmVLMjRRQlF0N0ZiYW14Q1FtV0F2aVVaZVZIWGhHbVJTSk42TzQ3Uitk?= =?utf-8?B?ajR3MzhPK01LUGU2N3Y1N1MrejhrT2V5WDl4K29FZHg3UXkrQ1JodXdYNm9n?= =?utf-8?B?WHcyRUJZaVRMZkF0eUpPTTFMci9rVXduWU9RaVVGZnREdE00VkhPZ3poYXlx?= =?utf-8?B?T1R6aFQ0UEYxVmtWUW5mMFV6WVNvVWlsdThPR3c5VEdqNEN6ZkxoUjhtakZC?= =?utf-8?B?c2JJOTZGT043MndNQ0RDc0d3dFpBTm9zaFNCUjFrbEp3VVNjR1FreDBha1gr?= =?utf-8?B?QVd5c2F4U3dFdGdvODUxRWRCK2JtKzdFWkh1cXprN2VmNGFJSlNsbk9qQzJ4?= =?utf-8?B?YnNBR2xSUWRUQXpKTEpJaDhKeGdmK1BoaHJ5cjMyeUVSWWQvclBFd3VPRWR6?= =?utf-8?B?MkpNRUNyVUxHbG01eWpNdFhVb3ZYd3RndVBxMWpmVDZHZGdaTmgwUUQ4UFZ3?= =?utf-8?B?S2ZZeUh3eEl4OHJ6UVBoM2hhQWpUdWM1ZGZHdkd6bEUxTGNlY1doVG9qVytT?= =?utf-8?B?ZmUybkp2ZEppYzd1OFV3SUhTWGlGZDFuRlhZdTF1SG5KOXlYMlhqNzFQaUZv?= =?utf-8?B?S3NyWmJqd01pUEpjYXhhcGg2eTNyZm5vbnpSOUozVnk5a3kxK0xybUF2c0Zq?= =?utf-8?B?QXhmSWF0V1NWS1BKbmNMYjhlZmFNcGd3emFpOU1kUEd5THVlcHZ4WTZuMUJ0?= =?utf-8?B?eTZHZ3FRZm96Q1RBemFCSHlDTlA4d3hubzBMVExzS1BLNk5QMnBJREwxQnh3?= =?utf-8?B?YnkrZ01xQ1dOMHVWd3pvNVBqdDhRazUxcjVBamRmSDYzclJCZFhKYStrM092?= =?utf-8?B?SlhKajVnL2xlWkVWRUF3aFYwRDV4S2pON0NMRkhoazBwazZQYW8ydzAyWkJC?= =?utf-8?B?djlpRkFjYWFuMHlxYW9FRlJkWWdQTXJyUEF1YWljb3N5R1ZiQlIrbjVqU2h3?= =?utf-8?B?UU1PZlNiUS9UVys3dDdYUkliOExvbUFPV2g2d2UzdVZ0YS9mZ0tPcDM2NGQ4?= =?utf-8?B?aFc3cWFUb3cwdFBJT0xIZkFPUjBnYVpKZW84QlBhcjNPcElHQTZXUTBsdlVq?= =?utf-8?B?TWZYdmpzcEUzaXRZQmk2QmhDaEZmZ0xjSUptNU5zN2FBcG1Rd21CcEQ0cVBW?= =?utf-8?B?TWlWeWtQa2tEdm8zTVFyNFQzUE9WYTU5QjNIUnJkdVlFUEo1RkI0MWZ2Uk5q?= =?utf-8?B?ZjZDbldHRTJ3dzIybXN3SXBqbEdUTTRjNmF0Y016Tm5FZFlsNXd4N1o1ZlBu?= =?utf-8?B?MURxZGhMSWJ0VGk3Q2sxcDNUM294VGRhQjFlMThMejRrbFcxeFNyRTZFQ0hi?= =?utf-8?B?R00rcVlMK3FHZklsaTEyeG1FKzA0R2hVb2JvblFyU2RqSldnVHQ4U05HM2dL?= =?utf-8?B?U1FDTXp4MmpqZld0elArNHJNNVE2V0NQN1hRRWZsZkg5RmZ4c3NBUUJBN09T?= =?utf-8?B?eHpKRWVBdnYxUEt2ajk1TTM5SUw5aXFsWDhRMWJzWHFlVThEamg3Q3YxU1g1?= =?utf-8?B?MS92c2tmTU94MGorRytRUFp0Wldydm9MMGh6QW94RnVZWk04Tlg1VDFMV2pY?= =?utf-8?B?eTdKRjJEaXBPM0FlMG5ZZGVmSUowYnJVbG54eXZXUVdJaGF1dWlkWnNlT0pl?= =?utf-8?B?SkpPalJ6MTE3OTJ3R3VEN2NROTRvT0E4a3k1WkQ1UTBxSndFQUdlRFBNcm90?= =?utf-8?Q?nqa2Og=3D?= x-microsoft-antispam-prvs: x-forefront-prvs: 09480768F8 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(376002)(366004)(39860400002)(396003)(136003)(199004)(53754006)(189003)(486006)(65956001)(99936001)(65826007)(65806001)(2616005)(11346002)(446003)(8936002)(476003)(25786009)(8676002)(81156014)(81166006)(66066001)(31686004)(36756003)(6486002)(53546011)(186003)(76176011)(386003)(68736007)(6506007)(99286004)(561944003)(6246003)(26005)(229853002)(64126003)(106356001)(97736004)(52116002)(105586002)(6116002)(3846002)(102836004)(7736002)(14454004)(733005)(110136005)(6306002)(54896002)(316002)(256004)(53936002)(86362001)(54556002)(2906002)(413944005)(236005)(606006)(966005)(31696002)(71190400001)(6512007)(71200400001)(6436002)(478600001)(58126008); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2713; H:HE1PR0701MB2905.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: MDE4a7I+jnELXIJXZBXeGfKLoaDb6AuAnVusg1SdGiBmEUQnIaPcLiyUlx7Nw+oRvVTkzdwAMAvwpxBU9AqNpA/rLdEomdzTo6QTqItNZ6W74ds64kWtfYcFCscYYMhWXb7r0xwdQuMg5u7wXdRS+vvHLCrOpZunO9xEzo5n5pd+KX6VrsPYljcQRxMK++l6VawvI/1xKt4kdeL5jkElP3C9QZTR5KsCrcc4d10DuiONQl5izM1nNOAKjL5nDgZORjGVc2DtTS8yC9CjMFvYQPwr42urKPR2cIab3/Ebc3sXiX1JTumeAwACRFeZuzEPx+OtCKmMmTYtkREh/Yxc/6y7tGBHANwmNd3cH2729pjpO9UoyX3PeIkpNZ66do5QOM7aHBX1pTtsR0hlaIOcH12TUyjioAqX6CARedBwwmk= Content-Type: multipart/related; boundary="_004_b5a2a434b6316edc840d0b3b9b78f27eericssoncom_"; type="multipart/alternative" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 584068ba-c417-43ca-0e78-08d6927333bc X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Feb 2019 11:54:40.3658 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2713 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA1WSe0hTcRTH+93dzbla/Jwzj4sIV4plPjKlEVYGQUYFBUUmhl30pqu1ye6U jCTFXs6wiWbvaWThKh9l4qOgNrXsYakUrSyG+UipRA2syKx791tg/33O95zz/X05/KQiRb5E JdXqTaxRz+jUEhl9PqExM0y0k02KvNsVrHlQt1nzqLaajqPiKyt/UvFni130VipRFpvK6rRZ rDFizR5Z+leLJuO38eDxol6Uix4ZzEgqBRwN36qyzUgmVeA2BFenXyAz8uaLSQQ9LWLS4PnZ y7depKikwGHrkggFjS0iGLbeQqRTRsGrgqOeYghBa2+vWDCT4EgoKa3yEliJtWC1jEgE9sUh cLmsXUL0JdDZ1iAiHA71JQ/dQWgcBFfyvlBCWDleC/Xl20i+1WC+lude9cZroNRa72aE58H3 p7cogUXYH94NlLsZsBL6up9JCPvBSP+0O5ofToCaSQcieiB0jvZRQn7AZxBYHreIieluGPtz 2mO0DDrfDHgWFkBPeaGHt4C5/Y2HBxHceR1NDrwMOk7sIrIKOrrbxYSrlTB5P8eCIi/MiEr4 CDSdmxIJLMc+8OT8AE30FCg4M4gu8K4i/lq1LRFEDoTSwj4vwiFw7NJlD8fD+NU6+v8ZYTUa Jsb8iLwEXK4m/lUZz9UIGp29EjITBU3TO2auVqC5N5Afx3LcgbSoqHDWqE3hOIM+XM+a7iD+ O9rv/lrVhOyf1jkQliL1HPnzzWySQsxkcdkHHGgx7/Ox7mYXUtF6g55VK+X52/m2PJXJPsQa DcnGTB3LOdB8Ka32l08pfJIUOI0xsftZNoM1/utSUm9VLlrYYE2w+8as0JUEtDX7nxx3bUNy X8cpxqKxhSY6J54O2zp8nZWtrvq5U8Hrtxy/eHZ7Uf+o6t6+WcnJTlva1GFZBbNxw6uEsvdh u4NiA0x7DZuUA7Nzih3NKz/HzK+4/oNrDS0Ju+0Yyq2hJ8bSP9hdVdaCt7U6mymZuRkij1uk prl0ZvlSkZFj/gLcmIZUlgMAAA== Archived-At: Subject: Re: [Emu] EAP and Fragmentation X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Feb 2019 11:54:50 -0000 --_004_b5a2a434b6316edc840d0b3b9b78f27eericssoncom_ Content-Type: multipart/alternative; boundary="_000_b5a2a434b6316edc840d0b3b9b78f27eericssoncom_" --_000_b5a2a434b6316edc840d0b3b9b78f27eericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RGVhciBEci4gUGFsYSwNCg0KT24gMi8xMi8xOSA3OjM2IFBNLCBEci4gUGFsYSB3cm90ZToNCg0K SGkgYWxsLA0KDQpJIGFtIHdvcmtpbmcgb24gYSBkcmFmdCBmb3IgY3JlZGVudGlhbHMgbWFuYWdl bWVudCB2aWEgRUFQLiBXaGVuIGxvb2tpbmcgYXQgdGhlIGRpZmZlcmVudCBzcGVjaWZpY2F0aW9u cywgaXQgc2VlbXMgYSBiaXQgd2VpcmQgdGhhdCBFQVAgZG9lcyBub3QgcHJvdmlkZSBGcmFnbWVu dGF0aW9uIGNvbnRyb2wgYW5kIHJlcXVpcmVzIGVhY2ggbWV0aG9kIHRvIGRlZmluZSB0aGVpciBv d24gd2F5Lg0KDQpUaGlzLCBsZWQgbWUgdG8gbXkgZmlyc3QgcXVlc3Rpb246IGlzIHRoZXJlIGEg ZGUtZmFjdG8gInN0YW5kYXJkIiB3YXkgdG8gYWRkIEZyYWdtZW50YXRpb24gc3VwcG9ydCB3ZSBj YW4ganVzdCB1c2UgKHdpdGhvdXQgaGF2aW5nIHRvIHJlLWludmVudCB0aGUgd2hlZWwgYWxsIHRo ZSB0aW1lKSA/IElmIHdlIGhhZCBzdWNoIGEgbWVjaGFuaXNtLCB0aGVuIHdlIGNvdWxkIGp1c3Qg c2F5ICJpbXBsZW1lbnQgdGhlIG1lY2hhbmlzbSBhcyBkZWZpbmVkIGluIC4uLiAiLiBUaGlzIHdv dWxkIGRlZmluaXRlbHkgaGVscCBkZXZlbG9wZXJzIHRoYXQgY291bGQgc2FmZWx5IHJlLXVzZSBj b2RlL2xpYnJhcmllcy4gVGhlIG90aGVyIGFwcHJvYWNoIHdvdWxkIGJlIHRvIG1vZGlmeSBFQVAg dG8gYWRkIEZyYWdtZW50YXRpb24gc3VwcG9ydCB0aGVyZS4gVGhlIG1haW4gcmVhc29uIHRvIGhh dmUgYSBzdGFuZGFyZCBiZWhhdmlvciBpcyB0byBoYXZlIGFsc28gYmV0dGVyIG1hbmFnZW1lbnQg Zm9yIGFjayBhbmQgbmFrIHBhY2tldHMuIEFzIGZhciBhcyB0aGUgc29sdXRpb24gZ29lcywgdGhl IG1haW4gb25lcyBJIGxvb2tlZCBhdCBhcmUgdGhlIG9uZXMgbWVudGlvbmVkIGluIEVBUC1UVExT IGFuZCBFQVAtVEVBUC4gVGhleSBhcmUgYm90aCBwcmFjdGljYWxseSB0aGUgc2FtZSwgYWN0aXZl IEFDSy1iYXNlZCAtIGFyZSB0aGVyZSBvdGhlciBtZXRob2RzIHRoYXQgaGF2ZSBiZWVuIGltcGxl bWVudGVkID8gSGFzIGFueWJvZHkgZXZlciBsb29rZWQgYXQgaG93IGZyYWdtZW50YXRpb24gaXMg aGFuZGxlZCBpbiBwcmFjdGljZSBhbmQgaWYgdGhlcmUgYXJlIGJldHRlciBzb2x1dGlvbnMgdGhh biBvdGhlcnMgPw0KDQpObyBoYXQ6IEkgdGhpbmsgaGF2aW5nIGEgc3RhbmRhcmQgbWVjaGFuaXNt IGZvciBzdXBwb3J0aW5nIGxhcmdlIG1lc3NhZ2VzIGFuZCBmcmFnbWVudGF0aW9uIGluZGVwZW5k ZW50bHkgb2YgYW55IHBhcnRpY3VsYXIgRUFQIG1ldGhvZCB3b3VsZCBkZWZpbml0ZWx5IGJlIHNv bWV0aGluZyB1c2VmdWwuIEFzIHlvdSBzYWlkLCBpdCB3b3VsZCBhbGxvdyBkZXZlbG9wZXJzIHRv IHNhZmVseSByZS11c2UgY29kZS4gSWYgeW91IGhhdmUgYSBkcmFmdCBwcm9wb3NhbCwgSSB3b3Vs ZCBiZSBoYXBweSB0byByZXZpZXcgaXQuIFBlcmhhcHMgd2UgY291bGQgc3RhcnQgYnkgbG9va2lu ZyBhdCBleGlzdGluZyBtZWNoYW5pc21zIHVzZWQgYnkgRUFQLVB3ZC9FQVAtVFRMUy4NCg0KLS1N b2hpdA0KDQpGdXJ0aGVyIHRoaW5raW5nIGxldCBtZSB0byBteSBzZWNvbmQgcXVlc3Rpb246IHRo ZSBtZXRob2Qgd2UgYXJlIGdvaW5nIHRvIHByb3Bvc2UgcmVxdWlyZXMgc29tZSBmb3JtIG9mIGF1 dGhlbnRpY2F0aW9uIGZvciB0aGUgc2VydmVyLCB0aGVyZWZvcmUgSSBjYW4gc2VlIGl0cyB1c2Ug bWFpbmx5IGFzIGEgdHVubmVsZWQgbWV0aG9kIHdoZXJlIHRoZSBjb21tdW5pY2F0aW9uIHdpdGgg dGhlIHNlcnZlciBpcyBhc3N1bWVkIHRvIGJlIGFscmVhZHkgc2VjdXJlLiBJZiB3ZSBnbyBkb3du IHRoZSByb3V0ZSBvZiByZXF1aXJpbmcgdGhlIHVzZSBvZiBhbiBvdXRlciBtZXRob2QgdGhhdCBw cm92aWRlcyBhdXRoZW50aWNpdHkgYW5kLCBvcHRpb25hbGx5LCBjb25maWRlbnRpYWxpdHkgd2Ug d291bGQgYWxzbyBub3QgbmVlZCB0byBwcm92aWRlIHN1cHBvcnQgZm9yIEZyYWdtZW50YXRpb24g Y29udHJvbCwgc2luY2UgdGhlIHJlY29yZHMgd291bGQgYmUgZW5jYXBzdWxhdGVkIHdpdGhpbiB0 aGUgb3V0ZXItbWV0aG9kIG1lc3NhZ2VzIHRoYXQgYWxyZWFkeSBwcm92aWRlIGZyYWdtZW50YXRp b24gc3VwcG9ydC4gV291bGQgdGhpcyBiZSBhY2NlcHRhYmxlID8gT3Igc2hvdWxkIHRoZSBtZXRo b2Qgbm90IGhhdmUgc3VjaCBhc3N1bXB0aW9ucyBhbmQgcHJvdmlkZSBzdXBwb3J0IGZvciBleHBs aWNpdCBmcmFnbWVudGF0aW9uIGNvbnRyb2wgPyBXaGF0IHdvdWxkIGJlIHRoZSBwcmVmZXJyZWQg cGF0aCBoZXJlID8gSSBwZXJzb25hbGx5IHdvdWxkIGxpa2UgdG8gaGF2ZSBhIG1ldGhvZCB0aGF0 IGNvdWxkIGJlIHVzZWQgaW5kZXBlbmRlbnRseSwgYnV0IEkgd291bGQgYWxzbyBsaWtlIHRvIGZv Y3VzIG9uIHNpbXBsaWNpdHkgb2YgaW1wbGVtZW50YXRpb24gc28gdGhhdCBpZiB5b3UgYWxyZWFk eSBoYXZlIEVBUC1UVExTL0VBUC1URUFQIHN1cHBvcnQsIGFkZGluZyBzdXBwb3J0IGZvciBFQVAt Q1JFRFMgd291bGQgYmUgdmVyeSBzaW1wbGUuDQoNCkxvb2tpbmcgZm9yd2FyZCB0byBzb21lIGdy ZWF0IGd1aWRhbmNlIGFuZCBhZHZpY2UgOkQgQWxzbywgaWYgeW91IHdvdWxkIGxpa2UgdG8gY29s bGFib3JhdGUvY29udHJpYnV0ZSwgcGxlYXNlIGxldCBtZSBrbm93IQ0KDQotLQ0KQmVzdCBSZWdh cmRzLA0KTWFzc2ltaWxpYW5vIFBhbGEsIFBoLkQuDQpPcGVuQ0EgTGFicyBEaXJlY3Rvcg0KW09w ZW5DQSBMb2dvXQ0KDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18NCkVtdSBtYWlsaW5nIGxpc3QNCkVtdUBpZXRmLm9yZzxtYWlsdG86RW11QGlldGYu b3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9lbXUNCg0K --_000_b5a2a434b6316edc840d0b3b9b78f27eericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <244A35AF61D24549990DA236322D3B7D@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IHRleHQ9IiMwMDAwMDAi IGJnY29sb3I9IiNGRkZGRkYiPg0KPHA+RGVhciBEci4gUGFsYSw8L3A+DQo8ZGl2IGNsYXNzPSJt b3otY2l0ZS1wcmVmaXgiPk9uIDIvMTIvMTkgNzozNiBQTSwgRHIuIFBhbGEgd3JvdGU6PGJyPg0K PC9kaXY+DQo8YmxvY2txdW90ZSB0eXBlPSJjaXRlIiBjaXRlPSJtaWQ6Zjc1NDhmNDUtZTllZC0z Yzk2LWZkNTUtZDg3MDA2YzVjZTcwQG9wZW5jYS5vcmciPg0KPHA+SGkgYWxsLDwvcD4NCjxwPkkg YW0gd29ya2luZyBvbiBhIGRyYWZ0IGZvciBjcmVkZW50aWFscyBtYW5hZ2VtZW50IHZpYSBFQVAu IFdoZW4gbG9va2luZyBhdCB0aGUgZGlmZmVyZW50IHNwZWNpZmljYXRpb25zLCBpdCBzZWVtcyBh IGJpdCB3ZWlyZCB0aGF0IEVBUCBkb2VzIG5vdCBwcm92aWRlIEZyYWdtZW50YXRpb24gY29udHJv bCBhbmQgcmVxdWlyZXMgZWFjaCBtZXRob2QgdG8gZGVmaW5lIHRoZWlyIG93biB3YXkuDQo8YnI+ DQo8L3A+DQo8cD48aT48Yj5UaGlzLCBsZWQgbWUgdG8gbXkgZmlyc3QgcXVlc3Rpb246PC9iPjwv aT4gaXMgdGhlcmUgYSBkZS1mYWN0byAmcXVvdDtzdGFuZGFyZCZxdW90OyB3YXkgdG8gYWRkIEZy YWdtZW50YXRpb24gc3VwcG9ydCB3ZSBjYW4ganVzdCB1c2UgKHdpdGhvdXQgaGF2aW5nIHRvIHJl LWludmVudCB0aGUgd2hlZWwgYWxsIHRoZSB0aW1lKSA/IElmIHdlIGhhZCBzdWNoIGEgbWVjaGFu aXNtLCB0aGVuIHdlIGNvdWxkIGp1c3Qgc2F5ICZxdW90O2ltcGxlbWVudCB0aGUgbWVjaGFuaXNt DQogYXMgZGVmaW5lZCBpbiAuLi4gJnF1b3Q7LiBUaGlzIHdvdWxkIGRlZmluaXRlbHkgaGVscCBk ZXZlbG9wZXJzIHRoYXQgY291bGQgc2FmZWx5IHJlLXVzZSBjb2RlL2xpYnJhcmllcy4gVGhlIG90 aGVyIGFwcHJvYWNoIHdvdWxkIGJlIHRvIG1vZGlmeSBFQVAgdG8gYWRkIEZyYWdtZW50YXRpb24g c3VwcG9ydCB0aGVyZS4gVGhlIG1haW4gcmVhc29uIHRvIGhhdmUgYSBzdGFuZGFyZCBiZWhhdmlv ciBpcyB0byBoYXZlIGFsc28gYmV0dGVyIG1hbmFnZW1lbnQNCiBmb3IgYWNrIGFuZCBuYWsgcGFj a2V0cy4gQXMgZmFyIGFzIHRoZSBzb2x1dGlvbiBnb2VzLCB0aGUgbWFpbiBvbmVzIEkgbG9va2Vk IGF0IGFyZSB0aGUgb25lcyBtZW50aW9uZWQgaW4gRUFQLVRUTFMgYW5kIEVBUC1URUFQLiBUaGV5 IGFyZSBib3RoIHByYWN0aWNhbGx5IHRoZSBzYW1lLCBhY3RpdmUgQUNLLWJhc2VkIC0gYXJlIHRo ZXJlIG90aGVyIG1ldGhvZHMgdGhhdCBoYXZlIGJlZW4gaW1wbGVtZW50ZWQgPyBIYXMgYW55Ym9k eSBldmVyIGxvb2tlZA0KIGF0IGhvdyBmcmFnbWVudGF0aW9uIGlzIGhhbmRsZWQgaW4gcHJhY3Rp Y2UgYW5kIGlmIHRoZXJlIGFyZSBiZXR0ZXIgc29sdXRpb25zIHRoYW4gb3RoZXJzID88L3A+DQo8 L2Jsb2NrcXVvdGU+DQo8cD5ObyBoYXQ6IEkgdGhpbmsgaGF2aW5nIGEgc3RhbmRhcmQgbWVjaGFu aXNtIGZvciBzdXBwb3J0aW5nIGxhcmdlIG1lc3NhZ2VzIGFuZCBmcmFnbWVudGF0aW9uIGluZGVw ZW5kZW50bHkgb2YgYW55IHBhcnRpY3VsYXIgRUFQIG1ldGhvZCB3b3VsZCBkZWZpbml0ZWx5IGJl IHNvbWV0aGluZyB1c2VmdWwuIEFzIHlvdSBzYWlkLCBpdCB3b3VsZCBhbGxvdyBkZXZlbG9wZXJz IHRvIHNhZmVseSByZS11c2UgY29kZS4gSWYgeW91IGhhdmUgYSBkcmFmdA0KIHByb3Bvc2FsLCBJ IHdvdWxkIGJlIGhhcHB5IHRvIHJldmlldyBpdC4gUGVyaGFwcyB3ZSBjb3VsZCBzdGFydCBieSBs b29raW5nIGF0IGV4aXN0aW5nIG1lY2hhbmlzbXMgdXNlZCBieSBFQVAtUHdkL0VBUC1UVExTLjxi cj4NCjwvcD4NCjxwPi0tTW9oaXQ8YnI+DQo8L3A+DQo8YmxvY2txdW90ZSB0eXBlPSJjaXRlIiBj aXRlPSJtaWQ6Zjc1NDhmNDUtZTllZC0zYzk2LWZkNTUtZDg3MDA2YzVjZTcwQG9wZW5jYS5vcmci Pg0KPHA+PGk+PGI+RnVydGhlciB0aGlua2luZyBsZXQgbWUgdG8gbXkgc2Vjb25kIHF1ZXN0aW9u OjwvYj48L2k+IHRoZSBtZXRob2Qgd2UgYXJlIGdvaW5nIHRvIHByb3Bvc2UgcmVxdWlyZXMgc29t ZSBmb3JtIG9mIGF1dGhlbnRpY2F0aW9uIGZvciB0aGUgc2VydmVyLCB0aGVyZWZvcmUgSSBjYW4g c2VlIGl0cyB1c2UgbWFpbmx5IGFzIGEgdHVubmVsZWQgbWV0aG9kIHdoZXJlIHRoZSBjb21tdW5p Y2F0aW9uIHdpdGggdGhlIHNlcnZlciBpcyBhc3N1bWVkDQogdG8gYmUgYWxyZWFkeSBzZWN1cmUu IElmIHdlIGdvIGRvd24gdGhlIHJvdXRlIG9mIHJlcXVpcmluZyB0aGUgdXNlIG9mIGFuIG91dGVy IG1ldGhvZCB0aGF0IHByb3ZpZGVzIGF1dGhlbnRpY2l0eSBhbmQsIG9wdGlvbmFsbHksIGNvbmZp ZGVudGlhbGl0eSB3ZSB3b3VsZCBhbHNvIG5vdCBuZWVkIHRvIHByb3ZpZGUgc3VwcG9ydCBmb3Ig RnJhZ21lbnRhdGlvbiBjb250cm9sLCBzaW5jZSB0aGUgcmVjb3JkcyB3b3VsZCBiZSBlbmNhcHN1 bGF0ZWQgd2l0aGluDQogdGhlIG91dGVyLW1ldGhvZCBtZXNzYWdlcyB0aGF0IGFscmVhZHkgcHJv dmlkZSBmcmFnbWVudGF0aW9uIHN1cHBvcnQuIFdvdWxkIHRoaXMgYmUgYWNjZXB0YWJsZSA/IE9y IHNob3VsZCB0aGUgbWV0aG9kIG5vdCBoYXZlIHN1Y2ggYXNzdW1wdGlvbnMgYW5kIHByb3ZpZGUg c3VwcG9ydCBmb3IgZXhwbGljaXQgZnJhZ21lbnRhdGlvbiBjb250cm9sID8gV2hhdCB3b3VsZCBi ZSB0aGUgcHJlZmVycmVkIHBhdGggaGVyZSA/IEkgcGVyc29uYWxseSB3b3VsZA0KIGxpa2UgdG8g aGF2ZSBhIG1ldGhvZCB0aGF0IGNvdWxkIGJlIHVzZWQgaW5kZXBlbmRlbnRseSwgYnV0IEkgd291 bGQgYWxzbyBsaWtlIHRvIGZvY3VzIG9uIHNpbXBsaWNpdHkgb2YgaW1wbGVtZW50YXRpb24gc28g dGhhdCBpZiB5b3UgYWxyZWFkeSBoYXZlIEVBUC1UVExTL0VBUC1URUFQIHN1cHBvcnQsIGFkZGlu ZyBzdXBwb3J0IGZvciBFQVAtQ1JFRFMgd291bGQgYmUgdmVyeSBzaW1wbGUuPC9wPg0KPHA+TG9v a2luZyBmb3J3YXJkIHRvIHNvbWUgZ3JlYXQgZ3VpZGFuY2UgYW5kIGFkdmljZSA6RCBBbHNvLCBp ZiB5b3Ugd291bGQgbGlrZSB0byBjb2xsYWJvcmF0ZS9jb250cmlidXRlLCBwbGVhc2UgbGV0IG1l IGtub3chPGJyPg0KPC9wPg0KPGRpdiBjbGFzcz0ibW96LXNpZ25hdHVyZSI+LS0gPGJyPg0KPGRp diBzdHlsZT0iY29sb3I6IGJsYWNrOyBtYXJnaW4tdG9wOiAxMHB4OyI+QmVzdCBSZWdhcmRzLA0K PGRpdiBzdHlsZT0ibWFyZ2luLXRvcDogNXB4OyBtYXJnaW4tbGVmdDogMHB4OyAiPk1hc3NpbWls aWFubyBQYWxhLCBQaC5ELjxicj4NCk9wZW5DQSBMYWJzIERpcmVjdG9yPGJyPg0KPC9kaXY+DQo8 aW1nIHNyYz0iY2lkOnBhcnQxLkJBOTAwMkRGLjdDNkJFM0RBQGVyaWNzc29uLmNvbSIgc3R5bGU9 InZlcnRpY2FsLWFsaWduOiAwcHg7IG1hcmdpbi10b3A6IDEwcHg7IG1hcmdpbi1sZWZ0Og0KICAg ICAgICAgICAgMHB4OyIgYWx0PSJPcGVuQ0EgTG9nbyIgY2xhc3M9IiI+PGJyPg0KPC9kaXY+DQo8 L2Rpdj4NCjxicj4NCjxmaWVsZHNldCBjbGFzcz0ibWltZUF0dGFjaG1lbnRIZWFkZXIiPjwvZmll bGRzZXQ+DQo8cHJlIGNsYXNzPSJtb3otcXVvdGUtcHJlIiB3cmFwPSIiPl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpFbXUgbWFpbGluZyBsaXN0DQo8YSBj bGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86RW11QGlldGYub3Jn Ij5FbXVAaWV0Zi5vcmc8L2E+DQo8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVm PSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2VtdSI+aHR0cHM6Ly93d3cu aWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9lbXU8L2E+DQo8L3ByZT4NCjwvYmxvY2txdW90ZT4N CjwvYm9keT4NCjwvaHRtbD4NCg== --_000_b5a2a434b6316edc840d0b3b9b78f27eericssoncom_-- --_004_b5a2a434b6316edc840d0b3b9b78f27eericssoncom_ Content-Type: image/png; name="hcfiklccgjlnbnjj.png" Content-Description: hcfiklccgjlnbnjj.png Content-Disposition: inline; filename="hcfiklccgjlnbnjj.png"; size=3146; creation-date="Thu, 14 Feb 2019 11:54:40 GMT"; modification-date="Thu, 14 Feb 2019 11:54:40 GMT" Content-ID: Content-Transfer-Encoding: base64 iVBORw0KGgoAAAANSUhEUgAAAGQAAAA2CAMAAAAGesyaAAADAFBMVEUsJiEAAQAKAwMABwoXBwES CQAqDgEkEQItFQESGykaGh0WGyE1FwE9GwJHHwElJiY4JBQmKDE1KCAfLUQ8KygoMEAqMjpXKgs/ MilMMR0pOFEyOUo4OTo1OkRqMgpjOBlpNxUwQV1DPz48QExdOyM4QVV+OQRRQzo1SGdDR0lDSFJf RDFASVyaPwF+RRpNT1I9UXlwSi8+UnNDUm6hQgCPRhBdUEZTUlBKVGlPVF27PgCaSANtUT57VBer SQOMUgxHW4KMUiepTwmJVDh6WT6KVjGCWDpRYH21TwFiYF57YgJXYXaeVR+lVRZrYld1ZiB7YEuS YQBgZW+8VAlkZWjBVQCfXiqqXwG1WhPLVgedYDazXiDZVgCWZEDVWQJ1blapYjbXWgDRXACMaU6W bgCiZjnIXw9mcIixZC6pZjJ/cUeLbFdycmZ4cGnnWwNwc3WqaS6BcGeobwndXwzkXwLgYgDaYwyM eCq/bQHJaBi9ajDMagWVegvRZxzVaAvXaQDLainqZAuvcEPrZQDQaSyockrFbSvmZwnabQLvZwDp aQB0fpPkaxGld1d+f3/3aACfeV6RfG2JfnLebSF7gYy2fQmugQCigxW8d0K3eEr1bQXaciTicRqK gnzNewHuchbUdzKYiDzrdwKah1erjAvOfEXleSq5g1qYjGikiHO2kADigwC2hmSZjIGGj6aHkJzQ iwCximixim/EkAORkZGVkYrOh0rPiVL5giTvhDKkk4LMjF23mR+zmTrhikrviDzsi0TAlHDCnwvK lGqpnJLdlF2boKy+m324nImkoZ+eo6XKpgrloATwl1WypZPOn3zfqQjYrgLBrVDdo3nGq5mysa/S rI7dq4bqqXTOrpWttL+6s6uwtbe/t4rhvALetpjQuqnuwwe9v8LAv7vauqD3xA68w9XBw83rvJfR wbXFyMvbxbPNyMP8zgTczMDr0mb91xLM1ODQ1NfS1c7p0sD70bPd19PX4qj83cje4+Xr4tv54NLp 7/Hy9PHw9fj6/v3YktvJAAAAAXRSTlMAQObYZgAAAAFiS0dEAIgFHUgAAAjrSURBVFjDtVcNWFPX GT6E+l9BZ0EFsTKEIQaUAIrTZdYqxqG0I3UjIuiDM0ipoyO5l0rFh2PE472EoIJKL9hQV2OxqM+U SgFL4r9gEaIoQxgqKBZBR+nGGhXYdwNro0Kfkcp3ntzce/7e8/2e70PoJVDl3bMlZyurUSsaKnqE SrMplYrByozCjUOEUZORodMRVsViTjJc8GbLUGCUUstLv1SyLCGch8DGRiDPe/kY5/2HCQQTxZEE y4fb2gDI8KjjLxsjfyyc3lZgM3KixwgeY4TEzk7+kjHODbeb6u0xAhiw8XgFMOxolpP6J75UjLZf p6dzHIcBYCQbIBB4sCxDOLK6eMAVT39it57+e09ysCnDUtnrJ0vS5ZMW0PBFWDbd40G/85sH2KeX vj94u/flX8/2J6kYQkhkHbzWbkdH0N0UDN8sURS8uMd9dMzPL7BxIIjOayuWLBIf70RPUPjxLouB EgVhMaYuWXQlMjwsN+eFTR4cDZ4werRDYOoAIFkrptm/Ni0gthOt9Q4yWQxcAwyWTbacW0sTDGoJ en4P002/2S7LjgV6BpY1N6OO5g5eeiZTY/P9b1FzRwfKWuk9p/72ct+NpuKpq32qLVaexOCCJB91 aezt5y6zt7fXILSdJZjlVr1w0mCR66x6FL3QOXiUQ2a0k/sFlDlq1LzUMQ4uxxycjl0LWO1bBsY6 yXR3wSTJGxqLhdsJHDsS9cwF47XlvcQGQiXhRbih/HkQv4XOcajZb6GDu7PTFEdPkVu0k4vQyd3J c/SUwNnB+RJ/XsI9ptZDIxMly3dbLNwGnGBJF+Id3cZM9ui8Gjq5P/TDiRCegbOFgSKRo5e7yNHV 2dnPdVb0bHfHQCevNIV/rxqrX48oFQdYcpKMtYRbjuxtfqRypNACK28+j3FsqcilAD0ADuIWCt0y Ra7zRNEOY2YELhW5CV2dXVKixH8BC+s8GDN9wWKxf94zpsRiJuWmBYjgndsKFmu5Bc+D3HQXCcu7 QTFTMl3HF0SLxruLvGa4zUqdMGFWqqfX3GSxN0y6NT154i+v75zvH2thXiWgY2YVElhwYl9NYxar lr0grlQn92DQt1vBUk+nUFeHGZmegUIvl1RXr1AnV/fx6zd4v3HptM/YaXbrzmYFePu2WpowYRlJ o+2PGLb2d9WE5bw1L4DcnOco9HIcH3o02HOecMqMJhQqdLPXpArHl2uEo+Na8qZPXxw0+bVx46bF zhw3eZylM2dgwkbWW3IyJp9lMDe9H2/raiqPCy5/fHSCu+M7mkffoQuzQhvRhWVlj1FcWTfq6dwd ElJmarxedr/u3P6CNn7Fk95ol8wRjIMsOLGJSwLm/OMGjlFHJ7hqelDuxdMlpbU16JvqlJTamivo BjrfUgNB69zfb6Fr1TWPKmtOw9xCdLayEFWvBlaSfmEBsk6LSdTMNnQaldTe7Qfj20yveddR2toV EevCi9/ffmntR7ErtvompmyICM9qyYpZsG3FhqwNYRH5KUtyW7eGRRxfH1OHDv0ZXH6ihbSyVYzS Y3FuBkVR9LaS2wPxUxyTFpu2eGverr+dezvi0ttpOy/tTKlL2ZkWs6p4VV1Kyq60nevS8iLyi1tW hfNWzMfhYT+ArAQ+5odRBENjlRW5F/vH6O7u7urpXtvR/bQbmX/dPd3w7Ok+2Ij4ry5o0N/dY1p7 qA21FodhFRc1ctjIsXZ2Y18VcwCixNgcWlgVbUiue3b3J33te7497vv/oT1Bj5/7br1RgrYlfrRe SqmwPDyK0GqOUHKWj/RwP0J0ZlmsK3o2HP+7Qt9HBr3BYH5aNL3FG/+ul8sjKcxHdRJFGJkhfKxg mM2rUoaSg5h4GAwXJsF00dRGq+/21k2EF7o50oNswrNfsYUQKRBIZWIFh3luaLNe1F++bjXGyWyz ZiGoYFYLx5Ys4v0R3GWRdBHNErBiSiqVRhHMyeaYrMQ4SENWCvEcfhCmGIzpqKlm27KTSWUcAX1g oBw5oATctDb33aLTYV5SWoaXP5+gyqlFdnZ23nB+plcnREv0RWJCBVkrrBJ1BewMmlVpgRUQF7wp ItMJTcsJ34GBRVaFdQZaqoqxFmSb3qDQgu1A2GI4YAnODkQYIOhklDKzo2C1IV2sijzdhjorqwef NdL6ihxzegU7SynexHgBMXy+xWFG8qvdf91D8WpRi41qKFl02YaswYNkULTeLC9CFFK4bDHDMmZb hnuXSOdAsnN1LxgfVu7ZvG8LpSJUlO/gnaWQFwYvJpZeKdUaSC8ApuhIShYQYp5yWQ0oPgVXPtkc Hz/fx5rqqzosHSSlBYHIxKSolJcUsIIpnzkhmt4b7Z/tOzBRQWaA6uNCNdet0nxLkL8CgzeQKIlC XaHjXR9MlqQn9Y1fNd5RE0zF/ryKwVR/JMnsI3S8Umcw6NRYxRuUKqk3lfnKeGcTySAx5hy+7Wfg ZOv4uLLl0w8wUah71QLBpJeXq/eMVVivV8jz6lB2ofWF6i1dEYRZfMJ4piE+ZweNeb7A2VVyKEx6 vjt1z/ghMehVKiUpyt1VYBXCN6j0Q4Mazp7TvvndhIaGhqqvP1bwFk0YRYR5RoLR+PkWmlIpV/oE DQ6jB9Wc3Z6bm6zLTtLlgLC4LVWXz5Q1ffbV5oZ24wmsV/NeKTlirmg+u/q7w7/38PDdeKF8UBgX s2kV4WUC0YR/KOLvPby3L5O30yvG9vY/6vX8JSbb2je96coXX5QPznqfokKKEPWBAwd20ApaTWsP 7LnTfsd42at3+B+H7+zRUfwZZMutN6baHCX5+Ou9Zy4f3nuiKr7KaHxoNDbsSwhp6htvfyg3Zw90 1G+ttVlTJa34/E+fvrXmvY3713xy6tSZfadOJby7X1P/vwn/MeaYr0mF7IMEq690Gu95KwQq5L5K +f59qGUtaZMSciHMKjdVbY6zFqRC/pv3LgxY5tcW0pjIpGGJ7+89kxBnbXZSmjuz7CeyihyG8fbd XXYdrWlqQg+sZWTdzPqBB68VEdnkzDY0lHSjSD9/GRpaMt3OWqLpQENOTf/PpP8CK9ZVVe2a8XoA AAAASUVORK5CYII= --_004_b5a2a434b6316edc840d0b3b9b78f27eericssoncom_-- From nobody Thu Feb 14 05:27:38 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0AF1713106D for ; Thu, 14 Feb 2019 05:27:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ooPTd1is0gQ3 for ; Thu, 14 Feb 2019 05:27:35 -0800 (PST) Received: from mail-vs1-xe2d.google.com (mail-vs1-xe2d.google.com [IPv6:2607:f8b0:4864:20::e2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B16F5128CB7 for ; Thu, 14 Feb 2019 05:27:34 -0800 (PST) Received: by mail-vs1-xe2d.google.com with SMTP id z18so3609042vso.7 for ; Thu, 14 Feb 2019 05:27:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=c8yKHPaC0Qa9LF9WdBFQWi6FFAyeIgkBAJqrjYV9Lrs=; b=VJGFO5RlO4fdK29u0JmVDKAzwvk/Ku9KPgx6YLrMf12AtFP2s8I9d5D9VND26XHKxU 3QcfPitKQ4S9kkPtbB9PJEx+sVY377zXutkagx1FujxZQd8DXeJrSLfvCMm4/Ttvdye9 DB1iz0lRdus30figDtz4MsJeSSEe83pMQH5942DxaGf0fOFlQT+h2tQAIlsrUF+a5Fcw LbH6+oYVX2ZrTUhSb7dlBfzWeJVoej7y5HFhuMxOx5j4cvbS3zBiiZ8DGx8w888JTqVJ sl6LTsG06XSXXkI9mk684Dra7PLSzgmVszuvwYGlnuOB7UQ6MMTF1fHRckxo3q92r1mB LoQw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=c8yKHPaC0Qa9LF9WdBFQWi6FFAyeIgkBAJqrjYV9Lrs=; b=BbMwvpu0nSxwgS44BgXBUrI2B/vFbdmaVwGaYN1yfe/kz2tzu0bz8aGprtdLRLeuUt 3yHQq/wWmPMifOzZRKGvG2/Yvsf8ECHyVXtUW//RLSe+rZC2n4edVs/M/VnAgdBn7ZrQ 6ghidiWPH//YlNGQ5JrX6X27o1elfZlgRJF5Zm0FQC8q1lbMODWABXlnUUjoa5l85w8j Vztpg3CT+eY8wwGoPtNd5i1nZjalkiTH/WJqlcfovIi2UlsO5ORpuGxPjPuwxfoXc5HJ lECMvf+CHQg6w1pYcUY77yapSV2mq6ipF9sLdKeukLbGZqVgpq9rviv9T5o3ggtzGipi rT7g== X-Gm-Message-State: AHQUAubhERGV/K4Vo21gXFu5gx+TJMv4UdghpgAFtndvQzJOBdcNcT6Q E6gIB6CRVdgHaEHUNnqplFhmtVQBosp1ORGzOE4= X-Google-Smtp-Source: AHgI3IbDj3hkRxjC26U2dKhTl1S+k+6mrwhc/MO84xLrsRIaOPkAwCnWCX/fGq7PcgqwMfbJtTCYEwxSu7yF+EHblJc= X-Received: by 2002:a67:fdd0:: with SMTP id l16mr1820999vsq.103.1550150853508; Thu, 14 Feb 2019 05:27:33 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: slon v sobstvennom palto Date: Thu, 14 Feb 2019 15:27:22 +0200 Message-ID: To: Mohit Sethi M Cc: "Dr. Pala" , EMU WG Content-Type: multipart/related; boundary="000000000000f95ce50581da9e4c" Archived-At: Subject: Re: [Emu] EAP and Fragmentation X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Feb 2019 13:27:37 -0000 --000000000000f95ce50581da9e4c Content-Type: multipart/alternative; boundary="000000000000f95ce30581da9e4b" --000000000000f95ce30581da9e4b Content-Type: text/plain; charset="UTF-8" Hi all, These are my first steps in this group so please correct me if I don't follow the rules. Per my experience the existing fragmentation method described in EAP-TLS RFC 5216 serves good for all fragmentation needs. The method is reused by PEAP, EAP-FAST, TEAP and EAP-TTLS. There's an ambiguity in EAP-TLS RFC that doesn't specify whether a not-fragmented message should have the L bit and the 4 octets length field so different peers treat it differently. However, for example, EAP-TTLS RFC closed it tightly saying that even a single-fragment message should have it nevertheless on its redundancy. ~Oleg On Thu, Feb 14, 2019 at 1:54 PM Mohit Sethi M wrote: > Dear Dr. Pala, > On 2/12/19 7:36 PM, Dr. Pala wrote: > > Hi all, > > I am working on a draft for credentials management via EAP. When looking > at the different specifications, it seems a bit weird that EAP does not > provide Fragmentation control and requires each method to define their own > way. > > *This, led me to my first question:* is there a de-facto "standard" way > to add Fragmentation support we can just use (without having to re-invent > the wheel all the time) ? If we had such a mechanism, then we could just > say "implement the mechanism as defined in ... ". This would definitely > help developers that could safely re-use code/libraries. The other approach > would be to modify EAP to add Fragmentation support there. The main reason > to have a standard behavior is to have also better management for ack and > nak packets. As far as the solution goes, the main ones I looked at are the > ones mentioned in EAP-TTLS and EAP-TEAP. They are both practically the > same, active ACK-based - are there other methods that have been implemented > ? Has anybody ever looked at how fragmentation is handled in practice and > if there are better solutions than others ? > > No hat: I think having a standard mechanism for supporting large messages > and fragmentation independently of any particular EAP method would > definitely be something useful. As you said, it would allow developers to > safely re-use code. If you have a draft proposal, I would be happy to > review it. Perhaps we could start by looking at existing mechanisms used by > EAP-Pwd/EAP-TTLS. > > --Mohit > > *Further thinking let me to my second question:* the method we are going > to propose requires some form of authentication for the server, therefore I > can see its use mainly as a tunneled method where the communication with > the server is assumed to be already secure. If we go down the route of > requiring the use of an outer method that provides authenticity and, > optionally, confidentiality we would also not need to provide support for > Fragmentation control, since the records would be encapsulated within the > outer-method messages that already provide fragmentation support. Would > this be acceptable ? Or should the method not have such assumptions and > provide support for explicit fragmentation control ? What would be the > preferred path here ? I personally would like to have a method that could > be used independently, but I would also like to focus on simplicity of > implementation so that if you already have EAP-TTLS/EAP-TEAP support, > adding support for EAP-CREDS would be very simple. > > Looking forward to some great guidance and advice :D Also, if you would > like to collaborate/contribute, please let me know! > -- > Best Regards, > Massimiliano Pala, Ph.D. > OpenCA Labs Director > [image: OpenCA Logo] > > _______________________________________________ > Emu mailing listEmu@ietf.orghttps://www.ietf.org/mailman/listinfo/emu > > _______________________________________________ > Emu mailing list > Emu@ietf.org > https://www.ietf.org/mailman/listinfo/emu > --000000000000f95ce30581da9e4b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,
These are my first steps in this gr= oup so please correct me if I don't follow the rules.

Per my experience the existing fragmentation method described in EA= P-TLS RFC=C2=A05216 se= rves good for all fragmentation needs. The method is reused by PEAP, EAP-FA= ST, TEAP and EAP-TTLS. There's an ambiguity in EAP-TLS RFC that doesn&#= 39;t specify whether a not-fragmented message should have the L bit and the= 4 octets length field so different peers treat it differently. However, fo= r example, EAP-TTLS RFC closed it tightly saying that even a single-fragmen= t message should have it nevertheless on its redundancy.
<= span style=3D"color:rgb(0,0,0);font-size:13.3333px">
<= span style=3D"color:rgb(0,0,0);font-size:13.3333px">~Oleg=C2=A0
On Th= u, Feb 14, 2019 at 1:54 PM Mohit Sethi M <mohit.m.sethi@ericsson.com> wrote:

Dear Dr. Pala,

On 2/12/19 7:36 P= M, Dr. Pala wrote:

Hi all,

I am working on a draft for credentials management via EAP. When looking= at the different specifications, it seems a bit weird that EAP does not pr= ovide Fragmentation control and requires each method to define their own wa= y.

This, led me to my first question: is there a de-facto &qu= ot;standard" way to add Fragmentation support we can just use (without= having to re-invent the wheel all the time) ? If we had such a mechanism, = then we could just say "implement the mechanism as defined in ... ". This would definitely help developers that could= safely re-use code/libraries. The other approach would be to modify EAP to= add Fragmentation support there. The main reason to have a standard behavi= or is to have also better management for ack and nak packets. As far as the solution goes, the main ones I look= ed at are the ones mentioned in EAP-TTLS and EAP-TEAP. They are both practi= cally the same, active ACK-based - are there other methods that have been i= mplemented ? Has anybody ever looked at how fragmentation is handled in practice and if there are better soluti= ons than others ?

No hat: I think having a standard mechanism for supporting large message= s and fragmentation independently of any particular EAP method would defini= tely be something useful. As you said, it would allow developers to safely = re-use code. If you have a draft proposal, I would be happy to review it. Perhaps we could start by looking= at existing mechanisms used by EAP-Pwd/EAP-TTLS.

--Mohit

Further thinking let me to my second question: the method = we are going to propose requires some form of authentication for the server= , therefore I can see its use mainly as a tunneled method where the communi= cation with the server is assumed to be already secure. If we go down the route of requiring the use of an o= uter method that provides authenticity and, optionally, confidentiality we = would also not need to provide support for Fragmentation control, since the= records would be encapsulated within the outer-method messages that already provide fragmentation support. Woul= d this be acceptable ? Or should the method not have such assumptions and p= rovide support for explicit fragmentation control ? What would be the prefe= rred path here ? I personally would like to have a method that could be used independently, but I would also l= ike to focus on simplicity of implementation so that if you already have EA= P-TTLS/EAP-TEAP support, adding support for EAP-CREDS would be very simple.=

Looking forward to some great guidance and advice :D Also, if you would = like to collaborate/contribute, please let me know!

--
Best Regards,
Massimiliano Pala, Ph.D.
OpenCA Labs Director
3D"OpenCA

___________________=
____________________________
Emu mailing list
Emu@ietf.org
https://www.ietf.or=
g/mailman/listinfo/emu
_______________________________________________
Emu mailing list
Emu@ietf.org
https://www.ietf.org/mailman/listinfo/emu
--000000000000f95ce30581da9e4b-- --000000000000f95ce50581da9e4c Content-Type: image/png; name="hcfiklccgjlnbnjj.png" Content-Disposition: inline; filename="hcfiklccgjlnbnjj.png" Content-Transfer-Encoding: base64 Content-ID: <168ec28a7178de5bb6b1> X-Attachment-Id: 168ec28a7178de5bb6b1 iVBORw0KGgoAAAANSUhEUgAAAGQAAAA2CAMAAAAGesyaAAADAFBMVEUsJiEAAQAKAwMABwoXBwES CQAqDgEkEQItFQESGykaGh0WGyE1FwE9GwJHHwElJiY4JBQmKDE1KCAfLUQ8KygoMEAqMjpXKgs/ MilMMR0pOFEyOUo4OTo1OkRqMgpjOBlpNxUwQV1DPz48QExdOyM4QVV+OQRRQzo1SGdDR0lDSFJf RDFASVyaPwF+RRpNT1I9UXlwSi8+UnNDUm6hQgCPRhBdUEZTUlBKVGlPVF27PgCaSANtUT57VBer SQOMUgxHW4KMUiepTwmJVDh6WT6KVjGCWDpRYH21TwFiYF57YgJXYXaeVR+lVRZrYld1ZiB7YEuS YQBgZW+8VAlkZWjBVQCfXiqqXwG1WhPLVgedYDazXiDZVgCWZEDVWQJ1blapYjbXWgDRXACMaU6W bgCiZjnIXw9mcIixZC6pZjJ/cUeLbFdycmZ4cGnnWwNwc3WqaS6BcGeobwndXwzkXwLgYgDaYwyM eCq/bQHJaBi9ajDMagWVegvRZxzVaAvXaQDLainqZAuvcEPrZQDQaSyockrFbSvmZwnabQLvZwDp aQB0fpPkaxGld1d+f3/3aACfeV6RfG2JfnLebSF7gYy2fQmugQCigxW8d0K3eEr1bQXaciTicRqK gnzNewHuchbUdzKYiDzrdwKah1erjAvOfEXleSq5g1qYjGikiHO2kADigwC2hmSZjIGGj6aHkJzQ iwCximixim/EkAORkZGVkYrOh0rPiVL5giTvhDKkk4LMjF23mR+zmTrhikrviDzsi0TAlHDCnwvK lGqpnJLdlF2boKy+m324nImkoZ+eo6XKpgrloATwl1WypZPOn3zfqQjYrgLBrVDdo3nGq5mysa/S rI7dq4bqqXTOrpWttL+6s6uwtbe/t4rhvALetpjQuqnuwwe9v8LAv7vauqD3xA68w9XBw83rvJfR wbXFyMvbxbPNyMP8zgTczMDr0mb91xLM1ODQ1NfS1c7p0sD70bPd19PX4qj83cje4+Xr4tv54NLp 7/Hy9PHw9fj6/v3YktvJAAAAAXRSTlMAQObYZgAAAAFiS0dEAIgFHUgAAAjrSURBVFjDtVcNWFPX GT6E+l9BZ0EFsTKEIQaUAIrTZdYqxqG0I3UjIuiDM0ipoyO5l0rFh2PE472EoIJKL9hQV2OxqM+U SgFL4r9gEaIoQxgqKBZBR+nGGhXYdwNro0Kfkcp3ntzce/7e8/2e70PoJVDl3bMlZyurUSsaKnqE SrMplYrByozCjUOEUZORodMRVsViTjJc8GbLUGCUUstLv1SyLCGch8DGRiDPe/kY5/2HCQQTxZEE y4fb2gDI8KjjLxsjfyyc3lZgM3KixwgeY4TEzk7+kjHODbeb6u0xAhiw8XgFMOxolpP6J75UjLZf p6dzHIcBYCQbIBB4sCxDOLK6eMAVT39it57+e09ysCnDUtnrJ0vS5ZMW0PBFWDbd40G/85sH2KeX vj94u/flX8/2J6kYQkhkHbzWbkdH0N0UDN8sURS8uMd9dMzPL7BxIIjOayuWLBIf70RPUPjxLouB EgVhMaYuWXQlMjwsN+eFTR4cDZ4werRDYOoAIFkrptm/Ni0gthOt9Q4yWQxcAwyWTbacW0sTDGoJ en4P002/2S7LjgV6BpY1N6OO5g5eeiZTY/P9b1FzRwfKWuk9p/72ct+NpuKpq32qLVaexOCCJB91 aezt5y6zt7fXILSdJZjlVr1w0mCR66x6FL3QOXiUQ2a0k/sFlDlq1LzUMQ4uxxycjl0LWO1bBsY6 yXR3wSTJGxqLhdsJHDsS9cwF47XlvcQGQiXhRbih/HkQv4XOcajZb6GDu7PTFEdPkVu0k4vQyd3J c/SUwNnB+RJ/XsI9ptZDIxMly3dbLNwGnGBJF+Id3cZM9ui8Gjq5P/TDiRCegbOFgSKRo5e7yNHV 2dnPdVb0bHfHQCevNIV/rxqrX48oFQdYcpKMtYRbjuxtfqRypNACK28+j3FsqcilAD0ADuIWCt0y Ra7zRNEOY2YELhW5CV2dXVKixH8BC+s8GDN9wWKxf94zpsRiJuWmBYjgndsKFmu5Bc+D3HQXCcu7 QTFTMl3HF0SLxruLvGa4zUqdMGFWqqfX3GSxN0y6NT154i+v75zvH2thXiWgY2YVElhwYl9NYxar lr0grlQn92DQt1vBUk+nUFeHGZmegUIvl1RXr1AnV/fx6zd4v3HptM/YaXbrzmYFePu2WpowYRlJ o+2PGLb2d9WE5bw1L4DcnOco9HIcH3o02HOecMqMJhQqdLPXpArHl2uEo+Na8qZPXxw0+bVx46bF zhw3eZylM2dgwkbWW3IyJp9lMDe9H2/raiqPCy5/fHSCu+M7mkffoQuzQhvRhWVlj1FcWTfq6dwd ElJmarxedr/u3P6CNn7Fk95ol8wRjIMsOLGJSwLm/OMGjlFHJ7hqelDuxdMlpbU16JvqlJTamivo BjrfUgNB69zfb6Fr1TWPKmtOw9xCdLayEFWvBlaSfmEBsk6LSdTMNnQaldTe7Qfj20yveddR2toV EevCi9/ffmntR7ErtvompmyICM9qyYpZsG3FhqwNYRH5KUtyW7eGRRxfH1OHDv0ZXH6ihbSyVYzS Y3FuBkVR9LaS2wPxUxyTFpu2eGverr+dezvi0ttpOy/tTKlL2ZkWs6p4VV1Kyq60nevS8iLyi1tW hfNWzMfhYT+ArAQ+5odRBENjlRW5F/vH6O7u7urpXtvR/bQbmX/dPd3w7Ok+2Ij4ry5o0N/dY1p7 qA21FodhFRc1ctjIsXZ2Y18VcwCixNgcWlgVbUiue3b3J33te7497vv/oT1Bj5/7br1RgrYlfrRe SqmwPDyK0GqOUHKWj/RwP0J0ZlmsK3o2HP+7Qt9HBr3BYH5aNL3FG/+ul8sjKcxHdRJFGJkhfKxg mM2rUoaSg5h4GAwXJsF00dRGq+/21k2EF7o50oNswrNfsYUQKRBIZWIFh3luaLNe1F++bjXGyWyz ZiGoYFYLx5Ys4v0R3GWRdBHNErBiSiqVRhHMyeaYrMQ4SENWCvEcfhCmGIzpqKlm27KTSWUcAX1g oBw5oATctDb33aLTYV5SWoaXP5+gyqlFdnZ23nB+plcnREv0RWJCBVkrrBJ1BewMmlVpgRUQF7wp ItMJTcsJ34GBRVaFdQZaqoqxFmSb3qDQgu1A2GI4YAnODkQYIOhklDKzo2C1IV2sijzdhjorqwef NdL6ihxzegU7SynexHgBMXy+xWFG8qvdf91D8WpRi41qKFl02YaswYNkULTeLC9CFFK4bDHDMmZb hnuXSOdAsnN1LxgfVu7ZvG8LpSJUlO/gnaWQFwYvJpZeKdUaSC8ApuhIShYQYp5yWQ0oPgVXPtkc Hz/fx5rqqzosHSSlBYHIxKSolJcUsIIpnzkhmt4b7Z/tOzBRQWaA6uNCNdet0nxLkL8CgzeQKIlC XaHjXR9MlqQn9Y1fNd5RE0zF/ryKwVR/JMnsI3S8Umcw6NRYxRuUKqk3lfnKeGcTySAx5hy+7Wfg ZOv4uLLl0w8wUah71QLBpJeXq/eMVVivV8jz6lB2ofWF6i1dEYRZfMJ4piE+ZweNeb7A2VVyKEx6 vjt1z/ghMehVKiUpyt1VYBXCN6j0Q4Mazp7TvvndhIaGhqqvP1bwFk0YRYR5RoLR+PkWmlIpV/oE DQ6jB9Wc3Z6bm6zLTtLlgLC4LVWXz5Q1ffbV5oZ24wmsV/NeKTlirmg+u/q7w7/38PDdeKF8UBgX s2kV4WUC0YR/KOLvPby3L5O30yvG9vY/6vX8JSbb2je96coXX5QPznqfokKKEPWBAwd20ApaTWsP 7LnTfsd42at3+B+H7+zRUfwZZMutN6baHCX5+Ou9Zy4f3nuiKr7KaHxoNDbsSwhp6htvfyg3Zw90 1G+ttVlTJa34/E+fvrXmvY3713xy6tSZfadOJby7X1P/vwn/MeaYr0mF7IMEq690Gu95KwQq5L5K +f59qGUtaZMSciHMKjdVbY6zFqRC/pv3LgxY5tcW0pjIpGGJ7+89kxBnbXZSmjuz7CeyihyG8fbd XXYdrWlqQg+sZWTdzPqBB68VEdnkzDY0lHSjSD9/GRpaMt3OWqLpQENOTf/PpP8CK9ZVVe2a8XoA AAAASUVORK5CYII= --000000000000f95ce50581da9e4c-- From nobody Thu Feb 14 05:38:34 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A25813106D for ; Thu, 14 Feb 2019 05:38:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=L6cFH4eD; dkim=pass (1024-bit key) header.d=ericsson.com header.b=Ab3cprbj Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pRI3LnqeivVI for ; Thu, 14 Feb 2019 05:38:29 -0800 (PST) Received: from sesbmg23.ericsson.net (sesbmg23.ericsson.net [193.180.251.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 271D112D84D for ; Thu, 14 Feb 2019 05:38:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1550151507; x=1552743507; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=6euhWJfR7q0W5vHwKgX7s3xRmJEK04ulxQw3XnZIGHU=; b=L6cFH4eDzVKuEXnpnFdd3wAMqohq1URTYJhJLz9tuyzZg01+CzTUWlo+Rzy4W0eG KV4l111q1399xJBfXXHaRYZyz++aSirOQl4dHlCTogw/E+yA4bXgcZpeAbf1k7IC byU4ISReaMRsukaqr/mB69Hq973EaUC/76/hEwcAia4=; X-AuditID: c1b4fb25-da1ff70000005ff7-99-5c656f53f4e1 Received: from ESESBMB501.ericsson.se (Unknown_Domain [153.88.183.114]) by sesbmg23.ericsson.net (Symantec Mail Security) with SMTP id 6F.22.24567.35F656C5; Thu, 14 Feb 2019 14:38:27 +0100 (CET) Received: from ESESBMR505.ericsson.se (153.88.183.201) by ESESBMB501.ericsson.se (153.88.183.168) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Thu, 14 Feb 2019 14:38:26 +0100 Received: from ESESBMB502.ericsson.se (153.88.183.169) by ESESBMR505.ericsson.se (153.88.183.201) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Thu, 14 Feb 2019 14:38:26 +0100 Received: from EUR04-DB3-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB502.ericsson.se (153.88.183.169) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Thu, 14 Feb 2019 14:38:26 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6euhWJfR7q0W5vHwKgX7s3xRmJEK04ulxQw3XnZIGHU=; b=Ab3cprbj21A/LHFzYL3E7gLQd97C6K3XHjkS1evTNCPz+Kd/3FG4zmRMYi2/kFNZOzjJlQiRs3ZtI4exSt+Pu7SLaQ/QLeeBpp7pYSOTJR4LCu11+r599Wy+XkAafQdyj6bzom6oHSPs+N1PTDQ+tArXHv5TsegbUpOv5Z2XLws= Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com (10.168.98.146) by HE1PR0701MB2188.eurprd07.prod.outlook.com (10.168.29.134) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1643.7; Thu, 14 Feb 2019 13:38:25 +0000 Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::1cbb:43e1:d406:1a0a]) by HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::1cbb:43e1:d406:1a0a%6]) with mapi id 15.20.1643.004; Thu, 14 Feb 2019 13:38:25 +0000 From: Mohit Sethi M To: slon v sobstvennom palto CC: "Dr. Pala" , EMU WG Thread-Topic: [Emu] EAP and Fragmentation Thread-Index: AQHUxFwPnkPBm43f0kqflrUiCzSSKKXfSVAAgAADEgA= Date: Thu, 14 Feb 2019 13:38:25 +0000 Message-ID: <38861eaf-4134-5225-fd41-c80b7eaa875e@ericsson.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 x-originating-ip: [89.166.49.243] x-clientproxiedby: HE1PR05CA0282.eurprd05.prod.outlook.com (2603:10a6:3:fc::34) To HE1PR0701MB2905.eurprd07.prod.outlook.com (2603:10a6:3:57::18) authentication-results: spf=none (sender IP is ) smtp.mailfrom=mohit.m.sethi@ericsson.com; x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 844b8012-8ad6-439d-99f0-08d69281b1a5 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020); SRVR:HE1PR0701MB2188; x-ms-traffictypediagnostic: HE1PR0701MB2188: x-ms-exchange-purlcount: 1 x-microsoft-exchange-diagnostics: =?utf-8?B?MTtIRTFQUjA3MDFNQjIxODg7MjM6dllwb2lIdTFNT0toOFZ3ejZhTzErRDNB?= =?utf-8?B?dEtTVTI3dld3UkxZSlRzYlZGWmdFUWR2dmtBRmdsRkJLUlh0Uzl2a2krZnJB?= =?utf-8?B?VE51U1NnSUNJdW5xSVVVMWU2dUxrMUFobHRYbURJakNYNE1wZHNsdjhCRHpi?= =?utf-8?B?QU96Q2dhdDByRHVWcTAyczJyNDVTRmNqTnoxNmtNQmpuNXdVLzVIMlVUcHhj?= =?utf-8?B?Y3ZIZ0NqVktyZjlGSFJvcFlhSEtpTlIwaU9rblhOQ3c3OTB0Q25xQTlGWjdB?= =?utf-8?B?bGRpcTk0cWpaVjNzQXhBZXhyeE9LUHMrdkFwdVF6d2h3SVBsQlhuVSsrbHQx?= =?utf-8?B?Y2FvZ2ZGbzQwVHVFZlBQbmp5UnpmSUVYeGd4Nm9VTjVOUE1aZXQ1M1BhV3I5?= =?utf-8?B?TFNVRFl2NlUwS1ppa0NqQTMzN2I0RnBZb2hCQXlWVCtRby9Lek9MOUltZmxX?= =?utf-8?B?emU1REpPcmhKU24yY0Y2LytuRlRJM1NCdGI0ZUo2Um9mTGEwQW1qanVvTjJP?= =?utf-8?B?UmVQdFBwck9zQzRGK1lvQWhuYzdGTWZIdDhRMlZyTGFYVDRPS1BhZ1pPcjBE?= =?utf-8?B?ZmdqbGJydG9SZjFoZ2h2ekl4Nlp6UWt6bG0wMC84R2JWTkcyMzNSSHRjMU9Z?= =?utf-8?B?S01yK2FtNzU2a0s5cEVCeFk0L3p3S2gzQjRTamREQnJqM0QxdzBRVlR5VENJ?= =?utf-8?B?Ylk1Q3Z1SFdjQ0lDSHowNjJ4K0VWaUMrTUltb3NxSXJ3dTNmSU5BSmtsSjlH?= =?utf-8?B?c1FoRnVtU0s0Ymxtcmhwa2g0YlhiYjFPQTZsOVRBVy9EdU5YVnlVM3R0Wi9q?= =?utf-8?B?ODhjdWc4Y3ZKWnd4Y3lBMlRpVG5iWXo5STROTS94b09RaU15d1FiSGV0M3FM?= =?utf-8?B?S3FTbHYvc01TNzlWc3dFNXp5SUVjNHd0MVk1d0RrSE5zMGROeU1QTlBQc2g2?= =?utf-8?B?QTNzSTc4S2dRRHR5dysyTzF1RXNFelRaL1NSalZ5a3ZrN1BCSXFXSzFYWG5t?= =?utf-8?B?WHIza1J4QzVmOC9MQ2ZUN292RzNTdEVNWkxXVjlObFNDYnlFTzNIeExyZ1Js?= =?utf-8?B?enZFbXg1bWV6bnZMN1hPVHlENGxQMmNWWkJpbXlUdU5nSnBxRCszbGsxOTFq?= =?utf-8?B?NXhGcHdaZVlWM016RnJENWR0T1dVRHpObG01Yk55U0cwVW9FQWpGVXRWcHl6?= =?utf-8?B?ZEczTElVZUNieG9xOWw1NWJ5U3VTSmFMNGJXK3h4d0xWSG1QTmRkQ3c1OUp4?= =?utf-8?B?bHlJTDNrZk9DQkJFbUM1dWcwZzAzb2x3N25ydjFleTlXOFdYTGo0Tzl4TkVC?= =?utf-8?B?VU5BMENrQzBBME13V2lNVW9QSXAvTG92dDdaK055Uzl0bGZJdUkzVXNEd1ZD?= =?utf-8?B?NmIxckQwZ2ZQQ3RkSnQ1bm15Q0s1WjVLNCtmcGZZVCtERGJSWmwzbERqejIr?= =?utf-8?B?eXVCdGpyV080Z3o1eDZCZEVudDFnb0xleWxHUmJiSE5KbUlmeGVkb0lDRFc2?= =?utf-8?B?UlZtVDhxZTc3OFZJL2NVaVd4ZVpJZlZMQ1hsL29DeUtVcmF2WDB2MGRLdVNJ?= =?utf-8?B?UkFwNUU2Y1l5YTFjSHVWMGlnZnZXWnJ5dU9VWFhHVG92c2pLblMzUmxnWEZW?= =?utf-8?B?Mk1lbDRaZXJ2SjlxNkJsdlVadURCZSt1Z3AzeEttcjBYMGozeTZwRzRjcEpM?= =?utf-8?B?UlJ5TzlENldSb3hmZXlqY0U2ZTBZUEY2SlQyUit2ZzZDZzdVYVk1Rzd6TTdE?= =?utf-8?B?WVVPZmkzYm5HQkhmM0FUTERCQ1pnZGFqbkpYOHJka3dDNCtKbFE2NGY5TXFC?= =?utf-8?B?QXpJYUhqdUVEbk9LeGR5bzU5S3RKZmJxbUFERFQ2cnUwcjMrc0lLSm9JWTJT?= =?utf-8?B?ODhRV0NGZHF1bENET2Y0L0tmVjJVeVF4dTN0NFREbnJ5S1VXa3JiQWVvbDBW?= =?utf-8?B?VWJTeDFobWRnL1pHNXJVWUxSK3ZlK1Zud0pMTVV5QXZFM1hqQ2xjcTBMQUZR?= =?utf-8?B?cmtIQkZwYjIydkJVSEt3eU9JSThRS2srKzRCT29ITWI3WEQ2UkNGcG1lSmNv?= =?utf-8?B?WVNDSmFNT25hLzYxd1hkVHpOSEZkV2hjK01nYXhpQU5idm5ESjBQNGl3eGZB?= =?utf-8?Q?TDa0ChJIHHY2U99dfEZfL3iAY=3D?= x-microsoft-antispam-prvs: x-forefront-prvs: 09480768F8 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(376002)(396003)(366004)(136003)(346002)(53754006)(199004)(189003)(6246003)(64126003)(54906003)(316002)(58126008)(256004)(36756003)(25786009)(5070765005)(4326008)(14444005)(2906002)(1411001)(31686004)(31696002)(86362001)(6916009)(26005)(106356001)(105586002)(186003)(476003)(2616005)(11346002)(446003)(65826007)(486006)(347775010)(966005)(561944003)(14454004)(68736007)(478600001)(3846002)(6116002)(97736004)(606006)(6486002)(7736002)(76176011)(99286004)(71190400001)(71200400001)(6506007)(53546011)(6436002)(8936002)(386003)(8676002)(733005)(81166006)(81156014)(66066001)(6306002)(52116002)(53936002)(6512007)(54896002)(102836004)(236005)(65806001)(65956001)(229853002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2188; H:HE1PR0701MB2905.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: IquTv0AIWnCRs2oc5y3G6pOvEfzwhJPJnv0WKY5wr8QfemEwypIUinYwQObc+yXuIEuSsbmx/t8eB0WcMrP/gLj13tEkAUw7bBaN1rVi8i7cHXme8DsW/HJqJp5MMP9hul3oiKBDihFGxMCcJ5i2bProx/HlLcmK+ySnHYipRxCLhbZK2oR3nuReCsz1eNQA62yNpfC/qZx+Sps5LTLaoyghESbz2x3hi0Q9FcTqlqbOutRrKlLXpBGVkcO/Oyu91zr/pncxY0EMZTnozs3M4h9Yy4OtLtSKDi1GOvvsQ6WOfQvgjRuTsBUuGG/SY1qyHmQgdLvUU8VHm+eLlsg225K64WF3vv3+GuigID0UELD4Jv81OZNt3/rhKmGLAYrPO2okxFmt23qt5D0aLv623pOy4IN3e3wDaf5uvno5Waw= Content-Type: multipart/alternative; boundary="_000_38861eaf41345225fd41c80b7eaa875eericssoncom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 844b8012-8ad6-439d-99f0-08d69281b1a5 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Feb 2019 13:38:24.5528 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2188 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrAKsWRmVeSWpSXmKPExsUyM2J7kW5wfmqMwY7jvBb7N/hYHFu/lsXi 2Z6D7A7MHjtn3WX3WLLkJ5PH9In3WQKYo7hsUlJzMstSi/TtErgyPnw7xlawZyNjxaEpNQ2M 99cwdjFyckgImEjsmbiHvYuRi0NI4AijxMtJXcwQzjdGiQOrN7HAOQ9OnmeCcJYwSXx70soI 4rAITGCWaL5wnhlkmJDANCaJtjOuEFXPGCV2r3/JBJJgEzCQmDxlBdAWDg4RAWOJS7f8QcLM AtYSN+4vBjtEWEBDYu60o2wgtoiApsTZI1uZIWwriavvP7GC2CwCqhLfpxwFs3kF7CUWXHjI CrFrF9CueXPAGjgFAiUu7p8ItpdRQEzi+6k1TBDLxCVuPZnPBPG1gMSSPRBHSwiISrx8/A9s qKhAhMS6b4egIaMocfbdQ7CXJQSmMkq0985hgxgaK/Hhfz/UIB2Js9efQDXISlya3w1l+0q8 mD+dDaL5NqPErlM/2WAabr94xgJhS0mcuHiUdQKj4SwkB0LYyRJNqy8wzgL7VFDi5MwnLLOA gccMDJn1u/QhShQlpnQ/ZIewNSRa58yFsj0kTjcdZUNWs4CRYxWjaHFqcVJuupGxXmpRZnJx cX6eXl5qySZGYLo6uOW36g7Gy28cDzEKcDAq8fC+TkmNEWJNLCuuzD3EKMHBrCTC+yUJKMSb klhZlVqUH19UmpNafIhRmoNFSZz3j5BgjJBAemJJanZqakFqEUyWiYNTqoHRM1tm1eZaI7W4 zfO49Z5b/5UpsDIr3al1wedlQ6+orE+8q9IC56ueWVzqCW+f3fC9G9zw2nDJ0yXbvhtIbRT4 1Pu5hTc80DTi3ap7SzXXcy6benGSSmXWlkWFq7tmXBaOsw5cZ/T2lVhc1P6S262HVNZ4Rd0J ujTlB1fKzIvSj99E59Xs1lBWYinOSDTUYi4qTgQAcM5svVMDAAA= Archived-At: Subject: Re: [Emu] EAP and Fragmentation X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Feb 2019 13:38:33 -0000 --_000_38861eaf41345225fd41c80b7eaa875eericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgT2xlZywNCg0KWW91IGFyZSB3YXJtbHkgd2VsY29tZS4NCg0KTm90IGFsbCBtZXRob2RzIHVz ZSBhIFRMUyBvdXRlciB0dW5uZWwuIEZvciBleGFtcGxlOiBFQVAtcHdkIGhhcyB0aGUgZm9sbG93 aW5nIHRleHQ6DQoNCkVBUC1wd2QgZnJhZ21lbnRhdGlvbiBzdXBwb3J0IGlzIHByb3ZpZGVkIHRo cm91Z2ggdGhlIGFkZGl0aW9uIG9mDQogICBmbGFncyB3aXRoaW4gdGhlIEVBUC1SZXNwb25zZSBh bmQgRUFQLVJlcXVlc3QgcGFja2V0cywgYXMgd2VsbCBhcyBhDQogICBUb3RhbC1MZW5ndGggZmll bGQgb2YgdHdvIG9jdGV0cy4gIEZsYWdzIGluY2x1ZGUgdGhlIExlbmd0aCBpbmNsdWRlZA0KICAg KEwpIGFuZCBNb3JlIGZyYWdtZW50cyAoTSkgYml0cy4gIFRoZSBMIGZsYWcgaXMgc2V0IHRvIGlu ZGljYXRlIHRoZQ0KICAgcHJlc2VuY2Ugb2YgdGhlIHR3by1vY3RldCBUb3RhbC1MZW5ndGggZmll bGQsIGFuZCBNVVNUIGJlIHNldCBmb3IgdGhlDQogICBmaXJzdCBmcmFnbWVudCBvZiBhIGZyYWdt ZW50ZWQgRUFQLXB3ZCBtZXNzYWdlIG9yIHNldCBvZiBtZXNzYWdlcy4NCiAgIFRoZSBNIGZsYWcg aXMgc2V0IG9uIGFsbCBidXQgdGhlIGxhc3QgZnJhZ21lbnQuICBUaGUgVG90YWwtTGVuZ3RoDQog ICBmaWVsZCBpcyB0d28gb2N0ZXRzLCBhbmQgcHJvdmlkZXMgdGhlIHRvdGFsIGxlbmd0aCBvZiB0 aGUgRUFQLXB3ZA0KICAgbWVzc2FnZSBvciBzZXQgb2YgbWVzc2FnZXMgdGhhdCBpcyBiZWluZyBm cmFnbWVudGVkOyB0aGlzIHNpbXBsaWZpZXMNCiAgIGJ1ZmZlciBhbGxvY2F0aW9uLg0KDQpBcyBJ IHNhaWQsIGhhdmluZyBhIG1ldGhvZCBpbmRlcGVuZGVudCBtZWNoYW5pc20gdGhhdCBjb3VsZCBi ZSByZS11c2VkIHNhZmVseSB3b3VsZCBtYWtlIHNlbnNlLg0KDQpBbmQgdGhhbmtzIGZvciBwb2lu dGluZyBvdXQgTCBiaXQgYW1iaWd1aXR5IGluIEVBUC1UTFMuIFdlIHNob3VsZCBpbmRlZWQgZml4 IHRoaXMuDQoNCi0tTW9oaXQNCg0KT24gMi8xNC8xOSAzOjI3IFBNLCBzbG9uIHYgc29ic3R2ZW5u b20gcGFsdG8gd3JvdGU6DQpIaSBhbGwsDQpUaGVzZSBhcmUgbXkgZmlyc3Qgc3RlcHMgaW4gdGhp cyBncm91cCBzbyBwbGVhc2UgY29ycmVjdCBtZSBpZiBJIGRvbid0IGZvbGxvdyB0aGUgcnVsZXMu DQoNClBlciBteSBleHBlcmllbmNlIHRoZSBleGlzdGluZyBmcmFnbWVudGF0aW9uIG1ldGhvZCBk ZXNjcmliZWQgaW4gRUFQLVRMUyBSRkMgNTIxNiBzZXJ2ZXMgZ29vZCBmb3IgYWxsIGZyYWdtZW50 YXRpb24gbmVlZHMuIFRoZSBtZXRob2QgaXMgcmV1c2VkIGJ5IFBFQVAsIEVBUC1GQVNULCBURUFQ IGFuZCBFQVAtVFRMUy4gVGhlcmUncyBhbiBhbWJpZ3VpdHkgaW4gRUFQLVRMUyBSRkMgdGhhdCBk b2Vzbid0IHNwZWNpZnkgd2hldGhlciBhIG5vdC1mcmFnbWVudGVkIG1lc3NhZ2Ugc2hvdWxkIGhh dmUgdGhlIEwgYml0IGFuZCB0aGUgNCBvY3RldHMgbGVuZ3RoIGZpZWxkIHNvIGRpZmZlcmVudCBw ZWVycyB0cmVhdCBpdCBkaWZmZXJlbnRseS4gSG93ZXZlciwgZm9yIGV4YW1wbGUsIEVBUC1UVExT IFJGQyBjbG9zZWQgaXQgdGlnaHRseSBzYXlpbmcgdGhhdCBldmVuIGEgc2luZ2xlLWZyYWdtZW50 IG1lc3NhZ2Ugc2hvdWxkIGhhdmUgaXQgbmV2ZXJ0aGVsZXNzIG9uIGl0cyByZWR1bmRhbmN5Lg0K DQp+T2xlZw0KDQpPbiBUaHUsIEZlYiAxNCwgMjAxOSBhdCAxOjU0IFBNIE1vaGl0IFNldGhpIE0g PG1vaGl0Lm0uc2V0aGlAZXJpY3Nzb24uY29tPG1haWx0bzptb2hpdC5tLnNldGhpQGVyaWNzc29u LmNvbT4+IHdyb3RlOg0KDQpEZWFyIERyLiBQYWxhLA0KDQpPbiAyLzEyLzE5IDc6MzYgUE0sIERy LiBQYWxhIHdyb3RlOg0KDQpIaSBhbGwsDQoNCkkgYW0gd29ya2luZyBvbiBhIGRyYWZ0IGZvciBj cmVkZW50aWFscyBtYW5hZ2VtZW50IHZpYSBFQVAuIFdoZW4gbG9va2luZyBhdCB0aGUgZGlmZmVy ZW50IHNwZWNpZmljYXRpb25zLCBpdCBzZWVtcyBhIGJpdCB3ZWlyZCB0aGF0IEVBUCBkb2VzIG5v dCBwcm92aWRlIEZyYWdtZW50YXRpb24gY29udHJvbCBhbmQgcmVxdWlyZXMgZWFjaCBtZXRob2Qg dG8gZGVmaW5lIHRoZWlyIG93biB3YXkuDQoNClRoaXMsIGxlZCBtZSB0byBteSBmaXJzdCBxdWVz dGlvbjogaXMgdGhlcmUgYSBkZS1mYWN0byAic3RhbmRhcmQiIHdheSB0byBhZGQgRnJhZ21lbnRh dGlvbiBzdXBwb3J0IHdlIGNhbiBqdXN0IHVzZSAod2l0aG91dCBoYXZpbmcgdG8gcmUtaW52ZW50 IHRoZSB3aGVlbCBhbGwgdGhlIHRpbWUpID8gSWYgd2UgaGFkIHN1Y2ggYSBtZWNoYW5pc20sIHRo ZW4gd2UgY291bGQganVzdCBzYXkgImltcGxlbWVudCB0aGUgbWVjaGFuaXNtIGFzIGRlZmluZWQg aW4gLi4uICIuIFRoaXMgd291bGQgZGVmaW5pdGVseSBoZWxwIGRldmVsb3BlcnMgdGhhdCBjb3Vs ZCBzYWZlbHkgcmUtdXNlIGNvZGUvbGlicmFyaWVzLiBUaGUgb3RoZXIgYXBwcm9hY2ggd291bGQg YmUgdG8gbW9kaWZ5IEVBUCB0byBhZGQgRnJhZ21lbnRhdGlvbiBzdXBwb3J0IHRoZXJlLiBUaGUg bWFpbiByZWFzb24gdG8gaGF2ZSBhIHN0YW5kYXJkIGJlaGF2aW9yIGlzIHRvIGhhdmUgYWxzbyBi ZXR0ZXIgbWFuYWdlbWVudCBmb3IgYWNrIGFuZCBuYWsgcGFja2V0cy4gQXMgZmFyIGFzIHRoZSBz b2x1dGlvbiBnb2VzLCB0aGUgbWFpbiBvbmVzIEkgbG9va2VkIGF0IGFyZSB0aGUgb25lcyBtZW50 aW9uZWQgaW4gRUFQLVRUTFMgYW5kIEVBUC1URUFQLiBUaGV5IGFyZSBib3RoIHByYWN0aWNhbGx5 IHRoZSBzYW1lLCBhY3RpdmUgQUNLLWJhc2VkIC0gYXJlIHRoZXJlIG90aGVyIG1ldGhvZHMgdGhh dCBoYXZlIGJlZW4gaW1wbGVtZW50ZWQgPyBIYXMgYW55Ym9keSBldmVyIGxvb2tlZCBhdCBob3cg ZnJhZ21lbnRhdGlvbiBpcyBoYW5kbGVkIGluIHByYWN0aWNlIGFuZCBpZiB0aGVyZSBhcmUgYmV0 dGVyIHNvbHV0aW9ucyB0aGFuIG90aGVycyA/DQoNCk5vIGhhdDogSSB0aGluayBoYXZpbmcgYSBz dGFuZGFyZCBtZWNoYW5pc20gZm9yIHN1cHBvcnRpbmcgbGFyZ2UgbWVzc2FnZXMgYW5kIGZyYWdt ZW50YXRpb24gaW5kZXBlbmRlbnRseSBvZiBhbnkgcGFydGljdWxhciBFQVAgbWV0aG9kIHdvdWxk IGRlZmluaXRlbHkgYmUgc29tZXRoaW5nIHVzZWZ1bC4gQXMgeW91IHNhaWQsIGl0IHdvdWxkIGFs bG93IGRldmVsb3BlcnMgdG8gc2FmZWx5IHJlLXVzZSBjb2RlLiBJZiB5b3UgaGF2ZSBhIGRyYWZ0 IHByb3Bvc2FsLCBJIHdvdWxkIGJlIGhhcHB5IHRvIHJldmlldyBpdC4gUGVyaGFwcyB3ZSBjb3Vs ZCBzdGFydCBieSBsb29raW5nIGF0IGV4aXN0aW5nIG1lY2hhbmlzbXMgdXNlZCBieSBFQVAtUHdk L0VBUC1UVExTLg0KDQotLU1vaGl0DQoNCkZ1cnRoZXIgdGhpbmtpbmcgbGV0IG1lIHRvIG15IHNl Y29uZCBxdWVzdGlvbjogdGhlIG1ldGhvZCB3ZSBhcmUgZ29pbmcgdG8gcHJvcG9zZSByZXF1aXJl cyBzb21lIGZvcm0gb2YgYXV0aGVudGljYXRpb24gZm9yIHRoZSBzZXJ2ZXIsIHRoZXJlZm9yZSBJ IGNhbiBzZWUgaXRzIHVzZSBtYWlubHkgYXMgYSB0dW5uZWxlZCBtZXRob2Qgd2hlcmUgdGhlIGNv bW11bmljYXRpb24gd2l0aCB0aGUgc2VydmVyIGlzIGFzc3VtZWQgdG8gYmUgYWxyZWFkeSBzZWN1 cmUuIElmIHdlIGdvIGRvd24gdGhlIHJvdXRlIG9mIHJlcXVpcmluZyB0aGUgdXNlIG9mIGFuIG91 dGVyIG1ldGhvZCB0aGF0IHByb3ZpZGVzIGF1dGhlbnRpY2l0eSBhbmQsIG9wdGlvbmFsbHksIGNv bmZpZGVudGlhbGl0eSB3ZSB3b3VsZCBhbHNvIG5vdCBuZWVkIHRvIHByb3ZpZGUgc3VwcG9ydCBm b3IgRnJhZ21lbnRhdGlvbiBjb250cm9sLCBzaW5jZSB0aGUgcmVjb3JkcyB3b3VsZCBiZSBlbmNh cHN1bGF0ZWQgd2l0aGluIHRoZSBvdXRlci1tZXRob2QgbWVzc2FnZXMgdGhhdCBhbHJlYWR5IHBy b3ZpZGUgZnJhZ21lbnRhdGlvbiBzdXBwb3J0LiBXb3VsZCB0aGlzIGJlIGFjY2VwdGFibGUgPyBP ciBzaG91bGQgdGhlIG1ldGhvZCBub3QgaGF2ZSBzdWNoIGFzc3VtcHRpb25zIGFuZCBwcm92aWRl IHN1cHBvcnQgZm9yIGV4cGxpY2l0IGZyYWdtZW50YXRpb24gY29udHJvbCA/IFdoYXQgd291bGQg YmUgdGhlIHByZWZlcnJlZCBwYXRoIGhlcmUgPyBJIHBlcnNvbmFsbHkgd291bGQgbGlrZSB0byBo YXZlIGEgbWV0aG9kIHRoYXQgY291bGQgYmUgdXNlZCBpbmRlcGVuZGVudGx5LCBidXQgSSB3b3Vs ZCBhbHNvIGxpa2UgdG8gZm9jdXMgb24gc2ltcGxpY2l0eSBvZiBpbXBsZW1lbnRhdGlvbiBzbyB0 aGF0IGlmIHlvdSBhbHJlYWR5IGhhdmUgRUFQLVRUTFMvRUFQLVRFQVAgc3VwcG9ydCwgYWRkaW5n IHN1cHBvcnQgZm9yIEVBUC1DUkVEUyB3b3VsZCBiZSB2ZXJ5IHNpbXBsZS4NCg0KTG9va2luZyBm b3J3YXJkIHRvIHNvbWUgZ3JlYXQgZ3VpZGFuY2UgYW5kIGFkdmljZSA6RCBBbHNvLCBpZiB5b3Ug d291bGQgbGlrZSB0byBjb2xsYWJvcmF0ZS9jb250cmlidXRlLCBwbGVhc2UgbGV0IG1lIGtub3ch DQoNCi0tDQpCZXN0IFJlZ2FyZHMsDQpNYXNzaW1pbGlhbm8gUGFsYSwgUGguRC4NCk9wZW5DQSBM YWJzIERpcmVjdG9yDQpbT3BlbkNBIExvZ29dDQoNCg0KDQpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXw0KRW11IG1haWxpbmcgbGlzdA0KRW11QGlldGYub3Jn PG1haWx0bzpFbXVAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL2VtdQ0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fDQpFbXUgbWFpbGluZyBsaXN0DQpFbXVAaWV0Zi5vcmc8bWFpbHRvOkVtdUBpZXRmLm9yZz4N Cmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vZW11DQo= --_000_38861eaf41345225fd41c80b7eaa875eericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <6BEC8D37A6024641AC0E822022692BB8@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IHRleHQ9IiMwMDAwMDAi IGJnY29sb3I9IiNGRkZGRkYiPg0KPHA+SGkgT2xlZyw8L3A+DQo8cD5Zb3UgYXJlIHdhcm1seSB3 ZWxjb21lLiA8YnI+DQo8L3A+DQo8cD5Ob3QgYWxsIG1ldGhvZHMgdXNlIGEgVExTIG91dGVyIHR1 bm5lbC4gRm9yIGV4YW1wbGU6IEVBUC1wd2QgaGFzIHRoZSBmb2xsb3dpbmcgdGV4dDo8L3A+DQo8 cD48L3A+DQo8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4NCjxwcmUgY2xhc3M9Im5ld3BhZ2UiPkVB UC1wd2QgZnJhZ21lbnRhdGlvbiBzdXBwb3J0IGlzIHByb3ZpZGVkIHRocm91Z2ggdGhlIGFkZGl0 aW9uIG9mCiAgIGZsYWdzIHdpdGhpbiB0aGUgRUFQLVJlc3BvbnNlIGFuZCBFQVAtUmVxdWVzdCBw YWNrZXRzLCBhcyB3ZWxsIGFzIGEKICAgVG90YWwtTGVuZ3RoIGZpZWxkIG9mIHR3byBvY3RldHMu ICBGbGFncyBpbmNsdWRlIHRoZSBMZW5ndGggaW5jbHVkZWQKICAgKEwpIGFuZCBNb3JlIGZyYWdt ZW50cyAoTSkgYml0cy4gIFRoZSBMIGZsYWcgaXMgc2V0IHRvIGluZGljYXRlIHRoZQogICBwcmVz ZW5jZSBvZiB0aGUgdHdvLW9jdGV0IFRvdGFsLUxlbmd0aCBmaWVsZCwgYW5kIE1VU1QgYmUgc2V0 IGZvciB0aGUKICAgZmlyc3QgZnJhZ21lbnQgb2YgYSBmcmFnbWVudGVkIEVBUC1wd2QgbWVzc2Fn ZSBvciBzZXQgb2YgbWVzc2FnZXMuCiAgIFRoZSBNIGZsYWcgaXMgc2V0IG9uIGFsbCBidXQgdGhl IGxhc3QgZnJhZ21lbnQuICBUaGUgVG90YWwtTGVuZ3RoCiAgIGZpZWxkIGlzIHR3byBvY3RldHMs IGFuZCBwcm92aWRlcyB0aGUgdG90YWwgbGVuZ3RoIG9mIHRoZSBFQVAtcHdkCiAgIG1lc3NhZ2Ug b3Igc2V0IG9mIG1lc3NhZ2VzIHRoYXQgaXMgYmVpbmcgZnJhZ21lbnRlZDsgdGhpcyBzaW1wbGlm aWVzCiAgIGJ1ZmZlciBhbGxvY2F0aW9uLjwvcHJlPg0KPC9ibG9ja3F1b3RlPg0KQXMgSSBzYWlk LCBoYXZpbmcgYSBtZXRob2QgaW5kZXBlbmRlbnQgbWVjaGFuaXNtIHRoYXQgY291bGQgYmUgcmUt dXNlZCBzYWZlbHkgd291bGQgbWFrZSBzZW5zZS4NCjxwPjwvcD4NCjxwPkFuZCB0aGFua3MgZm9y IHBvaW50aW5nIG91dCBMIGJpdCBhbWJpZ3VpdHkgaW4gRUFQLVRMUy4gV2Ugc2hvdWxkIGluZGVl ZCBmaXggdGhpcy4NCjxicj4NCjwvcD4NCjxwPi0tTW9oaXQ8YnI+DQo8L3A+DQo8ZGl2IGNsYXNz PSJtb3otY2l0ZS1wcmVmaXgiPk9uIDIvMTQvMTkgMzoyNyBQTSwgc2xvbiB2IHNvYnN0dmVubm9t IHBhbHRvIHdyb3RlOjxicj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0i bWlkOkNBQmU2QUhnbk9KVW9OdUxzRDZvSlVaTWc0cTJjM2FhJiM0MztQcE09NnMyNHhFNGd1Z3R0 OXdAbWFpbC5nbWFpbC5jb20iPg0KPGRpdiBkaXI9Imx0ciI+DQo8ZGl2PkhpIGFsbCw8L2Rpdj4N CjxkaXY+VGhlc2UgYXJlIG15IGZpcnN0IHN0ZXBzIGluIHRoaXMgZ3JvdXAgc28gcGxlYXNlIGNv cnJlY3QgbWUgaWYgSSBkb24ndCBmb2xsb3cgdGhlIHJ1bGVzLjwvZGl2Pg0KPGRpdj48YnI+DQo8 L2Rpdj4NCjxkaXY+UGVyIG15IGV4cGVyaWVuY2UgdGhlIGV4aXN0aW5nIGZyYWdtZW50YXRpb24g bWV0aG9kIGRlc2NyaWJlZCBpbiBFQVAtVExTIFJGQyZuYnNwOzxzcGFuIHN0eWxlPSJjb2xvcjpy Z2IoMCwwLDApO2ZvbnQtc2l6ZToxMy4zMzMzcHgiPjUyMTYgc2VydmVzIGdvb2QgZm9yIGFsbCBm cmFnbWVudGF0aW9uIG5lZWRzLiBUaGUgbWV0aG9kIGlzIHJldXNlZCBieSBQRUFQLCBFQVAtRkFT VCwgVEVBUCBhbmQgRUFQLVRUTFMuIFRoZXJlJ3MgYW4gYW1iaWd1aXR5DQogaW4gRUFQLVRMUyBS RkMgdGhhdCBkb2Vzbid0IHNwZWNpZnkgd2hldGhlciBhIG5vdC1mcmFnbWVudGVkIG1lc3NhZ2Ug c2hvdWxkIGhhdmUgdGhlIEwgYml0IGFuZCB0aGUgNCBvY3RldHMgbGVuZ3RoIGZpZWxkIHNvIGRp ZmZlcmVudCBwZWVycyB0cmVhdCBpdCBkaWZmZXJlbnRseS4gSG93ZXZlciwgZm9yIGV4YW1wbGUs IEVBUC1UVExTIFJGQyBjbG9zZWQgaXQgdGlnaHRseSBzYXlpbmcgdGhhdCBldmVuIGEgc2luZ2xl LWZyYWdtZW50IG1lc3NhZ2UNCiBzaG91bGQgaGF2ZSBpdCBuZXZlcnRoZWxlc3Mgb24gaXRzIHJl ZHVuZGFuY3kuPC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBzdHlsZT0iY29sb3I6cmdiKDAsMCww KTtmb250LXNpemU6MTMuMzMzM3B4Ij48YnI+DQo8L3NwYW4+PC9kaXY+DQo8ZGl2PjxzcGFuIHN0 eWxlPSJjb2xvcjpyZ2IoMCwwLDApO2ZvbnQtc2l6ZToxMy4zMzMzcHgiPn5PbGVnJm5ic3A7PC9z cGFuPjwvZGl2Pg0KPGJyPg0KPGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPg0KPGRpdiBkaXI9Imx0 ciIgY2xhc3M9ImdtYWlsX2F0dHIiPk9uIFRodSwgRmViIDE0LCAyMDE5IGF0IDE6NTQgUE0gTW9o aXQgU2V0aGkgTSAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1vaGl0Lm0uc2V0aGlAZXJpY3Nzb24uY29t IiBtb3otZG8tbm90LXNlbmQ9InRydWUiPm1vaGl0Lm0uc2V0aGlAZXJpY3Nzb24uY29tPC9hPiZn dDsgd3JvdGU6PGJyPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0 eWxlPSJtYXJnaW46MHB4IDBweCAwcHgKICAgICAgICAgICAgMC44ZXg7Ym9yZGVyLWxlZnQ6MXB4 IHNvbGlkCiAgICAgICAgICAgIHJnYigyMDQsMjA0LDIwNCk7cGFkZGluZy1sZWZ0OjFleCI+DQo8 ZGl2IGJnY29sb3I9IiNGRkZGRkYiPg0KPHA+RGVhciBEci4gUGFsYSw8L3A+DQo8ZGl2IGNsYXNz PSJnbWFpbC1tXzU4MTM2MzI1MzU2ODM4NzkxMTFtb3otY2l0ZS1wcmVmaXgiPk9uIDIvMTIvMTkg NzozNiBQTSwgRHIuIFBhbGEgd3JvdGU6PGJyPg0KPC9kaXY+DQo8YmxvY2txdW90ZSB0eXBlPSJj aXRlIj4NCjxwPkhpIGFsbCw8L3A+DQo8cD5JIGFtIHdvcmtpbmcgb24gYSBkcmFmdCBmb3IgY3Jl ZGVudGlhbHMgbWFuYWdlbWVudCB2aWEgRUFQLiBXaGVuIGxvb2tpbmcgYXQgdGhlIGRpZmZlcmVu dCBzcGVjaWZpY2F0aW9ucywgaXQgc2VlbXMgYSBiaXQgd2VpcmQgdGhhdCBFQVAgZG9lcyBub3Qg cHJvdmlkZSBGcmFnbWVudGF0aW9uIGNvbnRyb2wgYW5kIHJlcXVpcmVzIGVhY2ggbWV0aG9kIHRv IGRlZmluZSB0aGVpciBvd24gd2F5Lg0KPGJyPg0KPC9wPg0KPHA+PGk+PGI+VGhpcywgbGVkIG1l IHRvIG15IGZpcnN0IHF1ZXN0aW9uOjwvYj48L2k+IGlzIHRoZXJlIGEgZGUtZmFjdG8gJnF1b3Q7 c3RhbmRhcmQmcXVvdDsgd2F5IHRvIGFkZCBGcmFnbWVudGF0aW9uIHN1cHBvcnQgd2UgY2FuIGp1 c3QgdXNlICh3aXRob3V0IGhhdmluZyB0byByZS1pbnZlbnQgdGhlIHdoZWVsIGFsbCB0aGUgdGlt ZSkgPyBJZiB3ZSBoYWQgc3VjaCBhIG1lY2hhbmlzbSwgdGhlbiB3ZSBjb3VsZCBqdXN0IHNheSAm cXVvdDtpbXBsZW1lbnQgdGhlIG1lY2hhbmlzbQ0KIGFzIGRlZmluZWQgaW4gLi4uICZxdW90Oy4g VGhpcyB3b3VsZCBkZWZpbml0ZWx5IGhlbHAgZGV2ZWxvcGVycyB0aGF0IGNvdWxkIHNhZmVseSBy ZS11c2UgY29kZS9saWJyYXJpZXMuIFRoZSBvdGhlciBhcHByb2FjaCB3b3VsZCBiZSB0byBtb2Rp ZnkgRUFQIHRvIGFkZCBGcmFnbWVudGF0aW9uIHN1cHBvcnQgdGhlcmUuIFRoZSBtYWluIHJlYXNv biB0byBoYXZlIGEgc3RhbmRhcmQgYmVoYXZpb3IgaXMgdG8gaGF2ZSBhbHNvIGJldHRlciBtYW5h Z2VtZW50DQogZm9yIGFjayBhbmQgbmFrIHBhY2tldHMuIEFzIGZhciBhcyB0aGUgc29sdXRpb24g Z29lcywgdGhlIG1haW4gb25lcyBJIGxvb2tlZCBhdCBhcmUgdGhlIG9uZXMgbWVudGlvbmVkIGlu IEVBUC1UVExTIGFuZCBFQVAtVEVBUC4gVGhleSBhcmUgYm90aCBwcmFjdGljYWxseSB0aGUgc2Ft ZSwgYWN0aXZlIEFDSy1iYXNlZCAtIGFyZSB0aGVyZSBvdGhlciBtZXRob2RzIHRoYXQgaGF2ZSBi ZWVuIGltcGxlbWVudGVkID8gSGFzIGFueWJvZHkgZXZlciBsb29rZWQNCiBhdCBob3cgZnJhZ21l bnRhdGlvbiBpcyBoYW5kbGVkIGluIHByYWN0aWNlIGFuZCBpZiB0aGVyZSBhcmUgYmV0dGVyIHNv bHV0aW9ucyB0aGFuIG90aGVycyA/PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+Tm8gaGF0OiBJIHRo aW5rIGhhdmluZyBhIHN0YW5kYXJkIG1lY2hhbmlzbSBmb3Igc3VwcG9ydGluZyBsYXJnZSBtZXNz YWdlcyBhbmQgZnJhZ21lbnRhdGlvbiBpbmRlcGVuZGVudGx5IG9mIGFueSBwYXJ0aWN1bGFyIEVB UCBtZXRob2Qgd291bGQgZGVmaW5pdGVseSBiZSBzb21ldGhpbmcgdXNlZnVsLiBBcyB5b3Ugc2Fp ZCwgaXQgd291bGQgYWxsb3cgZGV2ZWxvcGVycyB0byBzYWZlbHkgcmUtdXNlIGNvZGUuIElmIHlv dSBoYXZlIGEgZHJhZnQNCiBwcm9wb3NhbCwgSSB3b3VsZCBiZSBoYXBweSB0byByZXZpZXcgaXQu IFBlcmhhcHMgd2UgY291bGQgc3RhcnQgYnkgbG9va2luZyBhdCBleGlzdGluZyBtZWNoYW5pc21z IHVzZWQgYnkgRUFQLVB3ZC9FQVAtVFRMUy48YnI+DQo8L3A+DQo8cD4tLU1vaGl0PGJyPg0KPC9w Pg0KPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+DQo8cD48aT48Yj5GdXJ0aGVyIHRoaW5raW5nIGxl dCBtZSB0byBteSBzZWNvbmQgcXVlc3Rpb246PC9iPjwvaT4gdGhlIG1ldGhvZCB3ZSBhcmUgZ29p bmcgdG8gcHJvcG9zZSByZXF1aXJlcyBzb21lIGZvcm0gb2YgYXV0aGVudGljYXRpb24gZm9yIHRo ZSBzZXJ2ZXIsIHRoZXJlZm9yZSBJIGNhbiBzZWUgaXRzIHVzZSBtYWlubHkgYXMgYSB0dW5uZWxl ZCBtZXRob2Qgd2hlcmUgdGhlIGNvbW11bmljYXRpb24gd2l0aCB0aGUgc2VydmVyIGlzIGFzc3Vt ZWQNCiB0byBiZSBhbHJlYWR5IHNlY3VyZS4gSWYgd2UgZ28gZG93biB0aGUgcm91dGUgb2YgcmVx dWlyaW5nIHRoZSB1c2Ugb2YgYW4gb3V0ZXIgbWV0aG9kIHRoYXQgcHJvdmlkZXMgYXV0aGVudGlj aXR5IGFuZCwgb3B0aW9uYWxseSwgY29uZmlkZW50aWFsaXR5IHdlIHdvdWxkIGFsc28gbm90IG5l ZWQgdG8gcHJvdmlkZSBzdXBwb3J0IGZvciBGcmFnbWVudGF0aW9uIGNvbnRyb2wsIHNpbmNlIHRo ZSByZWNvcmRzIHdvdWxkIGJlIGVuY2Fwc3VsYXRlZCB3aXRoaW4NCiB0aGUgb3V0ZXItbWV0aG9k IG1lc3NhZ2VzIHRoYXQgYWxyZWFkeSBwcm92aWRlIGZyYWdtZW50YXRpb24gc3VwcG9ydC4gV291 bGQgdGhpcyBiZSBhY2NlcHRhYmxlID8gT3Igc2hvdWxkIHRoZSBtZXRob2Qgbm90IGhhdmUgc3Vj aCBhc3N1bXB0aW9ucyBhbmQgcHJvdmlkZSBzdXBwb3J0IGZvciBleHBsaWNpdCBmcmFnbWVudGF0 aW9uIGNvbnRyb2wgPyBXaGF0IHdvdWxkIGJlIHRoZSBwcmVmZXJyZWQgcGF0aCBoZXJlID8gSSBw ZXJzb25hbGx5IHdvdWxkDQogbGlrZSB0byBoYXZlIGEgbWV0aG9kIHRoYXQgY291bGQgYmUgdXNl ZCBpbmRlcGVuZGVudGx5LCBidXQgSSB3b3VsZCBhbHNvIGxpa2UgdG8gZm9jdXMgb24gc2ltcGxp Y2l0eSBvZiBpbXBsZW1lbnRhdGlvbiBzbyB0aGF0IGlmIHlvdSBhbHJlYWR5IGhhdmUgRUFQLVRU TFMvRUFQLVRFQVAgc3VwcG9ydCwgYWRkaW5nIHN1cHBvcnQgZm9yIEVBUC1DUkVEUyB3b3VsZCBi ZSB2ZXJ5IHNpbXBsZS48L3A+DQo8cD5Mb29raW5nIGZvcndhcmQgdG8gc29tZSBncmVhdCBndWlk YW5jZSBhbmQgYWR2aWNlIDpEIEFsc28sIGlmIHlvdSB3b3VsZCBsaWtlIHRvIGNvbGxhYm9yYXRl L2NvbnRyaWJ1dGUsIHBsZWFzZSBsZXQgbWUga25vdyE8YnI+DQo8L3A+DQo8ZGl2IGNsYXNzPSJn bWFpbC1tXzU4MTM2MzI1MzU2ODM4NzkxMTFtb3otc2lnbmF0dXJlIj4tLSA8YnI+DQo8ZGl2IHN0 eWxlPSJjb2xvcjpibGFjazttYXJnaW4tdG9wOjEwcHgiPkJlc3QgUmVnYXJkcywNCjxkaXYgc3R5 bGU9Im1hcmdpbi10b3A6NXB4O21hcmdpbi1sZWZ0OjBweCI+TWFzc2ltaWxpYW5vIFBhbGEsIFBo LkQuPGJyPg0KT3BlbkNBIExhYnMgRGlyZWN0b3I8YnI+DQo8L2Rpdj4NCjxpbWcgc3JjPSJkYXRh OmltYWdlL3BuZztiYXNlNjQsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQUdRQUFBQTJDQU1BQUFB R2VzeWFBQUFEQUZCTVZFVXNKaUVBQVFBS0F3TUFCd29YQndFU0NRQXFEZ0VrRVFJdEZRRVNHeWth R2gwV0d5RTFGd0U5R3dKSEh3RWxKaVk0SkJRbUtERTFLQ0FmTFVROEt5Z29NRUFxTWpwWEtncy9N aWxNTVIwcE9GRXlPVW80T1RvMU9rUnFNZ3BqT0JscE54VXdRVjFEUHo0OFFFeGRPeU00UVZWJiM0 MztPUVJSUXpvMVNHZERSMGxEU0ZKZlJERkFTVnlhUHdGJiM0MztSUnBOVDFJOVVYbHdTaTgmIzQz O1VuTkRVbTZoUWdDUFJoQmRVRVpUVWxCS1ZHbFBWRjI3UGdDYVNBTnRVVDU3VkJlclNRT01VZ3hI VzRLTVVpZXBUd21KVkRoNldUNktWakdDV0RwUllIMjFUd0ZpWUY1N1lnSlhZWGFlVlImIzQzO2xW UlpyWWxkMVppQjdZRXVTWVFCZ1pXJiM0Mzs4VkFsa1pXakJWUUNmWGlxcVh3RzFXaFBMVmdlZFlE YXpYaURaVmdDV1pFRFZXUUoxYmxhcFlqYlhXZ0RSWEFDTWFVNldiZ0NpWmpuSVh3OW1jSWl4WkM2 cFpqSi9jVWVMYkZkeWNtWjRjR25uV3dOd2MzV3FhUzZCY0dlb2J3bmRYd3prWHdMZ1lnRGFZd3lN ZUNxL2JRSEphQmk5YWpETWFnV1ZlZ3ZSWnh6VmFBdlhhUURMYWlucVpBdXZjRVByWlFEUWFTeW9j a3JGYlN2bVp3bmFiUUx2WndEcGFRQjBmcFBrYXhHbGQxZCYjNDM7ZjMvM2FBQ2ZlVjZSZkcySmZu TGViU0Y3Z1l5MmZRbXVnUUNpZ3hXOGQwSzNlRXIxYlFYYWNpVGljUnFLZ256TmV3SHVjaGJVZHpL WWlEenJkd0thaDFlcmpBdk9mRVhsZVNxNWcxcVlqR2lraUhPMmtBRGlnd0MyaG1TWmpJR0dqNmFI a0p6UWl3Q3hpbWl4aW0vRWtBT1JrWkdWa1lyT2gwclBpVkw1Z2lUdmhES2trNExNakYyM21SJiM0 Mzt6bVRyaGlrcnZpRHpzaTBUQWxIRENud3ZLbEdxcG5KTGRsRjJib0t5JiM0MzttMzI0bklta29a JiM0MztlbzZYS3BncmxvQVR3bDFXeXBaUE9uM3pmcVFqWXJnTEJyVkRkbzNuR3E1bXlzYS9Tckk3 ZHE0YnFxWFRPcnBXdHRMJiM0Mzs2czZ1d3RiZS90NHJodkFMZXRwalF1cW51d3dlOXY4TEF2N3Zh dXFEM3hBNjh3OVhCdzgzcnZKZlJ3YlhGeU12YnhiUE55TVA4emdUY3pNRHIwbWI5MXhMTTFPRFEx TmZTMWM3cDBzRDcwYlBkMTlQWDRxajgzY2plNCYjNDM7WHI0dHY1NE5McDcvSHk5UEh3OWZqNi92 M1lrdHZKQUFBQUFYUlNUbE1BUU9iWVpnQUFBQUZpUzBkRUFJZ0ZIVWdBQUFqclNVUkJWRmpEdFZj TldGUFhHVDZFJiM0MztsOUJaMEVGc1RLRUlRYVVBSXJUWmRZcXhxRzBJM1VqSXVpRE0waXBveU81 bDByRmgyUEU0NzJFb0lKS0w5aFFWMk94cU0mIzQzO1VTZ0ZMNHI5Z0VhSW9ReGdxS0JaQlImIzQz O25HR2hYWWR3TnJvMEtma2NwM250emNlLzdlOC8yZTcwUG9KVkRsM2JNbFp5dXJVU3NhS25xRVNy TXBsWXJCeW96Q2pVT0VVWk9Sb2RNUlZzVmlUakpjOEdiTFVHQ1VVc3RMdjFTeUxDR2NoOERHUmlE UGUva1k1LzJIQ1FRVHhaRUV5NGZiMmdESThLampMeHNqZnl5YzNsWmdNM0tpeHdnZVk0VEV6azcm IzQzO2tqSE9EYmViNnUweEFoaXc4WGdGTU94b2xwUDZKNzVVakxaZnA2ZHpISWNCWUNRYklCQjRz Q3hET0xLNmVNQVZUMzlpdDU3JiM0MztlMDl5c0NuRFV0bnJKMHZTNVpNVzBQQkZXRGJkNDBHLzg1 c0gyS2VYdmo5NHUvZmxYOC8ySjZrWVFraGtIYnpXYmtkSDBOMFVETjhzVVJTOHVNZDlkTXpQTDdC eElJak9heXVXTEJJZjcwUlBVUGp4TG91QkVnVmhNYVl1V1hRbE1qd3NOJiM0MztlRlRSNGNEWjR3 ZXJSRFlPb0FJRmtycHRtL05pMGd0aE90OVE0eVdReGNBd3lXVGJhY1cwc1RER29KZW40UDAwMi8y UzdMamdWNkJwWTFONk9PNWc1ZWVpWlRZL1A5YjFGelJ3ZktXdWs5cC83MmN0JiM0MztOcHVLcHEz MnFMVmFleE9DQ0pCOTFhZXp0NXk2enQ3ZlhJTFNkSlpqbFZyMXcwbUNSNjZ4NkZMM1FPWGlVUTJh MGsvc0ZsRGxxMUx6VU1RNHV4eHljamwwTFdPMWJCc1k2eVhSM3dTVEpHeHFMaGRzSkhEc1M5Y3dG NDdYbHZjUUdRaVhoUmJpaC9Ia1F2NFhPY2FqWmI2R0R1N1BURkVkUGtWdTBrNHZReWQzSmMvU1V3 Tm5CJiM0MztSSi9Yc0k5cHRaREl4TWx5M2RiTE53R25HQkpGJiM0MztJZDNjWk05dWk4R2pxNVAv VERpUkNlZ2JPRmdTS1JvNWU3eU5IVjJkblBkVmIwYkhmSFFDZXZOSVYvcnhxclg0OG9GUWRZY3BL TXRZUmJqdXh0ZnFSeXBOQUNLMjgmIzQzO2ozRnNxY2lsQUQwQUR1SVdDdDB5UmE3elJORU9ZMllF TGhXNUNWMmRYVktpeEg4QkMmIzQzO3M4R0ROOXdXS3hmOTR6cHNSaUp1V21CWWpnbmRzS0ZtdTVC YyYjNDM7RDNIUVhDY3U3UVRGVE1sM0hGMFNMeHJ1THZHYTR6VXFkTUdGV3FxZlgzR1N4TjB5Nk5U MTU0aSYjNDM7djc1enZIMnRoWGlXZ1kyWVZFbGh3WWw5Tll4YXJscjBncmxRbjkyRFF0MXZCVWsm IzQzO25VRmVIR1ptZWdVSXZsMVJYcjFBblYvZng2emQ0djNIcHRNL1lhWGJyem1ZRmVQdTJXcG93 WVJsSm8mIzQzOzJQR0xiMmQ5V0U1YncxTDREY25PY285SEljSDNvMDJIT2VjTXFNSmhRcWRMUFhw QXJIbDJ1RW8mIzQzO05hOHFaUFh4dzAmIzQzO2JWeDQ2YkZ6aHczZVp5bE0yZGd3a2JXVzNJeUpw OWxNRGU5SDIvcmFpcVBDeTUvZkhTQ3UmIzQzO003bWtmZm9RdXpRaHZSaFdWbGoxRmNXVGZxNmR3 ZEVsSm1hcnhlZHIvdTNQNkNObjdGazk1b2w4d1JqSU1zT0xHSlN3TG0vT01HamxGSEo3aHFlbER1 eGRNbHBiVTE2SnZxbEpUYW1pdm9CanJmVWdOQjY5emZiNkZyMVRXUEttdE93OXhDZExheUVGV3ZC bGFTZm1FQnNrNkxTZFRNTm5RYWxkVGU3UWZqMjB5dmVkZFIydG9WRWV2Q2k5L2ZmbW50UjdFcnR2 b21wbXlJQ005cXlZcFpzRzNGaHF3TllSSDVLVXR5VzdlR1JSeGZIMU9IRHYwWlhINmloYlN5Vll6 U1kzRnVCa1ZSOUxhUzJ3UHhVeHlURnB1MmVHdmVyciYjNDM7ZGV6dmkwdHRwT3kvdFRLbEwyWmtX czZwNFZWMUt5cTYwbmV2UzhpTHlpMXRXaGZOV3pNZmhZVCYjNDM7QXJBUSYjNDM7NW9kUkJFTmps Ulc1Ri92SDZPN3U3dXJwWHR2Ui9iUWJtWC9kUGQzdzdPayYjNDM7MklqNHJ5NW8wTi9kWTFwN3FB MjFGb2RoRlJjMWN0aklzWFoyWTE4VmN3Q2l4TmdjV2xnVmJVaXVlM2IzSjMzdGU3NDk3dnYvb1Qx Qmo1LzdicjFSZ3JZbGZyUmVTcW13UER5SzBHcU9VSEtXai9Sd1AwSjBabG1zSzNvMkhQJiM0Mzs3 UXQ5SEJyM0JZSDVhTkwzRkcvJiM0Mzt1bDhzaktjeEhkUkpGR0praGZLeGdtTTJyVW9hU2c1aDRH QXdYSnNGMDBkUkdxJiM0MzsvMjFrMkVGN281MG9Oc3dyTmZzWVVRS1JCSVpXSUZoM2x1YUxOZTFG JiM0MzsmIzQzO2JqWEd5V3l6WmlHb1lGWUx4NVlzNHYwUjNHV1JkQkhORXJCaVNpcVZSaEhNeWVh WXJNUTRTRU5XQ3ZFY2ZoQ21HSXpwcUtsbTI3S1RTV1VjQVgxZ29CdzVvQVRjdERiMzNhTFRZVjVT V29hWFA1JiM0MztneXFsRmRuWjIzbkImIzQzO3BsY25SRXYwUldKQ0JWa3JyQkoxQmV3TW1sVnBn UlVRRjd3cEl0TUpUY3NKMzRHQlJWYUZkUVphcW9xeEZtU2IzcURRZ3UxQTJHSTRZQW5PRGtRWUlP aGtsREt6bzJDMUlWMnNpanpkaGpvcnF3ZWZOZEw2aWh4emVnVTdTeW5leEhnQk1YeSYjNDM7eFdG RzhxdmRmOTFEOFdwUmk0MXFLRmwwMllhc3dZTmtVTFRlTEM5Q0ZGSzRiREhETW1aYmhudVhTT2RB c25OMUx4Z2ZWdTdadkc4THBTSlVsTy9nbmFXUUZ3WXZKcFplS2RVYVNDOEFwdWhJU2hZUVlwNXlX UTBvUGdWWFB0a2NIei9meDVycXF6b3NIU1NsQllISXhLU29sSmNVc0lJcG56a2htdDRiN1ovdE96 QlJRV2FBNnVOQ05kZXQwbnhMa0w4Q2d6ZVFLSWxDWGFIalhSOU1scVFuOVkxZk5kNVJFMHpGL3J5 S3dWUi9KTW5zSTNTOFVtY3c2TlJZeFJ1VUtxazNsZm5LZUdjVHlTQXg1aHkmIzQzOzdXZmdaT3Y0 dUxMbDB3OHdVYWg3MVFMQnBKZVhxL2VNVlZpdlY4ano2bEIyb2ZXRjZpMWRFWVJaZk1KNHBpRSYj NDM7WndlTmViN0EyVlZ5S0V4NnZqdDF6L2doTWVoVktpVXB5dDFWWUJYQ042ajBRNE1henA3VHZ2 bmRoSWFHaHFxdlAxYndGazBZUllSNVJvTFImIzQzO1BrV21sSXBWL29FRFE2akI5V2MzWjZibTZ6 TFR0TGxnTEM0TFZXWHo1UTFmZmJWNW9aMjR3bXNWL05lS1RsaXJtZyYjNDM7dS9xN3c3LzM4UERk ZUtGOFVCZ1hzMmtWNFdVQzBZUi9LT0x2UGJ5M0w1TzMweXZHOXZZLzZ2WDhKU2JiMmplOTZjb1hY NVFQem5xZm9rS0tFUFdCQXdkMjBBcGFUV3NQN0xuVGZzZDQyYXQzJiM0MztCJiM0MztINyYjNDM7 elJVZndaWk11dE42YmFIQ1g1JiM0MztPdTlaeTRmM251aUtyN0thSHhvTkRic1N3aHA2aHR2Znln M1p3OTAxRyYjNDM7dHRWbFRKYTM0L0UmIzQzO2Z2clhtdlkzNzEzeHk2dFNaZmFkT0pieTdYMVAv dnduL01lYVlyMG1GN0lNRXE2OTBHdTk1S3dRcTVMNUsmIzQzO2Y1OXFHVXRhWk1TY2lITUtqZFZi WTZ6RnFSQy9wdjNMZ3hZNXRjVzBwaklwR0dKNyYjNDM7ODlreEJuYlhaU21qdXo3Q2V5aWh5Rzhm YmRYWFlkcldscVFnJiM0MztzWldUZHpQcUJCNjhWRWRua3pEWTBsSFNqU0Q5L0dScGFNdDNPV3FM cFFFTk9UZi9QcFA4Q0s5WlZWZTJhOFhvQUFBQUFTVVZPUks1Q1lJST0iIHN0eWxlPSJ2ZXJ0aWNh bC1hbGlnbjogMHB4OyBtYXJnaW4tdG9wOiAxMHB4OwogICAgICAgICAgICAgICAgICAgICAgbWFy Z2luLWxlZnQ6IDBweDsiIGFsdD0iT3BlbkNBIExvZ28iIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+ PGJyPg0KPC9kaXY+DQo8L2Rpdj4NCjxicj4NCjxmaWVsZHNldCBjbGFzcz0iZ21haWwtbV81ODEz NjMyNTM1NjgzODc5MTExbWltZUF0dGFjaG1lbnRIZWFkZXIiPjwvZmllbGRzZXQ+DQo8cHJlIGNs YXNzPSJnbWFpbC1tXzU4MTM2MzI1MzU2ODM4NzkxMTFtb3otcXVvdGUtcHJlIj5fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpFbXUgbWFpbGluZyBsaXN0Cjxh IGNsYXNzPSJnbWFpbC1tXzU4MTM2MzI1MzU2ODM4NzkxMTFtb3otdHh0LWxpbmstYWJicmV2aWF0 ZWQiIGhyZWY9Im1haWx0bzpFbXVAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIiBtb3otZG8tbm90 LXNlbmQ9InRydWUiPkVtdUBpZXRmLm9yZzwvYT4KPGEgY2xhc3M9ImdtYWlsLW1fNTgxMzYzMjUz NTY4Mzg3OTExMW1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby9lbXUiIHRhcmdldD0iX2JsYW5rIiBtb3otZG8tbm90LXNlbmQ9 InRydWUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vZW11PC9hPgo8L3By ZT4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX188YnI+DQpFbXUgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFp bHRvOkVtdUBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+ RW11QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vZW11IiByZWw9Im5vcmVmZXJyZXIiIHRhcmdldD0iX2JsYW5rIiBtb3otZG8t bm90LXNlbmQ9InRydWUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vZW11 PC9hPjxicj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8 L2JvZHk+DQo8L2h0bWw+DQo= --_000_38861eaf41345225fd41c80b7eaa875eericssoncom_-- From nobody Thu Feb 14 06:31:46 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A08CE131069 for ; Thu, 14 Feb 2019 06:31:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=g4gIBapk; dkim=pass (1024-bit key) header.d=ericsson.com header.b=L7NikZSO Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uOpsKrLvtz1p for ; Thu, 14 Feb 2019 06:31:41 -0800 (PST) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 31BF8131186 for ; Thu, 14 Feb 2019 06:31:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1550154699; x=1552746699; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=9qgO03wN4yG3zF/2COBCxzFf+qRe+6TYeh5zoq+UP8o=; b=g4gIBapkqYJegJgQoCSWcH2j6gTfECGpQSQGl9hHeIWFtgoYWYkRnTD7+lEQ7akg Zs5s/+pBGpInwMeIa9lu/Qz+wsuumuL5iI3J3yv4gJ4X8OS6Ka0lKMn8WJBBlKU9 4a3Fi++RPpkudkrcaFlaKCipv6JkvuQdYr0DyjrPJr8=; X-AuditID: c1b4fb2d-2198b9e00000062f-39-5c657bcbdc23 Received: from ESESSMB503.ericsson.se (Unknown_Domain [153.88.183.121]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id 10.B4.01583.BCB756C5; Thu, 14 Feb 2019 15:31:39 +0100 (CET) Received: from ESESSMB502.ericsson.se (153.88.183.163) by ESESSMB503.ericsson.se (153.88.183.164) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Thu, 14 Feb 2019 15:31:38 +0100 Received: from EUR02-HE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB502.ericsson.se (153.88.183.163) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Thu, 14 Feb 2019 15:31:38 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9qgO03wN4yG3zF/2COBCxzFf+qRe+6TYeh5zoq+UP8o=; b=L7NikZSOtQqWlLWbtU6RxcMnq4itseV4oP3nsvd+RdcKqhuCmc3xdIm4kQJzNcunkC9XzKyv6xPZOT8cPgZXB07QI0wgVf7LOjFxzinWYODl9DJvzjZFrLMKoDu0AUj0lvsMpn2CHx3/DhdnA6+PhhfuQj0MietSIsKC+5ui8TE= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3417.eurprd07.prod.outlook.com (10.170.247.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1622.13; Thu, 14 Feb 2019 14:31:37 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc%5]) with mapi id 15.20.1622.016; Thu, 14 Feb 2019 14:31:37 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: [Emu] WGLC for RFC5448bis Thread-Index: AQHUxHH+cMEAz5ft8E+YB3jpHTK/Jg== Date: Thu, 14 Feb 2019 14:31:37 +0000 Message-ID: <1B155AEF-C12E-4A70-9A45-76B34E4C76F5@ericsson.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.15.0.190117 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 1eb47595-9513-4f32-8c22-08d6928920cd x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3417; x-ms-traffictypediagnostic: HE1PR07MB3417: x-ms-exchange-purlcount: 4 x-microsoft-exchange-diagnostics: =?utf-8?B?MTtIRTFQUjA3TUIzNDE3OzIzOmlqS012azRkdkZPK0Fia1pvTzdlR0xKVUxj?= =?utf-8?B?QjhiYnRuY2pXdzRDZWs2amxhT0ZZVXAySTNKT2phekR3a01zMWt5Q1h5cjJz?= =?utf-8?B?UENVejVoY3RRUXZjMWd5SzZPNXhwVUN5VHZkTFJ1bHhNRC9ZNUhNQnhRUHg0?= =?utf-8?B?WUJ4UVRqUkIxVE16czNUaTV6Z2JQWVdtcDBqeUNLdVIwZEZ4THpuVmxNbUdO?= =?utf-8?B?SXFIREFwUTJvNkJIamlhZEdsOVZTU0pkYlFRYTgxTzRUcTlsTUEzMEphQ3JN?= =?utf-8?B?bXdGUEVaRjRWRWdLbTVrNFBYL1UxOXBzdWIvamZpdFB5OXhaZnpiUC9RWEtN?= =?utf-8?B?Y01ZUW41OElhcmlvc2RHQjZDUzRzRGRNdEY2UGRvNXkwdjcwVUJlQ1FCWnBJ?= =?utf-8?B?YTlEREl1d0Ztd1JUcVhBaFhCMjV0NkpWQjYzY0ljajFyOGg4NVNLaE1hTDBu?= =?utf-8?B?RHRpSm84U1VHcURkV0VRbVJvYnErSHpJMS94Y090YkI5cXpHczZwUlpwOE45?= =?utf-8?B?MXhHc2M5N0oyY0h2Y0xQUjArdEdBWUp1cDFySUZrRTdGMjdleURzaWlZTjRX?= =?utf-8?B?SlBtYmVmY0xFTTF6dW45SjFWV3FLM2ROLzJtem56d09DNTc0alNlMkI5NDlp?= =?utf-8?B?NXc2MWFxYllTd01SZ1FQeExvSXNYZ2ErWkdWSWxLSEtLYjFTWHM3YWk0K1pU?= =?utf-8?B?U1J6d0pKRnNLallQV0dlU0ttaFhad3gxMlhRek5KTUd5RThvUldBOFZ1RWhN?= =?utf-8?B?a0NJelEybXpocFB4QU02SG93bVA1aXkvcE54NnNEUHlLa0FWelFPcjF5ZUZ6?= =?utf-8?B?WCtpRnA2WTFqcmVMWHlaZ3pKQkNRSTREWm5LbTFnZ3BiRE1PSk40czAvNFJh?= =?utf-8?B?QkI5OGpzeXkxUnc5dmsxbnhCUlhSSk9WVmZPV3ZFYXlqVmRucFZJT2hnWjlr?= =?utf-8?B?OU1TaitZWmdyYmw1WWk0bkNldE44MGllUWloUWVyb0NXSExPejdBQk9wMXRi?= =?utf-8?B?MXFQNWt1RW96Q0hlOHhRNDA5NkR1VXBQQ3ZUNGV1RDVVeGJmaC9UMnhHZGVj?= =?utf-8?B?b1Rwb0lwYytxMm1FTERDRmxRakhXcStiNmt6Mm8rSjN5MFRPZk1RbmVVK2s3?= =?utf-8?B?cXEyK1E3NnlSQlNtUVNGSlRvakw4Z0tGMnkxRDlRbkk1VFBxY0hZTGZxSEJh?= =?utf-8?B?QkNxeFJDV2FzVzRMOGcreEp4Q2dpOW10Yk5RK0FBaGRDZzVzQUcyUUJrWVRn?= =?utf-8?B?Y05VdmRjYm1Uc3h4VWRtMEs5UGVXWlh2ZFIwVnc4TC9DdHNNYkd3QWZFV1B4?= =?utf-8?B?KzJ3aktUcFZWQVJ1VDJUT1d5ZmtWQVNzQlg3OGdEZmFxcjdwTG8wUWdxNXQ3?= =?utf-8?B?Ym8xQnArYkQ1WElMSm5PMHNQcERvVTZFaG5MaG54eFFaQjExNVJXamhnQTlt?= =?utf-8?B?dEpuTmRWcXA1R1Z2VFpLNXJBQmNXNzJsQXdpdWVwQnY1ZGNkd09mL0M5bkdH?= =?utf-8?B?WVRuMUFmNUx0aUpIMjRNcFdUZ3F2K2p6Y29PemRYdTV0OXp4bFRxVTlVTzMr?= =?utf-8?B?UmRrNlNMSzB0UzlsNVdrTkR6WUFoVVVMOHZQcnh3UGI3Z3lZMmtCY0dzZDQ3?= =?utf-8?B?ejltay9xa1VxT3NzRm1Xd09rYXM0RkIzYkxKaHFuSHB4L3hNam1CcmxQUWJu?= =?utf-8?B?U2tLT0dDN0NpTlA5U3ovU1F1SkVEQ3liTXdOTE1Za0lBZzkwZEdVVFd6Nm9K?= =?utf-8?B?QXNJamxidjhjMWF5UFpoUT09?= x-microsoft-antispam-prvs: x-forefront-prvs: 09480768F8 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(366004)(396003)(376002)(346002)(136003)(65554003)(189003)(199004)(99286004)(97736004)(71190400001)(71200400001)(105586002)(6506007)(6246003)(3846002)(82746002)(83716004)(2501003)(106356001)(2351001)(316002)(6116002)(36756003)(256004)(33656002)(58126008)(229853002)(5640700003)(6486002)(14454004)(53936002)(186003)(486006)(8936002)(305945005)(6436002)(7736002)(478600001)(44832011)(26005)(2616005)(66066001)(6512007)(1730700003)(8676002)(81156014)(81166006)(966005)(6916009)(6306002)(102836004)(68736007)(25786009)(86362001)(2906002)(476003); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3417; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Rz9xG138qXKre6Q1cEbS1gmdxmmOeHXrar5QQj41jJ0HudyqqKTI+qsT1Jb5HbHO34uwbrJun6xIAbRlTkVtWrHXCPXUQv/Pkw0UqLIb/ajIQbsF7O/X7tQ0NyAJkGTNIBYYbhLpBwt95Smvk3h4/MsrVXBlxN25rkxcFMAp1H/l37a2UdONy+vajueV2R1wsGhVm3Ob4d1v62QP9YCEPqdOFkULgNP0raQ+eYPmqBTT32A7xy+/Jzp3yj1UT8Tr5YVkTP1DOsfJRUmWhuzxHupcPiSTBXNa/2FhUN++gcGkaksjeR2FbZ4Jq2FG96ELST6xQmzVIYgsM+bXS0oQcX125tJ2AMgcJDe36a5B/E3mWn6sfY0kOlVrN6ECNbMHe44YzdFZlw2lwZgNB6gMS8mJ/JTHlM7ZwWDXAnoHu/Q= Content-Type: text/plain; charset="utf-8" Content-ID: <9E95CB3A3AB7094EAA81A7BB0CB6D568@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 1eb47595-9513-4f32-8c22-08d6928920cd X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Feb 2019 14:31:37.7189 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3417 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA02SbUhTYRTHe+6LXlerx+X0MDVwVJIxNbXwQ2UigdELFgShZg29qDk32zVp +kFDNFNH8yVyK1Fh5TTnW0ImS3CWYksii9RKwnyNygjSMi2b9y7o2+/8z//8ec7hYUhJCS1j 0tXZrFatVMndRJTxzAOdwpHHJoYOG7dEDrRZqUMo1mxeJuJQvGh/CqtKz2G1IQfPi9I69Z10 Vo/f5e7F21QBeudbijwYwBFw/4qFLEUiRoIfI1jobaWFYgnB5/YSJBRmAiaalnkbhQ0kdPQP umaqCLB133XZPiCw6vvJ9WQ3HAq1tgK3dfbCAfBzpJjXt+KdsGy849IDwTTTQQgcDAPj8/Q6 U3gHGOqv87oYR8HoSjHPCHvDj6ctPJPYB95M1xHCFhjMtuekwFL4OPWHz5HiEFhpdFDC7Fko KrpJC54AcPRaXH5/GKkrQwIfh6UmPX8AwOMIasvbXY0geFTY7y6wDBbGWinB9MQTykennNsw ziIDXjqSBI8fvK5ucBM80zTMthj4V0gwC43WIlfoNmjWT1IGpDD9t5DJGUXiXdDWEyLIsVDx /QshcABUl026m/i7eMKQcZqqR3QzknIsx2WmhoUHs9r0ZI7TqIPVbHYncv6Pvq4VRTe69yna jjCD5JvEL3LZRAmtzOF0mXYEDCn3Ep/QOSVxilKXy2o157SXVCxnR74MJfcRr0o8EyU4VZnN ZrBsFqv91yUYD1kBMipWk/JNkZaNMxr/sg3Rlaaqo7mTeZaEJcstwzN7F5za3JPZN7RYUQOD 8ycTvr6du9jQujuqRrN6bCLMlqye9fGIvxaj235DF1p5dW1soenIgYfEq6zAWdnaPhUcFn2r mnufzwxZ4355FxKavNJBTfgFY0zd3lTfYZU07HTEbznFpSn3BJFaTvkXr2CnfBsDAAA= Archived-At: Subject: Re: [Emu] WGLC for RFC5448bis X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Feb 2019 14:31:44 -0000 SGksDQoNCkkgaGF2ZSByZXZpZXdlZCB0aGlzIGRyYWZ0IG11bHRpcGxlIHRpbWVzLCBJIHRoaW5r IHRoaXMgZHJhZnQgaXMgdmVyeSB3ZWxsLXdyaXR0ZW4gYW5kIHJlYWR5IHRvIGJlIHB1Ymxpc2hl ZC4gQSBmZXcgbWlub3IgY29tbWVudHM6DQoNCg0KLSAiM3JkIEdlbmVyYXRpb24gQXV0aGVudGlj YXRpb24gYW5kIEtleSBBZ3JlZW1lbnQiDQoNCkkgc2VlIHRoYXQgdGhpcyBleGFjdCB0ZXJtIHdh cyB1c2VkIGluIFJGQyA1NDQ4LCBidXQgSSBmaW5kIGl0IHF1aXRlIHN0cmFuZ2UuIEkgdGhpbmsg dGhlIHRlcm1pbm9sb2d5IGlzIHdyb25nIGFzIFVNVFMgQUtBIHdhcyB0aGUgc2Vjb25kIGdlbmVy YXRpb24gQUtBIG1hZGUgZm9yIHRoZSB0aGlyZCBnZW5lcmF0aW9uIGNlbGx1bGFyIG5ldHdvcmtz Li4uLiBJIGZpbmQgIjNHIEF1dGhlbnRpY2F0aW9uIGFuZCBLZXkgQWdyZWVtZW50IChBS0EpIiwg b3IgdGhlIHRlcm1pbm9sb2d5IHVzZWQgaW4gUkZDIDQxODYgKCJUaGUgQXV0aGVudGljYXRpb24g YW5kIEtleSBBZ3JlZW1lbnQgKEFLQSkgbWVjaGFuaXNtIHVzZWQgaW4gM3JkIGdlbmVyYXRpb24g bW9iaWxlIG5ldHdvcmtzIikgdG8gYmUgbXVjaCBiZXR0ZXIuIDNHUFAgY2FsbHMgdGhlIGRpZmZl cmVudCBBS0EgbWVjaGFuaXNtczogR1NNIEFLQSwgVU1UUyBBS0EsIEVQUyBBS0EsIDVHIEFLQS4N Cg0KDQotICJFQVAtQUtBJyBpcyBjb21tb25seSBpbXBsZW1lbnRlZCBpbiBzbWFydCBwaG9uZXMg YW5kIG5ldHdvcmsgZXF1aXBtZW50LiINCg0KInNtYXJ0IHBob25lcyIgaXMgb2Z0ZW4gdXNlcyBm b3IgYSBjZXJ0YWluIGNsYXNzIG9mIHBob25lcywgSSBhc3N1bWUgRUFQLUFLQScgaXMgYWxzbyBj b21tb25seSBpbXBsZW1lbnRlZCBpbiBmZWF0dXJlIHBob25lcy4gU3VnZ2VzdGlvbjoNCg0KT0xE OiAic21hcnQgcGhvbmVzIg0KTkVXOiAibW9iaWxlIHBob25lcyINCg0KKGl0IGlzIGFsc28gY29t bW9ubHkgaW1wbGVtZW50ZWQgaW4gSW9UIGRldmljZXMgdGhhdCBhcmUgbm90IHBob25lcyBhdCBh bGwuLi4pDQoNCg0KDQotIEkgcHJldmlvdXNseSBzZW50IHRoaXMgaW4gYSBkaWZmZXJlbnQgdGhy ZWFkOg0KDQpodHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL2VtdS9mSG9wU2RM cU1ZMzdvZFBHdnduN001WmtzSXcNCg0KUmVhZGluZyBkcmFmdC1kZWtvay1lbXUtZWFwLXNlc3Np b24taWQtMDAsIEkgbm90aWNlZCB0aGF0IGRyYWZ0LWlldGYtZW11LXJmYzU0NDhiaXMgdXNlcw0K YSBkaWZmZXJlbnQgbm90YXRpb24gKGRlY2ltYWwgdnMuIGhleGFkZWNpbWFsKSB0aGFuIG90aGVy IHJlbGF0ZWQgZHJhZnRzLg0KDQogICBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQt aWV0Zi1lbXUtcmZjNTQ0OGJpcw0KDQogICAgICBTZXNzaW9uLUlkID0gNTAgfHwgUkFORCB8fCBB VVRODQogICAgICBTZXNzaW9uLUlkID0gNTAgfHwgTk9OQ0VfUyB8fCBNQUMNCg0KICAgaHR0cHM6 Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzUyNDcNCg0KICAgICAgU2Vzc2lvbi1JZCA9IDB4MTcg fHwgUkFORCB8fCBBVVRODQogICAgICBTZXNzaW9uLUlkID0gMHgxMiB8fCBSQU5EIHx8IE5PTkNF X01UDQoNCiAgIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1kZWtvay1lbXUtZWFw LXNlc3Npb24taWQNCg0KICAgICAgU2Vzc2lvbi1JZCA9IDB4MTcgfHwgUkFORCB8fCBBVVRODQog ICAgICBTZXNzaW9uLUlkID0gMHgxNyB8fCBOT05DRV9TIHx8IE1BQw0KICAgICAgU2Vzc2lvbi1J ZCA9IDB4MTIgfHwgUkFORCB8fCBOT05DRV9NVA0KDQogICBBcyBhbGwgb3RoZXIgRUFQIFJGQ3Mg SSBjYW4gZmluZCAoUkZDIDUyNDcsIFJGQyA1MjE2KSBhbHNvIHVzZSBoZXhhZGVjaW1hbCBub3Rh dGlvbiwgSSBzdWdnZXN0IHRoYXQgZHJhZnQtaWV0Zi1lbXUtcmZjNTQ0OGJpcyBpcyB1cGRhdGVk IHRvIGF2b2lkIGFueSBjb25mdXNpb24gZm9yIGltcGxlbWVudG9yczoNCg0KICAgICBPTEQ6ICJT ZXNzaW9uLUlkID0gNTAgfHwgUkFORCB8fCBBVVROIg0KICAgICBORVc6ICJTZXNzaW9uLUlkID0g MHgzMiB8fCBSQU5EIHx8IEFVVE4iDQoNCiAgICAgT0xEOiAiU2Vzc2lvbi1JZCA9IDUwIHx8IE5P TkNFX1MgfHwgTUFDIg0KICAgICBORVc6ICJTZXNzaW9uLUlkID0gMHgzMiB8fCBOT05DRV9TIHx8 IE1BQyINCg0KDQoNCi0gIltUUy0zR1BQLjM1LjIwOF0gLi4uLiAoUmVsZWFzZSAxNCkiDQoNCkEg cmVsZWFzZSAxNSB2ZXJzaW9uIG9mIFRTIDM1LjIwOCBoYXMgbm93IGJlZW4gcHVibGlzaGVkLiBN b3N0IG9mIHRoZSBvdGhlciAzR1BQIHJlZmVyZW5jZXMgYXJlIG91dC1vZi1kYXRlLiBNYXliZSBh ZGQgYW4gZWRpdG9yJ3Mgbm90ZSB0aGF0IGFsbCAzR1BQIHJlZmVyZW5jZXMgc2hvdWxkIGJlIHVw ZGF0ZWQgdG8gdGhlIGxhdGVzdCBSZWxlYXNlIDE1IHZlcnNpb24gYmVmb3JlIHB1Ymxpc2hpbmcu DQoNCg0KDQotICJBcHBlbmRpeCBHLiAgQWNrbm93bGVkZ21lbnRzIg0KDQpTaG91bGQgbm90IGJl IG51bWJlcmVkIGFjY29yZGluZyB0byBSRkMgNzMyMg0KDQpPTEQ6IDxzZWN0aW9uIHRpdGxlPSJB Y2tub3dsZWRnbWVudHMiPg0KTkVXOiA8c2VjdGlvbiB0aXRsZT0iQWNrbm93bGVkZ21lbnRzIiBu dW1iZXJlZD0iZmFsc2UiPg0KDQoNCkNoZWVycywNCkpvaG4NCg0K From nobody Thu Feb 14 16:45:20 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F0F0128B01 for ; Thu, 14 Feb 2019 16:45:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.889 X-Spam-Level: X-Spam-Status: No, score=-1.889 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_HK_NAME_DR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zCKA7ttGBJ1z for ; Thu, 14 Feb 2019 16:45:16 -0800 (PST) Received: from mail.katezarealty.com (mail.katezarealty.com [104.168.158.213]) by ietfa.amsl.com (Postfix) with ESMTP id 5B417126D00 for ; Thu, 14 Feb 2019 16:45:16 -0800 (PST) Received: from localhost (unknown [127.0.0.1]) by mail.katezarealty.com (Postfix) with ESMTP id 2509037412C2; Fri, 15 Feb 2019 00:45:16 +0000 (UTC) X-Virus-Scanned: amavisd-new at katezarealty.com Received: from mail.katezarealty.com ([127.0.0.1]) by localhost (mail.katezarealty.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id O14oYA_MlHnG; Thu, 14 Feb 2019 19:45:15 -0500 (EST) Received: from Maxs-MBP.cablelabs.com (unknown [192.160.73.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.katezarealty.com (Postfix) with ESMTPSA id 2813D3740FD2; Thu, 14 Feb 2019 19:45:15 -0500 (EST) To: Alan DeKok Cc: Mohit Sethi , EMU WG References: <894F23B3-59EA-4DE6-BC12-417C79850CC4@deployingradius.com> From: "Dr. Pala" Organization: OpenCA Labs Message-ID: <221e1f29-98c0-f232-eb25-db8ef75af16a@openca.org> Date: Thu, 14 Feb 2019 17:45:14 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.5.0 MIME-Version: 1.0 In-Reply-To: <894F23B3-59EA-4DE6-BC12-417C79850CC4@deployingradius.com> Content-Type: multipart/alternative; boundary="------------25613132F7785DAA883704C4" Content-Language: en-US Archived-At: Subject: Re: [Emu] EAP and Fragmentation X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Feb 2019 00:45:18 -0000 This is a multi-part message in MIME format. --------------25613132F7785DAA883704C4 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable Hi Alan, thanks for the answers... aligned with what I thought and they do make=20 sense... :D Further considerations inline... On 2/12/19 11:26 AM, Alan DeKok wrote: > On Feb 12, 2019, at 12:36 PM, Dr. Pala wrote: > [...] >> This, led me to my first question: is there a de-facto "standard" way = to add Fragmentation support we can just use (without having to re-invent= the wheel all the time) ? > No. Too bad... :( >> If we had such a mechanism, then we could just say "implement the mech= anism as defined in ... ". This would definitely help developers that cou= ld safely re-use code/libraries. The other approach would be to modify EA= P to add Fragmentation support there. > I suspect that it's difficult to "modify EAP". However, adding a st= andard fragmentation method would be definitely useful. I agree that (a) it would be useful and (b) it would be difficult to=20 modify EAP :D It seems to me that EAP made a too simple header... :D > [ ... ] > > If it's an EAP type that only appears inside of a TLS tunnel, then d= on't worry too much about fragmentation. > > If the data you're sending will be larger than 64K, you *will* need = to provide your own fragmentation support. But that's only because the E= AP header has a 16-bit "Length" field. > Yep, that is why the AVP/TLVs use the internal 'L' bit and the 32bits=20 length field to address that. I think that to keep the method simple, we = will require that the method is executed as an internal method of a=20 Tunneled method that provides (a) authentication of the server (and=20 optionally of the client), and (b) secrecy of the transferred data. This allows us to: * Remove the support for Fragmentation (but we need to require that the data is appropriately handled by the encapsulating method) * Do not have to implement crypto-parameters negotiation for the outer tunnel The draft will require a well-written security section to make sure that = deployments do not use the method without proper security around it. >> Looking forward to some great guidance and advice :D Also, if you woul= d like to collaborate/contribute, please let me know! > I've been known to have opinions. :) Plus, it's useful to have cre= dential provisioning methods. > =2E.. and I've been known to have ears and eyes to listen and read :D Tha= t=20 works perfectly! Thanks for the feedback! Cheers, --=20 Best Regards, Massimiliano Pala, Ph.D. OpenCA Labs Director OpenCA Logo --------------25613132F7785DAA883704C4 Content-Type: multipart/related; boundary="------------458990003855AA30D34200E4" --------------458990003855AA30D34200E4 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

Hi Alan,

thanks for the answers... aligned with what I thought and they do make sense... :D Further considerations inline...

On 2/12/19 11:26 AM, Alan DeKok wrote:
On Feb 12, 2019, at 12:36 PM, Dr. Pala <director@openca.org> wrote:
[...] 
This, led me to my first question: is there a de-facto "standard" way to add Fragmentation support we can just use (without having to re-invent the wheel all the time) ?

  No.
Too bad... :(

      

        
If we had such a mechanism, then we could just say "implement the mechanism as defined in ... ". This would definitely help developers that could safely re-use code/libraries. The other approach would be to modify EAP to add Fragmentation support there.


      

      
  I suspect that it's difficult to "modify EAP".  However, adding a standard fragmentation method would be definitely useful.


    

    
I agree that (a) it would be useful and (b) it would be difficult
      to modify EAP :D It seems to me that EAP made a too simple
      header... :D

    

    

      
[ ... ]

  If it's an EAP type that only appears inside of a TLS tunnel, then don't worry too much about fragmentation.

  If the data you're sending will be larger than 64K, you *will* need to provide your own fragmentation support.  But that's only because the EAP header has a 16-bit "Length" field.



    

    
Yep, that is why the AVP/TLVs use the internal 'L' bit and the
      32bits length field to address that. I think that to keep the
      method simple, we will require that the method is executed as an
      internal method of a Tunneled method that provides (a)
      authentication of the server (and optionally of the client), and
      (b) secrecy of the transferred data.

    
This allows us to:

    
    
      
  • Remove the support for Fragmentation (but we need to require
        that the data is appropriately handled by the encapsulating
        method)
    • 
      
  • Do not have to implement crypto-parameters negotiation for the
        outer tunnel
    • 
    

    
The draft will require a well-written security section to make
      sure that deployments do not use the method without proper
      security around it.

    

    

      

        
Looking forward to some great guidance and advice :D Also, if you would like to collaborate/contribute, please let me know!


      

      
  I've been known to have opinions.  :)  Plus, it's useful to have credential provisioning methods.



    

    
... and I've been known to have ears and eyes to listen and read
      :D That works perfectly!

    
Thanks for the feedback!

    
Cheers,

    

    
-- 

      

        Best Regards,
        

          Massimiliano Pala, Ph.D.

          OpenCA Labs Director

        

        OpenCA Logo

      

    

  


--------------458990003855AA30D34200E4
Content-Type: image/png;
 name="obebjghhlkiddhik.png"
Content-Transfer-Encoding: base64
Content-ID: 
Content-Disposition: inline;
 filename="obebjghhlkiddhik.png"

iVBORw0KGgoAAAANSUhEUgAAAGQAAAA2CAMAAAAGesyaAAADAFBMVEUsJiEAAQAKAwMABwoX
BwESCQAqDgEkEQItFQESGykaGh0WGyE1FwE9GwJHHwElJiY4JBQmKDE1KCAfLUQ8KygoMEAq
MjpXKgs/MilMMR0pOFEyOUo4OTo1OkRqMgpjOBlpNxUwQV1DPz48QExdOyM4QVV+OQRRQzo1
SGdDR0lDSFJfRDFASVyaPwF+RRpNT1I9UXlwSi8+UnNDUm6hQgCPRhBdUEZTUlBKVGlPVF27
PgCaSANtUT57VBerSQOMUgxHW4KMUiepTwmJVDh6WT6KVjGCWDpRYH21TwFiYF57YgJXYXae
VR+lVRZrYld1ZiB7YEuSYQBgZW+8VAlkZWjBVQCfXiqqXwG1WhPLVgedYDazXiDZVgCWZEDV
WQJ1blapYjbXWgDRXACMaU6WbgCiZjnIXw9mcIixZC6pZjJ/cUeLbFdycmZ4cGnnWwNwc3Wq
aS6BcGeobwndXwzkXwLgYgDaYwyMeCq/bQHJaBi9ajDMagWVegvRZxzVaAvXaQDLainqZAuv
cEPrZQDQaSyockrFbSvmZwnabQLvZwDpaQB0fpPkaxGld1d+f3/3aACfeV6RfG2JfnLebSF7
gYy2fQmugQCigxW8d0K3eEr1bQXaciTicRqKgnzNewHuchbUdzKYiDzrdwKah1erjAvOfEXl
eSq5g1qYjGikiHO2kADigwC2hmSZjIGGj6aHkJzQiwCximixim/EkAORkZGVkYrOh0rPiVL5
giTvhDKkk4LMjF23mR+zmTrhikrviDzsi0TAlHDCnwvKlGqpnJLdlF2boKy+m324nImkoZ+e
o6XKpgrloATwl1WypZPOn3zfqQjYrgLBrVDdo3nGq5mysa/SrI7dq4bqqXTOrpWttL+6s6uw
tbe/t4rhvALetpjQuqnuwwe9v8LAv7vauqD3xA68w9XBw83rvJfRwbXFyMvbxbPNyMP8zgTc
zMDr0mb91xLM1ODQ1NfS1c7p0sD70bPd19PX4qj83cje4+Xr4tv54NLp7/Hy9PHw9fj6/v3Y
ktvJAAAAAXRSTlMAQObYZgAAAAFiS0dEAIgFHUgAAAjrSURBVFjDtVcNWFPXGT6E+l9BZ0EF
sTKEIQaUAIrTZdYqxqG0I3UjIuiDM0ipoyO5l0rFh2PE472EoIJKL9hQV2OxqM+USgFL4r9g
EaIoQxgqKBZBR+nGGhXYdwNro0Kfkcp3ntzce/7e8/2e70PoJVDl3bMlZyurUSsaKnqESrMp
lYrByozCjUOEUZORodMRVsViTjJc8GbLUGCUUstLv1SyLCGch8DGRiDPe/kY5/2HCQQTxZEE
y4fb2gDI8KjjLxsjfyyc3lZgM3KixwgeY4TEzk7+kjHODbeb6u0xAhiw8XgFMOxolpP6J75U
jLZfp6dzHIcBYCQbIBB4sCxDOLK6eMAVT39it57+e09ysCnDUtnrJ0vS5ZMW0PBFWDbd40G/
85sH2KeXvj94u/flX8/2J6kYQkhkHbzWbkdH0N0UDN8sURS8uMd9dMzPL7BxIIjOayuWLBIf
70RPUPjxLouBEgVhMaYuWXQlMjwsN+eFTR4cDZ4werRDYOoAIFkrptm/Ni0gthOt9Q4yWQxc
AwyWTbacW0sTDGoJen4P002/2S7LjgV6BpY1N6OO5g5eeiZTY/P9b1FzRwfKWuk9p/72ct+N
puKpq32qLVaexOCCJB91aezt5y6zt7fXILSdJZjlVr1w0mCR66x6FL3QOXiUQ2a0k/sFlDlq
1LzUMQ4uxxycjl0LWO1bBsY6yXR3wSTJGxqLhdsJHDsS9cwF47XlvcQGQiXhRbih/HkQv4XO
cajZb6GDu7PTFEdPkVu0k4vQyd3Jc/SUwNnB+RJ/XsI9ptZDIxMly3dbLNwGnGBJF+Id3cZM
9ui8Gjq5P/TDiRCegbOFgSKRo5e7yNHV2dnPdVb0bHfHQCevNIV/rxqrX48oFQdYcpKMtYRb
juxtfqRypNACK28+j3FsqcilAD0ADuIWCt0yRa7zRNEOY2YELhW5CV2dXVKixH8BC+s8GDN9
wWKxf94zpsRiJuWmBYjgndsKFmu5Bc+D3HQXCcu7QTFTMl3HF0SLxruLvGa4zUqdMGFWqqfX
3GSxN0y6NT154i+v75zvH2thXiWgY2YVElhwYl9NYxarlr0grlQn92DQt1vBUk+nUFeHGZme
gUIvl1RXr1AnV/fx6zd4v3HptM/YaXbrzmYFePu2WpowYRlJo+2PGLb2d9WE5bw1L4DcnOco
9HIcH3o02HOecMqMJhQqdLPXpArHl2uEo+Na8qZPXxw0+bVx46bFzhw3eZylM2dgwkbWW3Iy
Jp9lMDe9H2/raiqPCy5/fHSCu+M7mkffoQuzQhvRhWVlj1FcWTfq6dwdElJmarxedr/u3P6C
Nn7Fk95ol8wRjIMsOLGJSwLm/OMGjlFHJ7hqelDuxdMlpbU16JvqlJTamivoBjrfUgNB69zf
b6Fr1TWPKmtOw9xCdLayEFWvBlaSfmEBsk6LSdTMNnQaldTe7Qfj20yveddR2toVEevCi9/f
fmntR7ErtvompmyICM9qyYpZsG3FhqwNYRH5KUtyW7eGRRxfH1OHDv0ZXH6ihbSyVYzSY3Fu
BkVR9LaS2wPxUxyTFpu2eGverr+dezvi0ttpOy/tTKlL2ZkWs6p4VV1Kyq60nevS8iLyi1tW
hfNWzMfhYT+ArAQ+5odRBENjlRW5F/vH6O7u7urpXtvR/bQbmX/dPd3w7Ok+2Ij4ry5o0N/d
Y1p7qA21FodhFRc1ctjIsXZ2Y18VcwCixNgcWlgVbUiue3b3J33te7497vv/oT1Bj5/7br1R
grYlfrReSqmwPDyK0GqOUHKWj/RwP0J0ZlmsK3o2HP+7Qt9HBr3BYH5aNL3FG/+ul8sjKcxH
dRJFGJkhfKxgmM2rUoaSg5h4GAwXJsF00dRGq+/21k2EF7o50oNswrNfsYUQKRBIZWIFh3lu
aLNe1F++bjXGyWyzZiGoYFYLx5Ys4v0R3GWRdBHNErBiSiqVRhHMyeaYrMQ4SENWCvEcfhCm
GIzpqKlm27KTSWUcAX1goBw5oATctDb33aLTYV5SWoaXP5+gyqlFdnZ23nB+plcnREv0RWJC
BVkrrBJ1BewMmlVpgRUQF7wpItMJTcsJ34GBRVaFdQZaqoqxFmSb3qDQgu1A2GI4YAnODkQY
IOhklDKzo2C1IV2sijzdhjorqwefNdL6ihxzegU7SynexHgBMXy+xWFG8qvdf91D8WpRi41q
KFl02YaswYNkULTeLC9CFFK4bDHDMmZbhnuXSOdAsnN1LxgfVu7ZvG8LpSJUlO/gnaWQFwYv
JpZeKdUaSC8ApuhIShYQYp5yWQ0oPgVXPtkcHz/fx5rqqzosHSSlBYHIxKSolJcUsIIpnzkh
mt4b7Z/tOzBRQWaA6uNCNdet0nxLkL8CgzeQKIlCXaHjXR9MlqQn9Y1fNd5RE0zF/ryKwVR/
JMnsI3S8Umcw6NRYxRuUKqk3lfnKeGcTySAx5hy+7WfgZOv4uLLl0w8wUah71QLBpJeXq/eM
VVivV8jz6lB2ofWF6i1dEYRZfMJ4piE+ZweNeb7A2VVyKEx6vjt1z/ghMehVKiUpyt1VYBXC
N6j0Q4Mazp7TvvndhIaGhqqvP1bwFk0YRYR5RoLR+PkWmlIpV/oEDQ6jB9Wc3Z6bm6zLTtLl
gLC4LVWXz5Q1ffbV5oZ24wmsV/NeKTlirmg+u/q7w7/38PDdeKF8UBgXs2kV4WUC0YR/KOLv
Pby3L5O30yvG9vY/6vX8JSbb2je96coXX5QPznqfokKKEPWBAwd20ApaTWsP7LnTfsd42at3
+B+H7+zRUfwZZMutN6baHCX5+Ou9Zy4f3nuiKr7KaHxoNDbsSwhp6htvfyg3Zw901G+ttVlT
Ja34/E+fvrXmvY3713xy6tSZfadOJby7X1P/vwn/MeaYr0mF7IMEq690Gu95KwQq5L5K+f59
qGUtaZMSciHMKjdVbY6zFqRC/pv3LgxY5tcW0pjIpGGJ7+89kxBnbXZSmjuz7CeyihyG8fbd
XXYdrWlqQg+sZWTdzPqBB68VEdnkzDY0lHSjSD9/GRpaMt3OWqLpQENOTf/PpP8CK9ZVVe2a
8XoAAAAASUVORK5CYII=
--------------458990003855AA30D34200E4--

--------------25613132F7785DAA883704C4--


From nobody Sun Feb 17 22:49:21 2019
Return-Path: 
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67C9C130EDF for ; Sun, 17 Feb 2019 22:49:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level: 
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MKbm-EALMJ04 for ; Sun, 17 Feb 2019 22:49:18 -0800 (PST)
Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 1848E1276D0 for ; Sun, 17 Feb 2019 22:49:17 -0800 (PST)
Received: from [192.168.2.10] (unknown [47.52.111.246]) by mail.networkradius.com (Postfix) with ESMTPSA id D598833E for ; Mon, 18 Feb 2019 06:49:14 +0000 (UTC)
From: Arran Cudbard-Bell 
Content-Type: multipart/signed; boundary="Apple-Mail=_99E5A9C4-9E6E-44DD-AA32-0C60E0DCEF6E"; protocol="application/pgp-signature"; micalg=pgp-sha256
Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\))
Date: Mon, 18 Feb 2019 14:49:09 +0800
References:  <63B02DB3-38D7-441C-8149-592FB1B171A6@deployingradius.com>
To: "emu@ietf.org" 
In-Reply-To: <63B02DB3-38D7-441C-8149-592FB1B171A6@deployingradius.com>
Message-Id: <8B3FB763-F053-4334-87CD-2C489BBD75ED@freeradius.org>
X-Mailer: Apple Mail (2.3445.102.3)
Archived-At: 
Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Mon, 18 Feb 2019 06:49:20 -0000

--Apple-Mail=_99E5A9C4-9E6E-44DD-AA32-0C60E0DCEF6E
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_934A97A5-815C-429B-AFB2-EDAD96BEE826"


--Apple-Mail=_934A97A5-815C-429B-AFB2-EDAD96BEE826
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii



> On Feb 9, 2019, at 1:17 AM, Alan DeKok  =
wrote:
>=20
> On Feb 8, 2019, at 7:21 AM, John Mattsson  =
wrote:
>> (Everything below is from a pure EAP-TLS (0x0d) perspective without =
considering any cross-method things)
>>=20
>> - =46rom an EAP-TLS perspective, I think these two cases ("not =
authenticated" and "authenticate via some other means") are the same, =
the peer is not authenticated as far as EAP-TLS is concerned. I read the =
sentence "other means" as outside of TLS.
>>=20
>> - RFC 5216 allows deployments with only server authentication:
>>=20
>> RFC 5216: "While the EAP server SHOULD require peer authentication, =
this is not mandatory, since there are circumstances in which peer =
authentication will not be needed (e.g., emergency services, as =
described in [UNAUTH]), or where the peer will authenticate via some =
other means."
>>=20
>> I don't know if there exists EAP-TLS (0x0d) deployments where the =
"peer authentication will not be needed" or "peer will authenticate via =
some other means", but if they do exist, we should probably not forbid =
them to do resumption unless we have good reasons.
>=20
>  I agree.
>=20
>  I can't think of any deployment which allows unauthenticated EAP-TLS. =
 Or authenticated only via the NAI.

HS 2.0 Release 2 section 7.7 (Anonymous EAP-TLS)

This specification defines a WFA Vendor specific EAP method, WFA =
Anonymous EAP-TLS, which can be used for OSU access. WFA Anonymous =
EAP-TLS is a profile of EAP-TLS (specified in [25]), in which the =
supplicant authenticates the AS, but the AS does not authenticate the =
client. WFA Anonymous EAP-TLS shall only be used for the OSU ESS; it =
shall not be used for the production ESS (see section 5.4.2)

It's used to allow access to the OSU (Online Sign Up) network to allow =
initial provisioning.

Yes, if the same AS server were used for both OSU ESS and production ESS =
a user could theoretically leverage cross-method resumption to gain =
access to the production ESS.  Arguably, the same issue could occur with =
any two SSIDs using the same AS irrespective of whether the EAP method =
was the same or not. This isn't a fundamental issue with cross-method =
resumption or session resumption in general, but a lack of appropriate =
binding between session tickets and the context in which they're being =
used.

Regarding anonymous outer identities and re-authorization, the =
real-world solution I've seen and implemented, is to associate the =
session ticket ID with the user's NAI using a datastore when using =
stateful tickets, or to include the user's NAI in the opaque data =
portion of sateless tickets.  Similar methods could be used to prevent =
cross-method resumption if local policies require it.

-Arran

--Apple-Mail=_934A97A5-815C-429B-AFB2-EDAD96BEE826
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=us-ascii



On Feb 9, 2019, at 1:17 =
AM, Alan DeKok <aland@deployingradius.com> wrote:

On Feb 8, 2019, at 7:21 AM, John Mattsson <john.mattsson@ericsson.com> wrote:
(Everything below is =
from a pure EAP-TLS (0x0d) perspective without considering any =
cross-method things)

- =46rom an EAP-TLS =
perspective, I think these two cases ("not authenticated" and =
"authenticate via some other means") are the same, the peer is not =
authenticated as far as EAP-TLS is concerned. I read the sentence =
"other means" as outside of TLS.

- RFC 5216 =
allows deployments with only server authentication:

RFC 5216: "While the EAP server SHOULD require peer =
authentication, this is not mandatory, since there are circumstances in =
which peer authentication will not be needed (e.g., emergency services, =
as described in [UNAUTH]), or where the peer will authenticate via =
some other means."

I don't know if there =
exists EAP-TLS (0x0d) deployments where the "peer authentication will =
not be needed" or "peer will authenticate via some other means", but if =
they do exist, we should probably not forbid them to do resumption =
unless we have good reasons.

 I agree.

 I can't =
think of any deployment which allows unauthenticated EAP-TLS.  Or =
authenticated only via the NAI.

HS 2.0 Release 2 section =
7.7 (Anonymous EAP-TLS)

This specification defines a =
WFA Vendor specific EAP method, WFA Anonymous EAP-TLS, which can be =
used for OSU access. WFA Anonymous EAP-TLS is a profile of =
EAP-TLS (specified in [25]), in which the supplicant =
authenticates the AS, but the AS does not authenticate the client. =
WFA Anonymous EAP-TLS shall only be used for the OSU ESS; it shall not =
be used for the production ESS (see section =
5.4.2)

It's used to =
allow access to the OSU (Online Sign Up) network to allow initial =
provisioning.

Yes, if the same AS server were used for both OSU ESS and =
production ESS a user could theoretically leverage cross-method =
resumption to gain access to the production ESS.  Arguably, the =
same issue could occur with any two SSIDs using the same AS irrespective =
of whether the EAP method was the same or not. This isn't a fundamental =
issue with cross-method resumption or session resumption in general, but =
a lack of appropriate binding between session tickets and the context in =
which they're being used.

Regarding anonymous outer identities and re-authorization, =
the real-world solution I've seen and implemented, is to associate the =
session ticket ID with the user's NAI using a datastore when using =
stateful tickets, or to include the user's NAI in the opaque data =
portion of sateless tickets.  Similar methods could be used to =
prevent cross-method resumption if local policies require it.

-Arran
=

--Apple-Mail=_934A97A5-815C-429B-AFB2-EDAD96BEE826--

--Apple-Mail=_99E5A9C4-9E6E-44DD-AA32-0C60E0DCEF6E
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE6VbEmJeQrF8361hu/6TVgp+218oFAlxqVWYACgkQ/6TVgp+2
18pEjxAAkT12wCleKsz/u/Ikaa1ctH0ol3a8cqnP2n6BTbMxgInAtVio872Dq619
79COutBEmv8BrxDsN2wYVOqMGiPhRU1f9oLH92rBCtOvvrvMlIs6kI9vg5B22/6V
xuRnEF+0i/Y920aFuY0sbCj17WEjKpv9kwwvw8bWvfVZst9Qwad9ZSwZY6+hpaj8
twhF8QQG53sFw555iI8vxlztQ0rN3rLEcxWpsE5LfOKybxCEuTgeSD4M4TGyLS5R
NdzJ3oWwEtonNKuGAOFtGHMf0qNkOUSKXlWvpgPlCKG9CSJzbxTov3wKNzmRupqD
XJ31sCPttP6LAY3zzKsyddfaL2A8M0BSEaQOjad4eG4mDoT67gPBucURqHdjJVvE
D17iOFloubXRHqNwP1zX5YntouCEp0uYCAlCYFq1nmVISvguNNAVxHs1xKQhJbeu
GN1A+Nkdm1n4lLVp91ffIO7Q6+/7nfdIGYa7686FlZgRemXhsWijUu390SZ9SAhs
5goBDRTfiK3jaDN0T8CRL03gUgIRLgKoYtc/cvlOigK2lcnqa8HCsd0y9I4jA8o2
QtmfgNxim3ETeW6MsqLjSLQ1huiNvJrll96uuemF6djYJuQbu/1yN3av2UTtQpJy
PvJc7oIXnyX6AAdr5cvZtxc2tN+jbft+ObFjd2G1Kkx8OKMp/Pk=
=DzOW
-----END PGP SIGNATURE-----

--Apple-Mail=_99E5A9C4-9E6E-44DD-AA32-0C60E0DCEF6E--


From nobody Mon Feb 18 07:38:29 2019
Return-Path: 
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F0CC8130DEA for ; Mon, 18 Feb 2019 07:38:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gZS1iYiM1ZDL for ; Mon, 18 Feb 2019 07:38:25 -0800 (PST)
Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 6FBD01277CC for ; Mon, 18 Feb 2019 07:38:25 -0800 (PST)
Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id D43302F4 for ; Mon, 18 Feb 2019 15:38:22 +0000 (UTC)
From: Alan DeKok 
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\))
Date: Mon, 18 Feb 2019 10:38:21 -0500
References:  <63B02DB3-38D7-441C-8149-592FB1B171A6@deployingradius.com> <8B3FB763-F053-4334-87CD-2C489BBD75ED@freeradius.org>
To: EMU WG 
In-Reply-To: <8B3FB763-F053-4334-87CD-2C489BBD75ED@freeradius.org>
Message-Id: <15D768D7-AA9B-47E2-9AED-BCD70E1EC0B3@deployingradius.com>
X-Mailer: Apple Mail (2.3445.100.39)
Archived-At: 
Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Mon, 18 Feb 2019 15:38:28 -0000

On Feb 18, 2019, at 1:49 AM, Arran Cudbard-Bell =
 wrote:
>>  I can't think of any deployment which allows unauthenticated =
EAP-TLS.  Or authenticated only via the NAI.
>=20
> HS 2.0 Release 2 section 7.7 (Anonymous EAP-TLS)

  Ah... I had forgotten about that.

> Regarding anonymous outer identities and re-authorization, the =
real-world solution I've seen and implemented, is to associate the =
session ticket ID with the user's NAI using a datastore when using =
stateful tickets, or to include the user's NAI in the opaque data =
portion of sateless tickets.  Similar methods could be used to prevent =
cross-method resumption if local policies require it.

  The issue with session resumption is much larger than just the EAP =
method.  This subject should ideally be discussed in the "Security =
Considerations" section of the new EAP-TLS draft.

  i.e. We should define precisely what a "session" is.

  Right now, the draft talks about "session resumption", without clearly =
defining it.  The *implicit* definition is a TLS session.  But the issue =
of resuming with different EAP methods shows there's more to it than =
that.

  The following is a short list of "session identification" fields which =
could change from session to session.  Some of these are EAP specific, =
others are in the encapsulating AAA protocol:

* outer NAI=20
    e.g. auth with "@example.org", resume with "@example.com", or even =
"@sales.example.org".  Is that OK?  If so, why?  If not, why not

* SSID
   e.g. auth with "eduroam", resume with "harvardU".

* MAC address
  is swapping MAC addresses OK?  The protocols actually don't forbid it =
right now..

* switch / AP IP address
  auth with wired, "resume" with Wifi?

* switch port
  auth at your desk with personal credentials, and then "resume" on the =
printers port.  Hey, you're a printer!


  It goes on.  The EAP-TLS draft should discuss these issues.  Which =
attributes can change across auth/resumption?  Should they be allowed to =
change?  Which attributes should be checked by the authentication =
server?

  The issue is made worse by site-dependent policies.  If certain =
policies are applied to the initial authentication, I would hope that =
the same policies are applied to the resumption.  The alternative could =
be bad.

  i.e. if we have a "secure" SSID and an "open" one, where both use =
EAP-TLS.  One SSID only allows "secure" users, and the other SSID allows =
anyone with a valid certificate.

  In theory, a user can authenticate against the "open" SSID, and then =
resume against the "secure" SSID.  If the authentication server allows =
resumed sessions, then the security policy can be bypassed.  In large =
part, because the session resumption can use an anonymous NAI, and does =
not include anything identifying the user.

  i.e. "@example.com" is resuming a session on the "secure" SSID.  Is it =
OK?

  There's really only one way around these issues.  The authentication =
server should check which policy was *originally* applied to the user.  =
And then refuse to apply a *different* policy for the session =
resumption.  This can be done by caching user identity, policy, and =
anything else that is relevant.

  The draft doesn't say much about these topics, which I think should be =
addressed.  The issue of "auth with TTLS and resume with TLS" is just a =
tiny part of the iceberg.

  Alan DeKok.


From nobody Wed Feb 20 05:54:07 2019
Return-Path: 
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5992512D7F8 for ; Wed, 20 Feb 2019 05:54:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.302
X-Spam-Level: 
X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=WD/oiHMP; dkim=pass (1024-bit key) header.d=ericsson.com header.b=fDZisyxN
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4VH6Du74oniD for ; Wed, 20 Feb 2019 05:54:03 -0800 (PST)
Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7AE541286E7 for ; Wed, 20 Feb 2019 05:54:03 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed;  q=dns/txt; i=@ericsson.com; t=1550670841; x=1553262841; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=336S96dizyePALrqUFMi8efBWprPiNHRbRKjWoVgCR8=; b=WD/oiHMPOKexc9NbPMwXt4QBGarzmZuir10Jpov+Fl7wd/OvjruJ4rOU5frVnIQt KNDQT9eRnVyrhyTetv9FwarwK0iP9lWzCNLDPUfCP/XYipx0feYtMpN60w+p/z1Y sacQ56VPQ3x4ElEW/dptmCJmdXpCfTlpDTgB8way8Fo=;
X-AuditID: c1b4fb3a-5c9c29e00000672c-3d-5c6d5bf92b9d
Received: from ESESSMB501.ericsson.se (Unknown_Domain [153.88.183.119]) by sessmg22.ericsson.net (Symantec Mail Security) with SMTP id 77.AC.26412.9FB5D6C5; Wed, 20 Feb 2019 14:54:01 +0100 (CET)
Received: from ESESBMB501.ericsson.se (153.88.183.168) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Wed, 20 Feb 2019 14:53:58 +0100
Received: from EUR01-HE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB501.ericsson.se (153.88.183.168) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Wed, 20 Feb 2019 14:53:58 +0100
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=336S96dizyePALrqUFMi8efBWprPiNHRbRKjWoVgCR8=; b=fDZisyxN4LQBLXiIvuL7QyIcE+/6COxW1Et8epraCKdaeChpKJYHZdEGhhoyTotlnYYSEyIlUL2CLEHOX28F9yJ5HpDkjbk0s9MIq1fAD6cQwzY62zBErlbIZiPMFKo+exBz5w2ZNabjXl5RGC6eEum8apj7duIlGb5ssZimw5I=
Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3113.eurprd07.prod.outlook.com (10.170.245.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1643.11; Wed, 20 Feb 2019 13:53:56 +0000
Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc%5]) with mapi id 15.20.1643.012; Wed, 20 Feb 2019 13:53:55 +0000
From: John Mattsson 
To: "emu@ietf.org" 
Thread-Topic: [Emu] Notes on session resumption with TLS-based EAP methods
Thread-Index: AQHUySO4M6EmbAPhZUuIm9Qen3Jnrg==
Date: Wed, 20 Feb 2019 13:53:55 +0000
Message-ID: 
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
user-agent: Microsoft-MacOutlook/10.16.0.190211
x-originating-ip: [192.176.1.92]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 3b66a00a-2971-4ef9-8403-08d6973adb1f
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600110)(711020)(4605104)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3113; 
x-ms-traffictypediagnostic: HE1PR07MB3113:
x-microsoft-exchange-diagnostics: =?utf-8?B?MTtIRTFQUjA3TUIzMTEzOzIzOlRDVHRPVzRZUlVwVk5lcG9LOTB4UTRiblhV?= =?utf-8?B?Qnh5Y3lWczNKTlovMmdnYkhOckx1SkhWTit3NCtiYTRXR05IaFpBQyt1a2cw?= =?utf-8?B?Wm56MGRMKzBVTklPa3ZKQ1BvWjlENGhzbjhRdnBxa3JmNGh1VVdHM2hBbnoz?= =?utf-8?B?b2lWZEZpeFl5RU5yM1NFdnN2cnl3RHYwMnJvc0o4RFhxbDJBZmFPY2FqcXBG?= =?utf-8?B?WG91REg2L08yckFIUkU5cjJmUC8xYVdBY1FjcW9XdVdaLzRoWG5yN2F0dm9a?= =?utf-8?B?V3JUOTd0V3ZYQkxRTjNzc0pscldTUWNoZ3lZdU1QL01vWVlyMTFlZ3JzR2hl?= =?utf-8?B?NFNpbXdSL0podk1xQTVRQmI3L2Z2RlJobjkyYTlacXg0czQvWDlpeEZ2Z3Mv?= =?utf-8?B?MS9oekZKMzFOQmxvdklVRzFWR0xyTkFOTFVXV1hpZ3hTeHllQlp3N1BvdzZE?= =?utf-8?B?QkFTYlFTYXZwOTE3WVZkOWg4NVhOZTdBUmJ0RVdleS9sSTdpNzdQRE91bWRE?= =?utf-8?B?WlJ2K0NoVGpxbWdBNEs3eXhIZmFmVEFjOFFNb0VKWnVyWFZ0TnU1ZXBpanli?= =?utf-8?B?TWNXdEFkR1lTcm9hc3E0d2dlM1dxYnVnQ1dONm1ySUUxYzRGMzFlMnFQOUht?= =?utf-8?B?cFNNVEdLczFWNGhwcGJrZTZmK1RCWFoyOFh2RngwTEkvMitrQ0ozR3U0eVQ2?= =?utf-8?B?bWtPZ1RlRko1TWNxcW5XWFk1YXRTOFpNeXYwcTlXVm5pQVhyRHFFdzJqMHlG?= =?utf-8?B?MEJGNkxNWkFCUUt0eXl4S1FjcmROcjNTZkFnZHN4U3dnQ2x5TWpyb3VSNVRI?= =?utf-8?B?cjh6SzIveXdCNjYxMkRlcnBmdGt0amlyV1ZBS3o1QTB6MFJHR0tnN3hSamRp?= =?utf-8?B?aS80bC9ONUhqV3lRUHZKOUNiWSs3ZDVQcnZBYWxCMUdhWElGcWVqMEdWR1FM?= =?utf-8?B?eEtONTJoZk0wYjlWQ09na0pQTzFKRWhZTzdxQzd3M0kxSXdkTUxGK280WGFk?= =?utf-8?B?MEpMT0E2N0NnWGFCdnZHeE4xSmlpcnRUb1pVM3RZdmVCWCthL05McVRKcW52?= =?utf-8?B?S1FBaThMNEFEN2ZZZmNYNUoreFNOWGsyYVp6M2ZvdCtYZXhYYXNBcWZCa1py?= =?utf-8?B?WTdYQ1NYR2JpZUU4MHEwNlEwTlhobTB3cnJubjVibUxNYlA4UHRzVE9xTldj?= =?utf-8?B?Qk56dkFsZU5qRFRUVm04OGJ2RFBnMlQwZm5ybkNoVHRnSlpYR0tGSnA1bXFW?= =?utf-8?B?bWNLczZ6YW4rOG4wYnRJS2tmbE93elZ2WE5KSzhncGFXanZRNlBEcmFCTWd2?= =?utf-8?B?YlFiUEY0dG1jRXQ2aDBhYmI4VU40TUIxRC9DRUs4a2M1ZytSNGYzNi9LZFl2?= =?utf-8?B?dU13L3QrcGR1alRydWd6TU5GYjF6eGVESjR1NWg2VnJHcDhCejFrekgwK0pP?= =?utf-8?B?YnhtZnpnQU1VdUtsQ0ZnSFVjMU5hODdtYkxoVzlGRzQxYTM5L3RBVVJKbkRR?= =?utf-8?B?NCsvK2kyLys5ZlAzSGozYWJUNzc4aG52YkV2c3JaRXBORk1laUpUSnNHM2tZ?= =?utf-8?B?T1RFOWZoMHFyZWNhTm03dEJQVWtUM01nVGxQeXpWeEsrY01IbnBEWkhpTzQy?= =?utf-8?B?NzRJZkowVlhpVmhQQ3RhVTR6eW1haHV0QXgxV0FFMWhrVlMrZ2M2d1JkREVX?= =?utf-8?B?aG43WGk0SnJoMkVldURBbEd3NXlRTDBlZzV5Y21FbFYzR1RCK1hVWDNSdW5X?= =?utf-8?Q?sMoVU96SQdbYG5Y0bEIQdM0NNjDKB9dih93hI=3D?=
x-microsoft-antispam-prvs: 
x-forefront-prvs: 0954EE4910
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(346002)(366004)(136003)(396003)(376002)(199004)(189003)(486006)(6512007)(44832011)(58126008)(478600001)(5640700003)(3846002)(1730700003)(66066001)(6246003)(316002)(99286004)(25786009)(6116002)(26005)(102836004)(186003)(81156014)(81166006)(6506007)(8936002)(33656002)(105586002)(6486002)(2616005)(106356001)(53936002)(8676002)(476003)(6436002)(2351001)(6346003)(6916009)(83716004)(97736004)(14454004)(2906002)(86362001)(229853002)(71200400001)(71190400001)(36756003)(5660300002)(14444005)(2501003)(68736007)(82746002)(256004)(7736002)(305945005); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3113; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; 
received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; 
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: iETLmMS3aAhnI4anWSXjUYqzOVWqmTp6Xex+qNaiif43+UEiuhClRZWBws91Ky9cEqKOworC6ENt7yB5rD2EG/UPMrdqME6o5iNPjvKoqxYXE5I2kQ2FAV3otudzcuKa7VBMn0zDq8YnTq+un7jeTCRxFYYf1R1hWf9S/7Sk+wpJzkGaW9v2TB1xr/RuZeNHNfJc2RQcTXqgRSUlhTHYDnOmr0wCDgeRcl1MDtvePPTT5E1PpTvVU9CXKL2byfGwoyuxoaJSRSuw7/+pUJ/uru9xypuhZ3zg/nkxl0I4qCYcr+F9CHfiFQwlaQtoQH/gXmPMrf8IQOwSgzdRN7I92c3DYC+kXJQcRbMhHIzPCzqEWgUVAqtufKLuNY3qDSMeeLb0DNAx3glOfm0tj29ttmvZrQ1dO5xAf9ygj7Oq6N4=
Content-Type: text/plain; charset="utf-8"
Content-ID: <8DF7437883C9D1479310571D6AEF38F5@eurprd07.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 3b66a00a-2971-4ef9-8403-08d6973adb1f
X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Feb 2019 13:53:55.8205 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3113
X-OriginatorOrg: ericsson.com
X-Brightmail-Tracker: H4sIAAAAAAAAA02SbUhTURzGObt38zocHufMP9qbC43Epq7QiMj8UGjQy4c+SM505UWH25R7 daZ+WaRmU1FTEUWxYOULWxNTNFN0S41EMAyLpMCXUfkCIZLOfKFt9wZ9+z3P8z8P5384FCGt EIZQGn0+zejVWrlITDanDBSe3knVqWI+bsecm7RZyUsoyWzeEdxEt8UXMmmtxkAz0RczxNlD I73CvGnZfVfXI2REFTIT8qUAnwX7407ShMSUFI8jKO3oJjixheDrAxOfmAXQM/IOeQSJawmw 7R3wY/UCaK7ZQpxYQtDzZh95mkU4BtqGjSIPy3AYuGbLCQ8H4mTo757m/avQOrVBcqyAl2PP vDMkDoft/U9eX4ITYOPVW4GHET4E21MWLxM4GOad7QJuCwzm4RmC4yBYWT4QejgIR4PNaeFn jsPe7JKI4yMw216JOL4GY8/LvXsC/oKgpmpCyAWRMDc4xgdzAWAqreeDHKgyr7hbKTcfhoU2 JWf/FMKQscTDUkxDh7UMcZdOg7KyJv7oUeiuXuQ7Zwh4ONcprEVRLf8t1OKuJfApsA1Fc3YS tHX1kByHQUPlok+L910C4H2zk3yKhN0oiKVZVpelVCpoRnOPZXP1Cj2d34vc/8Pet3t+ENl/ JDoQppDcTzJ/Q6eSCtUGtkjnQEARcpnEmeK2JJnqomKayU1nCrQ060ChFCkPluxJA1RSnKXO p3NoOo9m/qUCyjfEiPKKX0fIAmNdd10ftP2jyQkD45N3NHXVZ1pfGBzqiO/rCsv1NWWnYSFB gMtL0pfDGzfXT86v/UoaWLcrczY/f1tNLsiM+tMXX8eMhu6arWmplw1NJzLimajVjCvmiSda R6vV4uP08Y+L+32rsTCRTFb5Vehzw23N1mNBDc5xfznJZqtjIwmGVf8FDe+cbhsDAAA=
Archived-At: 
Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Wed, 20 Feb 2019 13:54:05 -0000

QWxhbiBEZUtvayA8YWxhbmRAZGVwbG95aW5ncmFkaXVzLmNvbT47IHdyb3RlOg0KDQo+VGhlIGlz
c3VlIHdpdGggc2Vzc2lvbiByZXN1bXB0aW9uIGlzIG11Y2ggbGFyZ2VyIHRoYW4ganVzdCB0aGUg
RUFQIG1ldGhvZC4gIFRoaXMgc3ViamVjdCBzaG91bGQgaWRlYWxseSBiZSBkaXNjdXNzZWQgaW4g
dGhlICJTZWN1cml0eSBDb25zaWRlcmF0aW9ucyIgc2VjdGlvbiBvZiB0aGUgbmV3IEVBUC1UTFMg
ZHJhZnQuDQoNCkkgYWdyZWUNCg0KPmkuZS4gV2Ugc2hvdWxkIGRlZmluZSBwcmVjaXNlbHkgd2hh
dCBhICJzZXNzaW9uIiBpcy4NCj4NCj5SaWdodCBub3csIHRoZSBkcmFmdCB0YWxrcyBhYm91dCAi
c2Vzc2lvbiByZXN1bXB0aW9uIiwgd2l0aG91dCBjbGVhcmx5IGRlZmluaW5nIGl0LiAgVGhlICpp
bXBsaWNpdCogZGVmaW5pdGlvbiBpcyBhIFRMUyBzZXNzaW9uLiAgQnV0IHRoZSBpc3N1ZSBvZiBy
ZXN1bWluZyB3aXRoIGRpZmZlcmVudCBFQVAgbWV0aG9kcyBzaG93cyB0aGVyZSdzIG1vcmUgdG8g
aXQgdGhhbiB0aGF0Lg0KDQpkcmFmdC1pZXRmLWVtdS1lYXAtdGxzMTMgaXMgYWN0dWFsbHkgdmVy
eSBjYXJlZnVsIHRvIG5vdCB0YWxrIGFib3V0ICJzZXNzaW9uIHJlc3VwdGlvbiIsIGl0IHRhbGtz
IGFib3V0ICJyZXN1bXB0aW9uIi4gVGhlIHJlYXNvbiBpcyB0aGF0ICJzZXNzaW9uIiBpcyBub3Qg
d2VsbCBkZWZpbmVkIGFuZCBwcm9iYWJseSBub3QgdGhlIHNhbWUgaW4gVExTIGFuZCBFQVAuIElu
IFRMUyAxLjIgb3IgZWFybGllciwgInNlc3Npb24gcmVzdW1wdGlvbiIgY2xlYXJseSByZXN1bWVk
IGEgc2Vzc2lvbi4gVExTIDEuMyBwYXJ0bHkgdXNlcyAic2Vzc2lvbiByZXN1bXB0aW9uIiBhcyBz
b21ldGhpbmcgZGVwcmFjYXRlZDoNCg0KICAgIlNlc3Npb24gcmVzdW1wdGlvbiB3aXRoIGFuZCB3
aXRob3V0IHNlcnZlci1zaWRlIHN0YXRlIGFzIHdlbGwgYXMgdGhlIFBTSy1iYXNlZCBjaXBoZXIg
c3VpdGVzIG9mIGVhcmxpZXIgVExTIHZlcnNpb25zIGhhdmUgYmVlbiByZXBsYWNlZCBieSBhIHNp
bmdsZSBuZXcgUFNLIGV4Y2hhbmdlLiINCg0KQXMgd2VsbCBhcyBzbGFuZyBmb3IgdGhlIG5ldyBy
ZXN1bXB0aW9uIG1lY2hhbmlzbToNCg0KICAgIkFsdGhvdWdoIFRMUyBQU0tzIGNhbiBiZSBlc3Rh
Ymxpc2hlZCBvdXQgb2YgYmFuZCwgUFNLcyBjYW4gYWxzbyBiZSBlc3RhYmxpc2hlZCBpbiBhIHBy
ZXZpb3VzIGNvbm5lY3Rpb24gYW5kIHRoZW4gdXNlZCB0byBlc3RhYmxpc2ggYSBuZXcgY29ubmVj
dGlvbiAoInNlc3Npb24gcmVzdW1wdGlvbiIgb3IgInJlc3VtaW5nIiB3aXRoIGEgUFNLKS4iDQoN
CkFuZCBhY2NvcmRpbmcgdG8gUkZDIDg0NDYsIHJlc3VtcHRpb24gaW4gVExTIDEuMyBjcmVhdGVz
IGEgbmV3IHNlc3Npb24NCg0KICAgIlRoZSBQU0sgYmluZGVyIHZhbHVlIGZvcm1zIGEgYmluZGlu
ZyBiZXR3ZWVuIGEgUFNLIGFuZCB0aGUgY3VycmVudCBoYW5kc2hha2UsIGFzIHdlbGwgYXMgYmV0
d2VlbiB0aGUgc2Vzc2lvbiB3aGVyZSB0aGUgUFNLIHdhcyBlc3RhYmxpc2hlZCBhbmQgdGhlIGN1
cnJlbnQgc2Vzc2lvbiINCg0KICAgIk5ld1Nlc3Npb25UaWNrZXQiDQoNCk15IHVuZGVyc3RhbmRp
bmcgaXMgdGhhdA0KDQogICAtIHNlc3Npb24gcmVzdW1wdGlvbiB3aXRoIEVBUC1UTFMgMS4yIHdv
dWxkIHJlc3VtZSB0aGUgc2FtZSBUTFMgc2Vzc2lvbiAoc2FtZSBUTFMgU2Vzc2lvbklEKSBidXQg
Y3JlYXRlIGEgbmV3IEVBUCBzZXNzaW9uIChkaWZmZXJlbnQgRUFQIFNlc3Npb24tSWQpLg0KDQog
ICAtIHJlc3VtcHRpb24gd2l0aCBFQVAtVExTIDEuMyB3b3VsZCBjcmVhdGUgYSBuZXcgVExTIHNl
c3Npb24gKFNlc3Npb25JRCBpcyBkZXByYWNhdGVkKSBhbmQgY3JlYXRlIGEgbmV3IEVBUCBzZXNz
aW9uIChkaWZmZXJlbnQgRUFQIFNlc3Npb24tSWQpDQoNCi9Kb2huDQoNCg==


From nobody Wed Feb 20 06:03:14 2019
Return-Path: 
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 721F512E036 for ; Wed, 20 Feb 2019 06:03:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TP9_hRBF9pSi for ; Wed, 20 Feb 2019 06:03:10 -0800 (PST)
Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id C6E061286E7 for ; Wed, 20 Feb 2019 06:03:09 -0800 (PST)
Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 9AC234A2; Wed, 20 Feb 2019 14:03:08 +0000 (UTC)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\))
From: Alan DeKok 
In-Reply-To: 
Date: Wed, 20 Feb 2019 09:03:07 -0500
Cc: "emu@ietf.org" 
Content-Transfer-Encoding: quoted-printable
Message-Id: <15A9502F-27BA-42B5-93E0-9396AB653D8B@deployingradius.com>
References: 
To: John Mattsson 
X-Mailer: Apple Mail (2.3445.102.3)
Archived-At: 
Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Wed, 20 Feb 2019 14:03:13 -0000

> On Feb 20, 2019, at 8:53 AM, John Mattsson =
 wrote:
> draft-ietf-emu-eap-tls13 is actually very careful to not talk about =
"session resuption", it talks about "resumption". The reason is that =
"session" is not well defined and probably not the same in TLS and EAP. =
In TLS 1.2 or earlier, "session resumption" clearly resumed a session. =
TLS 1.3 partly uses "session resumption" as something depracated:
>=20
>   "Session resumption with and without server-side state as well as =
the PSK-based cipher suites of earlier TLS versions have been replaced =
by a single new PSK exchange."
>=20
> As well as slang for the new resumption mechanism:
>=20
>   "Although TLS PSKs can be established out of band, PSKs can also be =
established in a previous connection and then used to establish a new =
connection ("session resumption" or "resuming" with a PSK)."
>=20
> And according to RFC 8446, resumption in TLS 1.3 creates a new session
>=20
>   "The PSK binder value forms a binding between a PSK and the current =
handshake, as well as between the session where the PSK was established =
and the current session"
>=20
>   "NewSessionTicket"

  OK, but that's still resuming a user session.  Even if the name of the =
thing changed.

> My understanding is that
>=20
>   - session resumption with EAP-TLS 1.2 would resume the same TLS =
session (same TLS SessionID) but create a new EAP session (different EAP =
Session-Id).
>=20
>   - resumption with EAP-TLS 1.3 would create a new TLS session =
(SessionID is depracated) and create a new EAP session (different EAP =
Session-Id)

  That's nice, but really misses my point.

  Whatever it's called in EAP-TLS 1.3, resumption *does not* use the =
same authentication credentials as the first session.  This creates a =
"time of use, time of check" security bug that's welded into the =
protocol.

  This security bug was completely missed in RFC 5216.  This new draft =
should rectify that error.

  i.e. using an NAI of "example.org" in the first session, and =
"example.com" in the second session.

  Not only is this entirely permitted by the current spec, it's not even =
discussed as an issue.  And it means that the protocol is open to a =
large number of time of use, time of check" security bugs which could =
cause serious breaches of networks.

  We can't paper over security issues by saying "it's not session =
resumption, it's a new session".  Well, whatever.  The NEW session =
should get the same authorization as the OLD session, but the =
information used to do that authorization doesn't exist in the NEW =
session!  Or if it does exist, it can be different!

  That's a show-stopper, TBH.

  Alan DeKok.


From nobody Wed Feb 20 06:08:51 2019
Return-Path: 
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FE6B12E036 for ; Wed, 20 Feb 2019 06:08:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.601
X-Spam-Level: 
X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Iq9WIoekv0Js for ; Wed, 20 Feb 2019 06:08:48 -0800 (PST)
Received: from mx0b-002e3701.pphosted.com (mx0b-002e3701.pphosted.com [148.163.143.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 084B01286E7 for ; Wed, 20 Feb 2019 06:08:47 -0800 (PST)
Received: from pps.filterd (m0134425.ppops.net [127.0.0.1]) by mx0b-002e3701.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x1KE7Fg3028925; Wed, 20 Feb 2019 14:08:42 GMT
Received: from g2t2354.austin.hpe.com (g2t2354.austin.hpe.com [15.233.44.27]) by mx0b-002e3701.pphosted.com with ESMTP id 2qs43ej2e6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 20 Feb 2019 14:08:41 +0000
Received: from G4W9120.americas.hpqcorp.net (exchangepmrr1.us.hpecorp.net [16.210.21.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by g2t2354.austin.hpe.com (Postfix) with ESMTPS id 74E70CE; Wed, 20 Feb 2019 14:08:38 +0000 (UTC)
Received: from G4W9121.americas.hpqcorp.net (2002:10d2:1510::10d2:1510) by G4W9120.americas.hpqcorp.net (2002:10d2:150f::10d2:150f) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Wed, 20 Feb 2019 14:08:38 +0000
Received: from NAM04-SN1-obe.outbound.protection.outlook.com (15.241.52.13) by G4W9121.americas.hpqcorp.net (16.210.21.16) with Microsoft SMTP Server (TLS) id 15.0.1367.3 via Frontend Transport; Wed, 20 Feb 2019 14:08:38 +0000
Received: from AT5PR8401MB0675.NAMPRD84.PROD.OUTLOOK.COM (10.169.4.146) by AT5PR8401MB0834.NAMPRD84.PROD.OUTLOOK.COM (10.169.6.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1622.19; Wed, 20 Feb 2019 14:08:36 +0000
Received: from AT5PR8401MB0675.NAMPRD84.PROD.OUTLOOK.COM ([fe80::2cd1:6020:8c30:22ca]) by AT5PR8401MB0675.NAMPRD84.PROD.OUTLOOK.COM ([fe80::2cd1:6020:8c30:22ca%7]) with mapi id 15.20.1622.018; Wed, 20 Feb 2019 14:08:36 +0000
From: "Cappalli, Tim (Aruba Security)" 
To: Alan DeKok , John Mattsson 
CC: "emu@ietf.org" 
Thread-Topic: [Emu] Notes on session resumption with TLS-based EAP methods
Thread-Index: AQHUySO4M6EmbAPhZUuIm9Qen3JnrqXot7qA//+ttoA=
Date: Wed, 20 Feb 2019 14:08:36 +0000
Message-ID: 
References:  <15A9502F-27BA-42B5-93E0-9396AB653D8B@deployingradius.com>
In-Reply-To: <15A9502F-27BA-42B5-93E0-9396AB653D8B@deployingradius.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
user-agent: Microsoft-MacOutlook/10.16.0.190211
x-originating-ip: [8.46.73.129]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: a12aae2e-bf99-4c42-79bf-08d6973ce840
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605104)(4618075)(2017052603328)(7153060)(7193020); SRVR:AT5PR8401MB0834; 
x-ms-traffictypediagnostic: AT5PR8401MB0834:
x-ms-exchange-purlcount: 1
x-microsoft-exchange-diagnostics: =?utf-8?B?MTtBVDVQUjg0MDFNQjA4MzQ7MjM6Q3c5NFNMU0Nycnc1eDFMTjMxeHRsVmdW?= =?utf-8?B?S011Q3h3ZTVHS1orc1N4eng0TXQwaHVEbGNyN0xQaGExTzR6a05iT2dNWTNC?= =?utf-8?B?bDNVN0wzbTBBajRKZ3VHS3UvbkpSVVdGR2k1WFFhVFdNRStqeS9JZ0dYNUJj?= =?utf-8?B?WWowSWVvUzNkZHFIc1ljaTduTU1LNytHWVI2N3JheXFZdDM1UzNScm5XNVho?= =?utf-8?B?aFIzRmR2MWprT2xmZmx5Snk1elFORUl2VnF0U0UvZmtoU3l1T3h6VVpXWkJ5?= =?utf-8?B?eGdKSitGaERQbVIwelNuR25SVnY0bzlqQm44K0ovelpDeENrbEpWcHJnWTg4?= =?utf-8?B?dGY1by9aWGpxZ1lsU3BOTlFTcmtycmdDU2JxZFRZakZBdWMvLzF1UTRmTWcv?= =?utf-8?B?OHBIdnp2WmtCd1FvK2FSZ1BkMWxzN2lhVXhHRG4wVWhUSUZxWlhtZU1sTGVT?= =?utf-8?B?MU9zbDNqWFZpL0E5SW1BbTIrSkVObVRxdUJBMzdtcmYyTk5ic1VEQWJ5RXZ1?= =?utf-8?B?aEtQL2YyREU3TUlnZEUvT2M3RWgvVXFXYlVFM0tvLzJMSlI3YXBMMnhhWVZ6?= =?utf-8?B?bm1DY3RnSThUMlZwUXVqMDExeC9ycTgxZmprRlRFUFJnSFZIekR0ZENJaTVu?= =?utf-8?B?Si9aRitHeCt4aTBIdUlsK3JGYnA1Tmk4NDdqbEJIeTBJeUdlZzM1K3kwMUo1?= =?utf-8?B?TDhlNWRWVWwwUjNBZ0M2bXRCV25EdlFsQUtTOVl2OWowRittbUhUWDltYk0r?= =?utf-8?B?VUkyWVlKQzcxS0EwK3g5d1V1QXNBVGRhRUIrSkplS2h3RUVYRTNZUWlUcnFU?= =?utf-8?B?dVZsKzVhTGczdUtxQ2QrQitWQitCSk80d2ZneXlWZ21iazFtY0RVK0VuaVBv?= =?utf-8?B?bXpjMVh4TEZiSU9FOUszdDlLQ0JiblJtOElsWDFYZWQ0OHcyQ29GS29BeG5G?= =?utf-8?B?L3FjV3hmR1E4RWM0MzZBaFMwVFBUT3AwcTRQVlk5ZVQwRW1KVWNqRlBQWDVi?= =?utf-8?B?OHRxbVBMRk5KQnd6NFB6TUZCTnNaQlVJamZQMy8ycERSL29HblBKNHdTbEtV?= =?utf-8?B?Q0tsY3FOcDR1eUlxa09Eb08yWVJzbDdYc0xCVWJIcXBtNXRtRjFVQS9zOE5Y?= =?utf-8?B?cVBSN0VWM2lxT3BpS25oOU4wUGZNRUdxenhpSkVzeTJiVE9qcC93MFdOT3pi?= =?utf-8?B?YUVwOFNyUHdaVXNPMDFtbHA2aE9ESWMyWThCR256eU5EMDVnVmZBeW5pYlJ5?= =?utf-8?B?MFdIVzdXTGozcXlsMXVwREloRTJPTGszcnNMR2JZTUNsdmRjTHZNbzJGeGJ0?= =?utf-8?B?QU1qaDhEQUpHcUVxL2tNZWxFL1hVcUE1OXh5Q3ZheDhUcnZ0VTA3L0wzZWRK?= =?utf-8?B?eE84cUdEZHRya2ZHMU5HTlRZTU42b1dpRC9FMjdUbEE4ZVVnWTNubmJhZ1Fj?= =?utf-8?B?WllPY1d6S2dnYmwwQlA4ZVJnNFhRYnNHQzAxQXUwejgvdDVwOHdGeGlVUWYx?= =?utf-8?B?VFRlNlc2c0pMYzVFMG9hcGFtN2FDL2pQVDE3K25Xem9xUklhVUpEMFllekRG?= =?utf-8?B?TXliNHRhZERoNGxUZlhNdDl5NEN2MlZaaklvTXZDVlNvUitMclJBMGhTdHM0?= =?utf-8?B?c1dvM1VnWVczYzQxUEJnNUdZRC9KeUl4K25KckxDc3RJY3luSlRubk5LalZJ?= =?utf-8?B?YUFxNFdmV2JQT2xRcm5CQW4vQUN1NjNYdzdIV2haTnROazVjd3VKZ05PSEd4?= =?utf-8?B?RlR6bmpNTDZmb1NqQjN6b1NoL05LcVJ1blhjdEJNRm1vQmJlZzFKNlFUU2F5?= =?utf-8?Q?rXt7B7cijdRZca8?=
x-microsoft-antispam-prvs: 
x-forefront-prvs: 0954EE4910
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(136003)(39860400002)(346002)(366004)(396003)(13464003)(199004)(189003)(305945005)(478600001)(71190400001)(8676002)(71200400001)(36756003)(186003)(83716004)(97736004)(446003)(7736002)(86362001)(81166006)(14454004)(81156014)(11346002)(68736007)(99286004)(26005)(53546011)(102836004)(966005)(58126008)(110136005)(6506007)(8936002)(316002)(4326008)(2906002)(53936002)(6246003)(76176011)(25786009)(486006)(106356001)(6436002)(82746002)(229853002)(105586002)(14444005)(256004)(6116002)(6512007)(6306002)(6486002)(3846002)(33656002)(5660300002)(476003)(2616005)(66066001); DIR:OUT; SFP:1102; SCL:1; SRVR:AT5PR8401MB0834; H:AT5PR8401MB0675.NAMPRD84.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; 
received-spf: None (protection.outlook.com: hpe.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: IbCQyKqEiw12WdCwGcQ5SVaVxDhT8DdXzj9tRHPHm7pKpeTvd/7llFgHDa4hW1HUgar/nM0J5jIJ9/F+tBVY6qt65gj6cwLU6Q1+jyzLy3PskacUICFkDEG467/0zTSYMzTX5s7HRidubymiaq399hbKLnPguPU4u3GRkh9oMERKblfSGqUa4CYhBI8NCuTP+kuPSGEYpy9u6mIjvQL4E7ScC/+foUy+DQ9I9Q5ZnusXuEBHqsuP3D0rmMHw5l11XwxWsSKwH3YFhsqRNF2BPSRh4P55yyR1uj9AfigaUGhjuzeRsrwLTvmIG/d686x8hUu6xVN+dcrsoToQDw814fcLqavuBusLBwZAFXHdlvqzQaf0R8M0MTtoxixUNrTVsLai6OKHuAQHFFc3eKzBXxUr1VFp5yzzaJcdQ/QzGhE=
Content-Type: text/plain; charset="utf-8"
Content-ID: 
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: a12aae2e-bf99-4c42-79bf-08d6973ce840
X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Feb 2019 14:08:36.9425 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 105b2061-b669-4b31-92ac-24d304d195dc
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AT5PR8401MB0834
X-OriginatorOrg: hpe.com
X-HPE-SCL: -1
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-02-20_13:, , signatures=0
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=714 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1902200103
Archived-At: 
Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Wed, 20 Feb 2019 14:08:50 -0000

QWdyZWUgMTAwJSBBbGFuLiBOb3cgaXMgdGhlIHRpbWUgdG8gZml4IHRoaXMuDQoNCu+7vy0tLS0t
T3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBFbXUgPGVtdS1ib3VuY2VzQGlldGYub3JnPiBv
biBiZWhhbGYgb2YgQWxhbiBEZUtvayA8YWxhbmRAZGVwbG95aW5ncmFkaXVzLmNvbT4NCkRhdGU6
IFdlZG5lc2RheSwgRmVicnVhcnkgMjAsIDIwMTkgYXQgOTowMyBBTQ0KVG86IEpvaG4gTWF0dHNz
b24gPGpvaG4ubWF0dHNzb25AZXJpY3Nzb24uY29tPg0KQ2M6ICJlbXVAaWV0Zi5vcmciIDxlbXVA
aWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0VtdV0gTm90ZXMgb24gc2Vzc2lvbiByZXN1bXB0aW9u
IHdpdGggVExTLWJhc2VkIEVBUCBtZXRob2RzDQoNCg0KPiBPbiBGZWIgMjAsIDIwMTksIGF0IDg6
NTMgQU0sIEpvaG4gTWF0dHNzb24gPGpvaG4ubWF0dHNzb25AZXJpY3Nzb24uY29tPiB3cm90ZToN
Cj4gZHJhZnQtaWV0Zi1lbXUtZWFwLXRsczEzIGlzIGFjdHVhbGx5IHZlcnkgY2FyZWZ1bCB0byBu
b3QgdGFsayBhYm91dCAic2Vzc2lvbiByZXN1cHRpb24iLCBpdCB0YWxrcyBhYm91dCAicmVzdW1w
dGlvbiIuIFRoZSByZWFzb24gaXMgdGhhdCAic2Vzc2lvbiIgaXMgbm90IHdlbGwgZGVmaW5lZCBh
bmQgcHJvYmFibHkgbm90IHRoZSBzYW1lIGluIFRMUyBhbmQgRUFQLiBJbiBUTFMgMS4yIG9yIGVh
cmxpZXIsICJzZXNzaW9uIHJlc3VtcHRpb24iIGNsZWFybHkgcmVzdW1lZCBhIHNlc3Npb24uIFRM
UyAxLjMgcGFydGx5IHVzZXMgInNlc3Npb24gcmVzdW1wdGlvbiIgYXMgc29tZXRoaW5nIGRlcHJh
Y2F0ZWQ6DQo+IA0KPiAgICJTZXNzaW9uIHJlc3VtcHRpb24gd2l0aCBhbmQgd2l0aG91dCBzZXJ2
ZXItc2lkZSBzdGF0ZSBhcyB3ZWxsIGFzIHRoZSBQU0stYmFzZWQgY2lwaGVyIHN1aXRlcyBvZiBl
YXJsaWVyIFRMUyB2ZXJzaW9ucyBoYXZlIGJlZW4gcmVwbGFjZWQgYnkgYSBzaW5nbGUgbmV3IFBT
SyBleGNoYW5nZS4iDQo+IA0KPiBBcyB3ZWxsIGFzIHNsYW5nIGZvciB0aGUgbmV3IHJlc3VtcHRp
b24gbWVjaGFuaXNtOg0KPiANCj4gICAiQWx0aG91Z2ggVExTIFBTS3MgY2FuIGJlIGVzdGFibGlz
aGVkIG91dCBvZiBiYW5kLCBQU0tzIGNhbiBhbHNvIGJlIGVzdGFibGlzaGVkIGluIGEgcHJldmlv
dXMgY29ubmVjdGlvbiBhbmQgdGhlbiB1c2VkIHRvIGVzdGFibGlzaCBhIG5ldyBjb25uZWN0aW9u
ICgic2Vzc2lvbiByZXN1bXB0aW9uIiBvciAicmVzdW1pbmciIHdpdGggYSBQU0spLiINCj4gDQo+
IEFuZCBhY2NvcmRpbmcgdG8gUkZDIDg0NDYsIHJlc3VtcHRpb24gaW4gVExTIDEuMyBjcmVhdGVz
IGEgbmV3IHNlc3Npb24NCj4gDQo+ICAgIlRoZSBQU0sgYmluZGVyIHZhbHVlIGZvcm1zIGEgYmlu
ZGluZyBiZXR3ZWVuIGEgUFNLIGFuZCB0aGUgY3VycmVudCBoYW5kc2hha2UsIGFzIHdlbGwgYXMg
YmV0d2VlbiB0aGUgc2Vzc2lvbiB3aGVyZSB0aGUgUFNLIHdhcyBlc3RhYmxpc2hlZCBhbmQgdGhl
IGN1cnJlbnQgc2Vzc2lvbiINCj4gDQo+ICAgIk5ld1Nlc3Npb25UaWNrZXQiDQoNCiAgT0ssIGJ1
dCB0aGF0J3Mgc3RpbGwgcmVzdW1pbmcgYSB1c2VyIHNlc3Npb24uICBFdmVuIGlmIHRoZSBuYW1l
IG9mIHRoZSB0aGluZyBjaGFuZ2VkLg0KDQo+IE15IHVuZGVyc3RhbmRpbmcgaXMgdGhhdA0KPiAN
Cj4gICAtIHNlc3Npb24gcmVzdW1wdGlvbiB3aXRoIEVBUC1UTFMgMS4yIHdvdWxkIHJlc3VtZSB0
aGUgc2FtZSBUTFMgc2Vzc2lvbiAoc2FtZSBUTFMgU2Vzc2lvbklEKSBidXQgY3JlYXRlIGEgbmV3
IEVBUCBzZXNzaW9uIChkaWZmZXJlbnQgRUFQIFNlc3Npb24tSWQpLg0KPiANCj4gICAtIHJlc3Vt
cHRpb24gd2l0aCBFQVAtVExTIDEuMyB3b3VsZCBjcmVhdGUgYSBuZXcgVExTIHNlc3Npb24gKFNl
c3Npb25JRCBpcyBkZXByYWNhdGVkKSBhbmQgY3JlYXRlIGEgbmV3IEVBUCBzZXNzaW9uIChkaWZm
ZXJlbnQgRUFQIFNlc3Npb24tSWQpDQoNCiAgVGhhdCdzIG5pY2UsIGJ1dCByZWFsbHkgbWlzc2Vz
IG15IHBvaW50Lg0KDQogIFdoYXRldmVyIGl0J3MgY2FsbGVkIGluIEVBUC1UTFMgMS4zLCByZXN1
bXB0aW9uICpkb2VzIG5vdCogdXNlIHRoZSBzYW1lIGF1dGhlbnRpY2F0aW9uIGNyZWRlbnRpYWxz
IGFzIHRoZSBmaXJzdCBzZXNzaW9uLiAgVGhpcyBjcmVhdGVzIGEgInRpbWUgb2YgdXNlLCB0aW1l
IG9mIGNoZWNrIiBzZWN1cml0eSBidWcgdGhhdCdzIHdlbGRlZCBpbnRvIHRoZSBwcm90b2NvbC4N
Cg0KICBUaGlzIHNlY3VyaXR5IGJ1ZyB3YXMgY29tcGxldGVseSBtaXNzZWQgaW4gUkZDIDUyMTYu
ICBUaGlzIG5ldyBkcmFmdCBzaG91bGQgcmVjdGlmeSB0aGF0IGVycm9yLg0KDQogIGkuZS4gdXNp
bmcgYW4gTkFJIG9mICJleGFtcGxlLm9yZyIgaW4gdGhlIGZpcnN0IHNlc3Npb24sIGFuZCAiZXhh
bXBsZS5jb20iIGluIHRoZSBzZWNvbmQgc2Vzc2lvbi4NCg0KICBOb3Qgb25seSBpcyB0aGlzIGVu
dGlyZWx5IHBlcm1pdHRlZCBieSB0aGUgY3VycmVudCBzcGVjLCBpdCdzIG5vdCBldmVuIGRpc2N1
c3NlZCBhcyBhbiBpc3N1ZS4gIEFuZCBpdCBtZWFucyB0aGF0IHRoZSBwcm90b2NvbCBpcyBvcGVu
IHRvIGEgbGFyZ2UgbnVtYmVyIG9mIHRpbWUgb2YgdXNlLCB0aW1lIG9mIGNoZWNrIiBzZWN1cml0
eSBidWdzIHdoaWNoIGNvdWxkIGNhdXNlIHNlcmlvdXMgYnJlYWNoZXMgb2YgbmV0d29ya3MuDQoN
CiAgV2UgY2FuJ3QgcGFwZXIgb3ZlciBzZWN1cml0eSBpc3N1ZXMgYnkgc2F5aW5nICJpdCdzIG5v
dCBzZXNzaW9uIHJlc3VtcHRpb24sIGl0J3MgYSBuZXcgc2Vzc2lvbiIuICBXZWxsLCB3aGF0ZXZl
ci4gIFRoZSBORVcgc2Vzc2lvbiBzaG91bGQgZ2V0IHRoZSBzYW1lIGF1dGhvcml6YXRpb24gYXMg
dGhlIE9MRCBzZXNzaW9uLCBidXQgdGhlIGluZm9ybWF0aW9uIHVzZWQgdG8gZG8gdGhhdCBhdXRo
b3JpemF0aW9uIGRvZXNuJ3QgZXhpc3QgaW4gdGhlIE5FVyBzZXNzaW9uISAgT3IgaWYgaXQgZG9l
cyBleGlzdCwgaXQgY2FuIGJlIGRpZmZlcmVudCENCg0KICBUaGF0J3MgYSBzaG93LXN0b3BwZXIs
IFRCSC4NCg0KICBBbGFuIERlS29rLg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fXw0KRW11IG1haWxpbmcgbGlzdA0KRW11QGlldGYub3JnDQpodHRwczov
L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2VtdQ0KDQo=


From nobody Thu Feb 21 23:46:33 2019
Return-Path: 
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A3FDC124D68 for ; Thu, 21 Feb 2019 23:46:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.302
X-Spam-Level: 
X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=cYiKAMkU; dkim=pass (1024-bit key) header.d=ericsson.com header.b=bGZKO79h
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 80NwwGcSWKUt for ; Thu, 21 Feb 2019 23:46:30 -0800 (PST)
Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF6C31200B3 for ; Thu, 21 Feb 2019 23:46:29 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed;  q=dns/txt; i=@ericsson.com; t=1550821587; x=1553413587; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=L5xd1LoopuumC8NbJKuqdC/pMD5NoyKjDN6lAIPQbTE=; b=cYiKAMkUFLNG0s+9dMHbu9QO0Al5/915l9eIYtXKupLTQQZpwRPAXAusloPz6VrV rIOg+gU02fq9ow2+NsWOi6xUshPAXd+7LRpd/huXlfibsBELUuPbFurF+ogV+d3/ Atp7I4C1C+ebYH294OqJuR43dmRR+7DEUib18KG223M=;
X-AuditID: c1b4fb30-41b3a9e00000355c-a0-5c6fa8d38255
Received: from ESESSMB503.ericsson.se (Unknown_Domain [153.88.183.121]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id B4.B4.13660.3D8AF6C5; Fri, 22 Feb 2019 08:46:27 +0100 (CET)
Received: from ESESSMB502.ericsson.se (153.88.183.163) by ESESSMB503.ericsson.se (153.88.183.164) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Fri, 22 Feb 2019 08:46:26 +0100
Received: from EUR03-VE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB502.ericsson.se (153.88.183.163) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Fri, 22 Feb 2019 08:46:26 +0100
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=L5xd1LoopuumC8NbJKuqdC/pMD5NoyKjDN6lAIPQbTE=; b=bGZKO79hZJPmsOGPuJ/G3YyJrPz4Au6o19lhLhwpaomYnS2a8d011bXHrXr2cJ9dAOF0x7tkx8izAiUQK3r8QRTMf8fk29kF0iEKWVPd+DCpWo7PxHu9OWTNuUdoDYuf4lyXZWTtN3uZzqt3MiMxnHsCWpWtXNgCb78IM1et/EE=
Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3322.eurprd07.prod.outlook.com (10.170.246.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1643.14; Fri, 22 Feb 2019 07:46:25 +0000
Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::49f9:ba7d:bd7d:2ffc%5]) with mapi id 15.20.1665.008; Fri, 22 Feb 2019 07:46:25 +0000
From: John Mattsson 
To: "emu@ietf.org" 
Thread-Topic: [Emu] Notes on session resumption with TLS-based EAP methods
Thread-Index: AQHUyoK23iKSTKMs50qAiNLxijoleA==
Date: Fri, 22 Feb 2019 07:46:25 +0000
Message-ID: <84FA2D8F-17EF-4611-81E5-FCDD2C611423@ericsson.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
user-agent: Microsoft-MacOutlook/10.16.0.190211
authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; 
x-originating-ip: [82.214.46.143]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 7dc3974d-ea2b-4e26-4771-08d69899d8e1
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600110)(711020)(4605104)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3322; 
x-ms-traffictypediagnostic: HE1PR07MB3322:
x-microsoft-exchange-diagnostics: =?utf-8?B?MTtIRTFQUjA3TUIzMzIyOzIzOlFHcVZJUVo5SUZqTURqK3A1QmdTaG9NWGl6?= =?utf-8?B?eDFPUnJqKzR1MitrR0xLK1JXMVdZS1hvaDB4SFl2ZWl2OHo1bHdHMWlMcnFn?= =?utf-8?B?eGtqTmlJdVRoUU5zaDdXLzZvalJicjNacTRIeGszSkJZMmtKSk5lVUx5YVVT?= =?utf-8?B?U2ZJMm5Jd2JhT0NTYktDRWhBOW40NVBtdTF1bWxRSkpXdUE3ZHFpMGFPdkU3?= =?utf-8?B?dkZzVWlRUlI5VU1WWG5xVmZsallWV0U0NTBldElTNFQ3ZDhFaEZndEJsWVpF?= =?utf-8?B?cEdnUisvSXQzSmJLNFY1bVNZTk5Td3NOZ0tCUDdZRkM0cXhjL1ZkWlV2Y3V5?= =?utf-8?B?UUNyT0NHNGppRGZ6NC83MERSeklvdDk2aTIrSnRIMzhwR0x0TVRTU29rcUI1?= =?utf-8?B?LzJ1ZHBlSFlzay84UUhwWll0Mis5ZU8xMEZuVWVDTTdUU3F0cmR3MEMxY3JE?= =?utf-8?B?bEwzZ1FXc29mTlk4RGdXT2Q2bk5aUWxidTdIWGdQUVQ2MUVUZmI1YUlySG1P?= =?utf-8?B?WWVPK0RqaVJrME04bWRuOStGRjA5QlpYVVVXQ3FWRUZFMHNQblkrSVVTSW55?= =?utf-8?B?NG5EQjFja3F2b2dQQ0lvWGxzOU1XOEc1N29nWHpHOExNVkZBQ1ZweGFDbFd0?= =?utf-8?B?OEhqcGNkWHhsWGZvenI3RXJpTHZhdVZLYXAvOW9yVkhNOHZ0MUtjOHpxclM5?= =?utf-8?B?UGpxTUhzRkgwQmIralpmcWlBcmxIQzZPQ0tGT3o2R0l4c1RpMW4ramZQR1RQ?= =?utf-8?B?L3BXUC9lejVKWlNZRnB4R1UvaTNxRFZsNXZXOG9EREI5ZDJYRk1pVHVYUndY?= =?utf-8?B?RWs0WEpRaHJJeml6TlJ1QUhzeDY4TTd4N0hWVTM1bUxOaE1MZC90RTBhZTZC?= =?utf-8?B?QWgxYVNQemZWajU1UUhvbHQrallSNUlPamtOSTY3ajFtYUM4Smp5UnRxVHda?= =?utf-8?B?S1ZhUDNMYWtKZlVucnVWclp0RHovUm8zQlkwbjN0Slc3SENvcnZIaWtVQ0tM?= =?utf-8?B?Unh6SXczMFNSSlU2eTdlMjdXOWRXcjlNQTliWHRBZEUyaDhTSHMwcVo0TnpY?= =?utf-8?B?bW9wUEtzZy9VNFNoQ01neldpdkVScWQrZVh1VUlnb0ZOUTRkVy9sSlhpSkNr?= =?utf-8?B?SDIvNWt1b3JrU2pZTGIvbmpCd3Mydi9KT2NvOU1HZllCbFFnZXRDUmpaSkhV?= =?utf-8?B?TEgvQ05kcE1wMzFDUDNwSTZWbndOckV3amtBazhBYlI3YXZORzlEZGRnSml3?= =?utf-8?B?Sk84ZC8xRGc0RklNT09GTDNnQ2hUNjU2S1ZUdThobHdVaC9WZ3JtM3FNQWRy?= =?utf-8?B?azVoVkVFVGYwS1UyUWMzZkFZN2VCRXpNYTdzSWhOTDVEdjNWTkhzc25qRVIy?= =?utf-8?B?Q1lLMkxFMVVZVXFYTFlnWTRheTREUUxaWkp3T2hCeTNucVRHem1sMytWWjRo?= =?utf-8?B?LzRMNW9vejRzL0sxWGJZYk9mVHNFdEdSQWU3NFNWTDRELy9zSTJBN1ZhTkpy?= =?utf-8?B?VWZqZE5sMHArUklQYkpjNUM0ZHUraUI0MnI5S2lRZzIxM1p3Qm5KZDB6SUov?= =?utf-8?B?UkhXcVAzK0FjVXJjVWk4RkhjVzhKSjZYNnlCYVRnK0FXZFZwMStabjBuM0Iw?= =?utf-8?B?R3duMG0rMUdpQ0VFQzh5V0lSa2VEa2t2NkV0TTBtSCtDWnhSdGxvMU9HVTBE?= =?utf-8?B?c3VIcmNxdi9XWENHR3kzYjZGL1ZkOE50M3dpT1pzU0hvMyt0bGE2eWw0V0lo?= =?utf-8?B?dmJYcmZhc3pQYldCMk9wdz09?=
x-microsoft-antispam-prvs: 
x-forefront-prvs: 09565527D6
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(346002)(376002)(39860400002)(366004)(396003)(189003)(199004)(2616005)(83716004)(53936002)(478600001)(2906002)(44832011)(97736004)(2351001)(229853002)(6436002)(486006)(476003)(36756003)(6512007)(99286004)(105586002)(106356001)(5640700003)(7736002)(305945005)(68736007)(6916009)(6486002)(33656002)(6246003)(3846002)(6116002)(6506007)(26005)(102836004)(14444005)(81166006)(58126008)(81156014)(2501003)(5660300002)(256004)(8676002)(1730700003)(25786009)(14454004)(186003)(316002)(71190400001)(66066001)(71200400001)(82746002)(8936002)(86362001); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3322; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; 
received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: d7lPSPdaatZTaKABwMOaJe0Y9d6g1Zz9KAfdvjtIVNuX8pbwq3SULIQIgceP1vyCOwjPufIZWOj8MllLxCpd9O5+/wX4l3aZprdmHLQkuXb//W/c1UIRuCzXTQhm3Phnhfhqd3lyIwqLEsEKn3RZYhOlHZXzASo+5kCGBHvK2DZkL8n9K3bUa75YFUUZ7nyzSMK7MZUs4ghev0hmTO6cmQ1ADhZHq32wrvt+Kqw8uuPhDCYnFVlfM0MYt8vOXi1McuoGpxzZmvUOaMsS6AH1CMmli3ZgI1eWtPv+nGVmmPrcOk4F8EIB4KuXWw2X36vtyC+069OMzSEs82kXj6wNUUc+G6FwQ/ii/faxiw+o1hGVQDNe+4ag9d7GnfOE5+TkcLeWj0O0kjjNZE5wWrqFaIf1oN6CMAcmcDG5525/wz4=
Content-Type: text/plain; charset="utf-8"
Content-ID: 
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 7dc3974d-ea2b-4e26-4771-08d69899d8e1
X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Feb 2019 07:46:25.3883 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3322
X-OriginatorOrg: ericsson.com
X-Brightmail-Tracker: H4sIAAAAAAAAA02SbUhTYRTHee7LvI4Gj9PpQbPYwiCtzUTBMLSIyJJE+pLYopbe+b7pvSbq lyyblCatfEszFRtm8xVLDFlGmpovpCiRWSTaUoSyF8Is09r1Lujb7/yf3zmHAw9DygtpbybZ kMVyBl2aSiKlqmK7c/dMNRm1gdY3O0MH21upAyjSYvlJxKA46f4ENi05m+U04WelScsN11wy ejxzxjqi89EXRRFyZQAHw0T5TUkRkjJy/AxB22oNLRYrCBbm1wmxsBDQPGhGQkFhMwnWG3Ok +FJGQGvzR2fPPIKh2mVCmCzBgXDHli8R2AMrYXWykBTYHR+FLuuYMz8GNSNfKZHVUDJVu8kU 9oMl00uHzzAyHAH3H8cIMcKe8GOkZXM8ib1gxl5HiEdgsNjGSZEVsPR+gxZYgTXQbhd9hE+D yVRJi44SRnubnL4vTNYVI2EV4ONwd1YqnAL4NYLP7/oJMfeHi5VJYj7gBtNlC0jsTYXvRTbn nK1QcWlUIkqzNKy0VmxKcszCvVaTs2EbWEvmKFEaJ6HuwzRlRrur/zuo2rGQxLugvUcjxpGw 8qmNEFkJZcVzLgLLsBsMV9mpekRbkYJn+XPpiUFBapZLjud5o0FtYLM6keN3PH24FvgILS0e 7EOYQaotss5So1ZO67L53PQ+BAyp8pBdsDgiWYIuN4/ljGe482ks34d8GErlJfstd9PKcaIu i01l2QyW+/dKMK7e+ehQVMupBfPJte6elIKu+XGtJvZbeVjmicXndMiThmW5y/WR24p9/Ske nGGiwedKQcwr5Vs/z7LG8MgRfUB0iDm06MF2f+ya9OvP5Qi1+5H4AJ1Jf9V3I8Rz2BY80xfX u56zw6eECYuqd8s8/EJJ19lmSpk39saBYL2+41Ze3hChovgk3V5/kuN1fwEHv5HWGQMAAA==
Archived-At: 
Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Fri, 22 Feb 2019 07:46:32 -0000

IEFsYW4gRGVLb2sgPGFsYW5kQGRlcGxveWluZ3JhZGl1cy5jb20+Ozsgd3JvdGU6DQoNCiA+VGhp
cyBzZWN1cml0eSBidWcgd2FzIGNvbXBsZXRlbHkgbWlzc2VkIGluIFJGQyA1MjE2LiAgVGhpcyBu
ZXcgZHJhZnQgc2hvdWxkIHJlY3RpZnkgdGhhdCBlcnJvci4NCj4NCiA+aS5lLiB1c2luZyBhbiBO
QUkgb2YgImV4YW1wbGUub3JnIiBpbiB0aGUgZmlyc3Qgc2Vzc2lvbiwgYW5kICJleGFtcGxlLmNv
bSIgaW4gdGhlIHNlY29uZCBzZXNzaW9uLg0KPg0KID5Ob3Qgb25seSBpcyB0aGlzIGVudGlyZWx5
IHBlcm1pdHRlZCBieSB0aGUgY3VycmVudCBzcGVjLCBpdCdzIG5vdCBldmVuIGRpc2N1c3NlZCBh
cyBhbiBpc3N1ZS4gIEFuZCBpdCBtZWFucyB0aGF0IHRoZSBwcm90b2NvbCBpcyBvcGVuIHRvIGEg
bGFyZ2UgbnVtYmVyIG9mIHRpbWUgb2YgdXNlLCB0aW1lIG9mIGNoZWNrIiBzZWN1cml0eSBidWdz
IHdoaWNoIGNvdWxkIGNhdXNlIHNlcmlvdXMgYnJlYWNoZXMgb2YgbmV0d29ya3MuDQoNCkkgdGhp
bmsgU2VjdGlvbiAyLjIgb2YgUkZDIDUyMTYgZG8gZGlzY3VzcyB0aGlzIGlzc3VlLCBidXQgaXQg
ZG9lcyBub3QgZXhwbGljaXRseSBtZW50aW9uIHJlc3VtcHRpb24uIFRoZSB0ZXh0IGlzIGFsc28g
dG9vIHNvZnQuIA0KDQotLS0tLS0tLS0tLS0tLS0tDQogMi4yLiAgSWRlbnRpdHkgVmVyaWZpY2F0
aW9uDQoNCiAgIEFzIG5vdGVkIGluIFNlY3Rpb24gNS4xIG9mIFtSRkMzNzQ4XToNCg0KICAgICAg
SXQgaXMgUkVDT01NRU5ERUQgdGhhdCB0aGUgSWRlbnRpdHkgUmVzcG9uc2UgYmUgdXNlZCBwcmlt
YXJpbHkgZm9yDQogICAgICByb3V0aW5nIHB1cnBvc2VzIGFuZCBzZWxlY3Rpbmcgd2hpY2ggRUFQ
IG1ldGhvZCB0byB1c2UuICBFQVANCiAgICAgIE1ldGhvZHMgU0hPVUxEIGluY2x1ZGUgYSBtZXRo
b2Qtc3BlY2lmaWMgbWVjaGFuaXNtIGZvciBvYnRhaW5pbmcNCiAgICAgIHRoZSBpZGVudGl0eSwg
c28gdGhhdCB0aGV5IGRvIG5vdCBoYXZlIHRvIHJlbHkgb24gdGhlIElkZW50aXR5DQogICAgICBS
ZXNwb25zZS4NCg0KICAgQXMgcGFydCBvZiB0aGUgVExTIG5lZ290aWF0aW9uLCB0aGUgc2VydmVy
IHByZXNlbnRzIGEgY2VydGlmaWNhdGUgdG8NCiAgIHRoZSBwZWVyLCBhbmQgaWYgbXV0dWFsIGF1
dGhlbnRpY2F0aW9uIGlzIHJlcXVlc3RlZCwgdGhlIHBlZXINCiAgIHByZXNlbnRzIGEgY2VydGlm
aWNhdGUgdG8gdGhlIHNlcnZlci4gIEVBUC1UTFMgdGhlcmVmb3JlIHByb3ZpZGVzIGENCiAgIG1l
Y2hhbmlzbSBmb3IgZGV0ZXJtaW5pbmcgYm90aCB0aGUgcGVlciBpZGVudGl0eSAoUGVlci1JZCBp
bg0KICAgW0tFWUZSQU1FXSkgYW5kIHNlcnZlciBpZGVudGl0eSAoU2VydmVyLUlkIGluIFtLRVlG
UkFNRV0pLiAgRm9yDQogICBkZXRhaWxzLCBzZWUgU2VjdGlvbiA1LjIuDQoNCiAgIFNpbmNlIHRo
ZSBpZGVudGl0eSBwcmVzZW50ZWQgaW4gdGhlIEVBUC1SZXNwb25zZS9JZGVudGl0eSBuZWVkIG5v
dCBiZQ0KICAgcmVsYXRlZCB0byB0aGUgaWRlbnRpdHkgcHJlc2VudGVkIGluIHRoZSBwZWVyIGNl
cnRpZmljYXRlLCBFQVAtVExTDQogICBpbXBsZW1lbnRhdGlvbnMgU0hPVUxEIE5PVCByZXF1aXJl
IHRoYXQgdGhleSBiZSBpZGVudGljYWwuICBIb3dldmVyLA0KICAgaWYgdGhleSBhcmUgbm90IGlk
ZW50aWNhbCwgdGhlIGlkZW50aXR5IHByZXNlbnRlZCBpbiB0aGUgRUFQLQ0KICAgUmVzcG9uc2Uv
SWRlbnRpdHkgaXMgdW5hdXRoZW50aWNhdGVkIGluZm9ybWF0aW9uLCBhbmQgU0hPVUxEIE5PVCBi
ZQ0KICAgdXNlZCBmb3IgYWNjZXNzIGNvbnRyb2wgb3IgYWNjb3VudGluZyBwdXJwb3Nlcy4NCi0t
LS0tLS0tLS0tLS0tLS0NCg0KU3VnZ2VzdGlvbiB0byBhZGQgdG8gU2VjdGlvbiAyLjIgb2YgRUFQ
LVRMUyAxLjMNCg0KIlRoZSBpZGVudGl0eSBwcmVzZW50ZWQgaW4gdGhlIEVBUC1SZXNwb25zZS9J
ZGVudGl0eSBpcyB1bmF1dGhlbnRpY2F0ZWQgaW5mb3JtYXRpb24sIGFuZCBTSEFMTCBOT1QgYmUg
dXNlZCBmb3IgYWNjZXNzIGNvbnRyb2wgb3IgYWNjb3VudGluZyBwdXJwb3Nlcy4gTm90ZSB0aGF0
IHRoaXMgYWxzbyBhcHBsaWVzIHRvIHJlc3VtcHRpb24uIg0KDQovSm9obg0KDQo=


From nobody Fri Feb 22 02:31:12 2019
Return-Path: 
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADDC0129524; Fri, 22 Feb 2019 02:31:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.3
X-Spam-Level: 
X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cjdUs3wJADBF; Fri, 22 Feb 2019 02:31:07 -0800 (PST)
Received: from smtp-out-01.aalto.fi (smtp-out-01.aalto.fi [130.233.228.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4F54D128CB7; Fri, 22 Feb 2019 02:31:07 -0800 (PST)
Received: from smtp-out-01.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 64E4F1156F9_C6FCE46B; Fri, 22 Feb 2019 10:26:14 +0000 (GMT)
Received: from exng4.org.aalto.fi (exng4.org.aalto.fi [130.233.223.23]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng4.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-01.aalto.fi (Sophos Email Appliance) with ESMTPS id 02ABE115532_C6FCE46F; Fri, 22 Feb 2019 10:26:14 +0000 (GMT)
Received: from [130.233.193.86] (130.233.0.5) by exng4.org.aalto.fi (130.233.223.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1591.10; Fri, 22 Feb 2019 12:31:01 +0200
From: Aleksi Peltonen 
To: , 
Message-ID: <30e0a051-f492-35d8-ebf3-57fefacb01e3@aalto.fi>
Date: Fri, 22 Feb 2019 12:30:56 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="------------9D6F113EB7B5E6621185F202"
Content-Language: en-US
X-Originating-IP: [130.233.0.5]
X-ClientProxiedBy: exng8.org.aalto.fi (130.233.223.27) To exng4.org.aalto.fi (130.233.223.23)
X-SASI-RCODE: 200
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=from:subject:to:cc:message-id:date:mime-version:content-type; s=its18; bh=1PbdK+mdSs/wfLEcFmEs/oHmOyexGNgRZAi0TJn5Log=; b=hRE2kfiluWWIu/2tyjx9wgpaAKyEnkIkALHRa1HHTVbxZmW4djD8d/LsH6quq3rfzVlOui+rKm+SlSgKMskxNng4859FGAXgH2fyivwdlX8QakM5oyIGhG0/8ck0gy5nViOx9gzin0f3Zv9vvoqGUPhZ4XP8Zc4YPEjELF3cqmsuU/fwU0aK7Gz8tjHVlI/TzGKnaJa93VKY7/Ltnkg+GNKLe2ywZzlOlB1fpWmH90KP1mEtCrEztBKW8LKBwgu/wcx+rO47ficcXPwM04UbqI7GUHM0riSekpH+dcTs2BXd8CmQPafF0BG5p7MUGwCBMkT2lQmSlex1iHhdcxOTdw==
Archived-At: 
Subject: [Emu] EAP-NOOB at the IETF 104 hackathon
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Fri, 22 Feb 2019 10:31:11 -0000

--------------9D6F113EB7B5E6621185F202
Content-Type: text/plain; charset="utf-8"; format=flowed
Content-Transfer-Encoding: 8bit

Dear all,

My colleagues and I will be working on the EAP-NOOB protocol during the 
hackathon. Feel free to join our table!

Please find the project details below or in the hackathon wiki 
https://trac.ietf.org/trac/ietf/meeting/wiki/104hackathon.

  *
    Champions:
      o Aleksi Peltonen 
      o Eduardo Inglés Sánchez 
      o Tuomas Aura 
  *
    Project:
      o
        EAP-NOOB
          +
            EAP-NOOB is an EAP method where the authentication is based
            on a user-assisted out-of-band (OOB) channel between the
            server and peer.
          +
            It is intended as a generic bootstrapping solution for
            Internet-of-Things devices which have no pre-configured
            authentication credentials and which are not yet registered
            on the authentication server. Consider devices you just
            bought or borrowed.
      o
        Working open source implementation with wpa_supplicant and
        hostapd on github: https://github.com/tuomaura/eap-noob
      o
        During the hackathon we plan to work on the following:
          +
            Various bug fixes
          + Interop testing between implementations
          +
            Testing the code with new kinds of IoT devices and OOB
            channels such as audio
          +
            User experience in real deployment

Regards,
Aleksi

--------------9D6F113EB7B5E6621185F202
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: 8bit


  

    
  
  
    
Dear all,

    
My colleagues and I will be working on the EAP-NOOB protocol
      during the hackathon. Feel free to join our table!

    
Please find the project details below or in the hackathon wiki https://trac.ietf.org/trac/ietf/meeting/wiki/104hackathon.

    

    
    
      
  • 
        
     Champions:
    
      
    • 
      
      
        
    • Aleksi Peltonen <aleksi.peltonen at aalto.fi>
        
      • 
        
    • Eduardo Inglés Sánchez <eduardo.ingles at um.es>
      • 
        
    • Tuomas Aura <tuomas.aura at aalto.fi>
      
        
      • 
      
    
      
  • 
        
     Project:
    
        
      
          
    • 
            
       EAP-NOOB
      
            
      
            
        
              
      • 
                
         EAP-NOOB is an EAP method where the
                  authentication is based on a user-assisted out-of-band
                  (OOB) channel between the server and peer. 
        
              
        • 
              
      • 
                
         It is intended as a generic
                  bootstrapping solution for Internet-of-Things devices
                  which have no pre-configured authentication
                  credentials and which are not yet registered on the
                  authentication server. Consider devices you just
                  bought or borrowed.
        
              
        • 
            
      
          
      • 
          
    • 
            
       Working open source implementation with
              wpa_supplicant and hostapd on github: https://github.com/tuomaura/eap-noob
      
          
      • 
          
    • 
            
       During the hackathon we plan to work on the
              following:
      
            
        
              
      • 
                
         Various bug fixes
        
              
        • 
              
      • Interop testing between implementations
        
              
        • 
              
      • 
                
         Testing the code with new kinds of IoT
                  devices and OOB channels such as audio
        
              
        • 
              
      • 
                
         User experience in real deployment
        
              
        • 
            
      
          
      • 
        
    
      
    • 
    

    Regards,

    Aleksi

  


--------------9D6F113EB7B5E6621185F202--


From nobody Fri Feb 22 04:51:30 2019
Return-Path: 
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 93EC9130DC0 for ; Fri, 22 Feb 2019 04:51:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cAhQdkWaNOzz for ; Fri, 22 Feb 2019 04:51:26 -0800 (PST)
Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id EEAEC12EB11 for ; Fri, 22 Feb 2019 04:51:25 -0800 (PST)
Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 2D703333; Fri, 22 Feb 2019 12:51:24 +0000 (UTC)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\))
From: Alan DeKok 
In-Reply-To: <84FA2D8F-17EF-4611-81E5-FCDD2C611423@ericsson.com>
Date: Fri, 22 Feb 2019 07:51:15 -0500
Cc: "emu@ietf.org" 
Content-Transfer-Encoding: quoted-printable
Message-Id: <8EC98343-E2F7-42DD-9962-EC89865039E1@deployingradius.com>
References: <84FA2D8F-17EF-4611-81E5-FCDD2C611423@ericsson.com>
To: John Mattsson 
X-Mailer: Apple Mail (2.3445.102.3)
Archived-At: 
Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Fri, 22 Feb 2019 12:51:29 -0000

On Feb 22, 2019, at 2:46 AM, John Mattsson  =
wrote:
>=20
> I think Section 2.2 of RFC 5216 do discuss this issue, but it does not =
explicitly mention resumption. The text is also too soft.=20

  I think that section discusses an entirely different issue, that has =
nothing to do with resumption.

> Suggestion to add to Section 2.2 of EAP-TLS 1.3
>=20
> "The identity presented in the EAP-Response/Identity is =
unauthenticated information, and SHALL NOT be used for access control or =
accounting purposes. Note that this also applies to resumption."

  This text means that resumption is impossible in all practical =
networks.

  Why?  Because the user was originally authenticated via the =
credentials they provide: the certificate.  As per Section 2.2, any =
policies applied to that user are applied based on those credentials.

  When resumption happens, those credentials are not supplied.  The only =
ID provided is the EAP-Response/Identity, which systems are forbidden =
from trusting.

  So we now have resumption where we don't know the identity of who is =
resuming.  We don't know what policies were applied to them previously.  =
We don't know what policies to apply to them now.

  Therefore, any *practical* resumption is impossible.


  In my opinion, the document MUST give guidance for implementors and =
site administrators:

* if resumption is used, the implementation MUST cache sufficient =
information for the system to make appropriate policy decisions on =
resumption

* resumption MUST be rejected if no cached information is available, as =
we have no idea what policies to apply

* the document MUST discuss the use of EAP-TLS in other protocols such =
as PPP, PANA, RADIUS, and Diameter.  Just a mention that they exist is =
fine.

* These protocols MAY carry additional information about the user and/or =
the machine involved.    e.g. MAC, switch IP, port, etc.

* When systems make policy decisions on that additional information, the =
systems MUST be aware that the additional information can be different =
between the original authentication and any resumption

* This difference creates a "Time of check, time of use" (TOCTOU) =
security issue with the policies.  i.e. The user can leverage the TOCTOU =
issue to get one policy applied for the original authentication, and a =
different policy applied for resumption.

* That difference allows users to exploit the system, and get access =
that they should not have.

* Implementations SHOULD add such information to the above cache for the =
session, so they can look for discrepancies between the original =
authentication and resumption

* where there are discrepancies, the resumption SHOULD be rejected.

  I don't understand why there's so little concern about people being =
able to PWN your network.  It's a disaster.

  We can't just paper over this issue.  It's a major security flaw =
that's designed into the protocol.  It needs to be addressed.

  Alan DeKok.


From nobody Fri Feb 22 16:47:16 2019
Return-Path: 
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C1AD130FA2 for ; Fri, 22 Feb 2019 16:47:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WSoKSo5TlbFS for ; Fri, 22 Feb 2019 16:47:09 -0800 (PST)
Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 76BD6130F67 for ; Fri, 22 Feb 2019 16:47:08 -0800 (PST)
Received: from [192.168.2.16] (unknown [47.52.111.246]) by mail.networkradius.com (Postfix) with ESMTPSA id E8EA82F4; Sat, 23 Feb 2019 00:47:05 +0000 (UTC)
From: Arran Cudbard-Bell 
Message-Id: 
Content-Type: multipart/signed; boundary="Apple-Mail=_1A00C84B-2EFA-4B50-B6F2-1958AF7C4881"; protocol="application/pgp-signature"; micalg=pgp-sha256
Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\))
Date: Sat, 23 Feb 2019 08:47:01 +0800
In-Reply-To: <8EC98343-E2F7-42DD-9962-EC89865039E1@deployingradius.com>
Cc: John Mattsson , "emu@ietf.org" 
To: Alan DeKok 
References: <84FA2D8F-17EF-4611-81E5-FCDD2C611423@ericsson.com> <8EC98343-E2F7-42DD-9962-EC89865039E1@deployingradius.com>
X-Mailer: Apple Mail (2.3445.102.3)
Archived-At: 
Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Sat, 23 Feb 2019 00:47:15 -0000

--Apple-Mail=_1A00C84B-2EFA-4B50-B6F2-1958AF7C4881
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii


>  In my opinion, the document MUST give guidance for implementors and =
site administrators:
>=20
> * if resumption is used, the implementation MUST cache sufficient =
information for the system to make appropriate policy decisions on =
resumption

Maybe something about not relying on the outer identity to apply any =
kind of autz policies?  Administrators may assume some kind of binding =
between the outer identity, the original session, and the resumed =
session, and assume it'll be consistent. In reality the user can provide =
any outer identity they like.

I know this is covered by the above point, but I feel it's worth =
documenting this case explicitly.

> * resumption MUST be rejected if no cached information is available, =
as we have no idea what policies to apply

I'd argue if cached information is expected and non is available, =
resumption MUST be rejected.  For the majority of cases the security =
policies applied to the different TLS based EAP methods will be =
identical.

I agree with the rest of the points.

-Arran


--Apple-Mail=_1A00C84B-2EFA-4B50-B6F2-1958AF7C4881
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE6VbEmJeQrF8361hu/6TVgp+218oFAlxwmAUACgkQ/6TVgp+2
18pJQg/+PNY4nlCfzVfr6IV7YdGTgJiYI4uy7hn7H791iT2UsS2ICM/4BuOlHmgR
6nNca/BBu4R3eFnnxk9IbxpRsl/WFU8YxkR+45XkYHv+JgjANmw8NV4sPB9DwCUu
Ae73rVNZ1vg3aQXFfnFLL44I3AFtlNE4nwSP0NwbgTy2O6wy4izlP4+duYjoXaeI
nTaLxhm07Ruf3svIYLQxuVEBC25s3L0gyZbmyBbKI+af8urTmxU1f2nhVBYoolaR
F1f1CIFrxNPE/+5WFLJuYkEfsQ2Zn0aDERVRu5fftJRF3b4qaTwz9hQ6hCFaKQPB
JDMLge0vRD04o5ZH1IjeNavc8gciR7IGRHrqrpsLSudldjD6RFSJozBA3D0ns9+g
6HH67bTmlpMq+Nu9tDOLMeilW2tDDka4M7wO0ujscWaNeuMPEpR0StlcjXtVzWvV
UPyfMi+wFYQDDecjEb6yuQ23ub0I3T7cOdtUaZMn8tiYCeu27fn8uJz0uGdNxE0L
IBLYyI7LfXm/6BcS1lo6PeeyEO7SRQrQsnMfKQ/+M72Apj9ng/u1n0a0+qTEzGW9
ZKLTbUNS4notJ2RtSYGlRMD706q8Eb4UMYU1eDTl5wahjAWVtunOsuj9ZKJFE6CL
iCBSu92bkiyEw0uTUVCEPVNczRtm5zieeyhLPshI4Y1BSUBBzes=
=kpde
-----END PGP SIGNATURE-----

--Apple-Mail=_1A00C84B-2EFA-4B50-B6F2-1958AF7C4881--


From nobody Sat Feb 23 11:15:09 2019
Return-Path: 
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1EC87130E13 for ; Sat, 23 Feb 2019 11:15:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NT4HaQrl0VRE for ; Sat, 23 Feb 2019 11:15:00 -0800 (PST)
Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 41C7C12008F for ; Sat, 23 Feb 2019 11:14:59 -0800 (PST)
Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 525FA49B; Sat, 23 Feb 2019 19:14:58 +0000 (UTC)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\))
From: Alan DeKok 
In-Reply-To: 
Date: Sat, 23 Feb 2019 14:14:51 -0500
Cc: John Mattsson , "emu@ietf.org" 
Content-Transfer-Encoding: quoted-printable
Message-Id: 
References: <84FA2D8F-17EF-4611-81E5-FCDD2C611423@ericsson.com> <8EC98343-E2F7-42DD-9962-EC89865039E1@deployingradius.com> 
To: Arran Cudbard-Bell 
X-Mailer: Apple Mail (2.3445.102.3)
Archived-At: 
Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Sat, 23 Feb 2019 19:15:04 -0000

On Feb 22, 2019, at 7:47 PM, Arran Cudbard-Bell =
 wrote:
>=20
>=20
>> In my opinion, the document MUST give guidance for implementors and =
site administrators:
>>=20
>> * if resumption is used, the implementation MUST cache sufficient =
information for the system to make appropriate policy decisions on =
resumption
>=20
> Maybe something about not relying on the outer identity to apply any =
kind of autz policies?  Administrators may assume some kind of binding =
between the outer identity, the original session, and the resumed =
session, and assume it'll be consistent. In reality the user can provide =
any outer identity they like.

  Yes.  The NAI document discusses this situation:

https://tools.ietf.org/html/rfc7542#section-4.2

  That discussion unfortunately doesn't discuss resumption.

> I know this is covered by the above point, but I feel it's worth =
documenting this case explicitly.

  Yes.  An explicit reference to the above section would help.

>> * resumption MUST be rejected if no cached information is available, =
as we have no idea what policies to apply
>=20
> I'd argue if cached information is expected and non is available, =
resumption MUST be rejected.  For the majority of cases the security =
policies applied to the different TLS based EAP methods will be =
identical.

  Yes, that has to happen, too.

  Alan DeKok.


From nobody Tue Feb 26 09:29:23 2019
Return-Path: 
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C83B12D4F2 for ; Tue, 26 Feb 2019 09:29:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xr_iadUjn3q2 for ; Tue, 26 Feb 2019 09:29:20 -0800 (PST)
Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id CB981130E5D for ; Tue, 26 Feb 2019 09:29:19 -0800 (PST)
Received: from [192.168.20.98] (ottawa.ca.networkradius.com [72.137.155.194]) by mail.networkradius.com (Postfix) with ESMTPSA id 02A604A2 for ; Tue, 26 Feb 2019 17:29:17 +0000 (UTC)
From: Alan DeKok 
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\))
Date: Tue, 26 Feb 2019 12:29:16 -0500
References: <84FA2D8F-17EF-4611-81E5-FCDD2C611423@ericsson.com> <8EC98343-E2F7-42DD-9962-EC89865039E1@deployingradius.com>  
To: EMU WG 
In-Reply-To: 
Message-Id: <1DDE7ED1-C539-4E11-81F8-EF557E2F6EB2@deployingradius.com>
X-Mailer: Apple Mail (2.3445.102.3)
Archived-At: 
Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Tue, 26 Feb 2019 17:29:22 -0000

  Here's my $0.02 on updates to the "Security Considerations" section.

---
5.9.  Authorization

   We note that EAP-TLS may be encapsulated in other protocols, such as
   PPP [RFC1661], RADIUS [RFC2865], Diameter [RFC6733], or PANA
   [RFC5191].  Systems implementing those protocols can make policy
   decisions, and can enforce authorization based on information from
   the EAP-TLS exchange.  As such, we need to discuss interactions
   between those protocols and EAP-TLS.  For generality, we state
   requirements on EAP servers, instead of updating those other
   protocols.

   As noted in Section 2.2, above, the EAP-Response / Identity is
   unauthenticated.  EAP servers therefore MUST NOT make policy =
decisions based on
   that identity.  Instead, where they make policy decisions, EAP
   servers MUST base those decisions on authenticated identities, such
   as information from the client certificate, or from the PSK identity
   provisioned for resumption, or from other cached information as
   described in the next section.

   We note that this requirement does not over-ride the requirements
   given in [RFC7542] Section 4.  EAP servers which use the NAI format
   necessarily also MUST follow the requirements of the NAI
   specification.

   In order to implement the requirements of [RFC7542], EAP servers MAY
   examine the EAP-Response / Identity field, and reject authentication
   if they determine that the field is in any way unsuitable.

   In short, EAP servers MUST NOT authorize sessions based the EAP-
   Response / Identity field.  The field is untrusted, and may be
   trivially forged.

5.10.  Resumption

   There are a number of security issues related to resumption.
   [RFC516] is unfortunately silent on this topic, so we discuss this
   issue in detail here.  We note that the problems outlined here are
   also relevant to earlier versions of TLS.  The solutions are also
   similar.

   When resumption occurs, it largely occurs based on the cached TLS
   data, at the TLS layer.  The only credentials supplied during this
   resumption are the EAP-Response/Identity.  However, as noted above in
   Section 2.2, the identity presented in the EAP-Response/Identity is
   unauthenticated information, and SHALL NOT be used for access control
   or accounting purposes. Note that this also applies to resumption.

   This requirement gives us a conundrum.  We have a successful
   resumption, but we have no idea what identity is being used in that
   resumption.  We are thus unable to apply any authorization to that
   authentication request.  Since we have no way to authorize the user,
   the only secure step we can take is to reject the session.  This
   rejection removes any possibility of resumption.

   The solution to this conundrum is to associate authentication
   credentials and authorization information with the original
   authentication.  That information can then be obtained and applied
   during resumption.

   There are two ways to make this association.  The first method is via
   [RFC5077], where the TLS server encapsulates the session state into a
   ticket and forwards it to the client.  The client can subsequently
   resume a session using the obtained ticket.  The second method is
   where the TLS server caches information about the TLS session, based
   on a unique key.  For TLS versions before 1.3, this key can be the
   session ID.  For TLS 1.3, this key is the unique PSK identity.

   The following requirements apply to both methods of associating
   additional data with the TLS session.  For simplicity, we use the
   term "cached data" to mean any authentication credentials or
   authorization information that has been associated with the TLS
   session via either session tickets, or via caching on the TLS server.

   Where the EAP server applies no authorization policies to TLS
   sessions, it MAY allow resumption where no cached data is available.
   That is, if no policies are applied during the original
   authentication, it is acceptable to not apply policies during any
   resumption.

   In all other cases, the EAP server MUST cache data during the
   original authentication.  This cached data MUST be sufficient to make
   authorization decisions during session resumption.  Where this cached
   data is unavailable, the resumption MUST be rejected, as no policies
   can be meaningfully applied.

   Any authorization applied during resumption MUST be done using the
   cached data, and MUST NOT be done by examining the EAP-Response /
   Identity that was supplied during resumption.  As noted earlier, that
   identity is unauthenticated and therefore insecure.

   The above requirements also apply if the EAP server expects some
   system to perform accounting for the session.  Since accounting must
   be tied to an authenticated identity, and resumption does not supply
   such an identity, accounting is impossible without access to cached
   data.

   As discussed in the previous section, EAP-TLS may be carried inside
   of another protocol.  This encapsulation creates further security
   issues with resumption.

   These encapsulating protocols can provide additional, non-EAP
   information to the EAP server.  This information can include, but is
   not limited to, the following data:

   * MAC address of the EAP peer * IP address of the EAP peer *
   Informtion about the ethernet switch to which the EAP peer is
   connecting
      * MAC address of the switch
      * IP address of the switch
      * switch port used by the EAP peer
   * Wifi SSID
   * Information about the ethernet layer used by the EAP peer

   The EAP server also has access to the cached EAP-Response / Identity
   from the original authentication.

   None of these fields are authenticated or secured.  As a result, any
   or all of these fields can change between the original
   authentication, and resumption.  This change creates a "Time of
   check, time of use" (TOCTOU) security vulnerability.  A malicious
   user could supply one set of data during authentication, and a
   different set of data during resumption.  The malicious user could
   then obtain different authorization during resumption, potentially
   leading to them obtaining access that they should not have.

   When EAP servers make policy decisions based on unauthenticated
   information, they MUST then add that information to the cached data
   described above.  This cached information MUST be used as part of any
   policy decision or authorization made for resumption.  That
   requirement allows the EAP peer to potentially obtain the same
   authorization as for the original session.  The requirement also
   ensures that where accounting is needed, the resumption is correctly
   accounted for via the original authentication credentials.

   The new information given during resumption SHOULD also be used as
   part of any policy decision or authorization made for resumption.
   EAP servers MAY reject resumption where the information supplied
   during resumption does not match the information supplied during the
   original authentication.  Where a good decision is unclear, EAP
   servers SHOULD err on the side of caution, and therefore reject the
   resumption.

   It is difficult for us to state the above requirement more precisely
   than the above.  We cannot require that the resumption be rejected in
   all cases.  For example, it may be permissible for a user to change
   switch ports, and still use resumption.  It may be permissible for
   for the user to request additional authorization during resumption.

   Where EAP servers determine that the user is acting maliciously, they
   MUST reject the resumption.

   We can unfortunately provide little additional guidelines here.  It
   is up to each implementation and / or deploymentment of EAP-TLS to
   determine which information to examine, and which policies apply.


From nobody Wed Feb 27 18:19:20 2019
Return-Path: 
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7279212867A for ; Wed, 27 Feb 2019 18:19:18 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.889
X-Spam-Level: 
X-Spam-Status: No, score=-1.889 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_HK_NAME_DR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OJStlaL2srKO for ; Wed, 27 Feb 2019 18:19:15 -0800 (PST)
Received: from mail.katezarealty.com (mail.katezarealty.com [104.168.158.213]) by ietfa.amsl.com (Postfix) with ESMTP id 518FE12E04D for ; Wed, 27 Feb 2019 18:19:15 -0800 (PST)
Received: from localhost (unknown [127.0.0.1]) by mail.katezarealty.com (Postfix) with ESMTP id 2EDD437410ED; Thu, 28 Feb 2019 02:19:15 +0000 (UTC)
X-Virus-Scanned: amavisd-new at katezarealty.com
Received: from mail.katezarealty.com ([127.0.0.1]) by localhost (mail.katezarealty.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id N6JXBiCneuZF; Wed, 27 Feb 2019 21:19:13 -0500 (EST)
Received: from Maxs-MBP.cablelabs.com (unknown [192.160.73.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.katezarealty.com (Postfix) with ESMTPSA id B17D73741015; Wed, 27 Feb 2019 21:19:13 -0500 (EST)
To: Mohit Sethi M , EMU WG 
References:  
From: "Dr. Pala" 
Organization: OpenCA Labs
Message-ID: <322807bd-9f77-1f80-81ef-993d33f4e0f9@openca.org>
Date: Wed, 27 Feb 2019 19:19:13 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.5.1
MIME-Version: 1.0
In-Reply-To: 
Content-Type: multipart/alternative; boundary="------------F047527B14FDCC1B822215CD"
Content-Language: en-US
Archived-At: 
Subject: Re: [Emu] EAP and Fragmentation
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Thu, 28 Feb 2019 02:19:19 -0000

This is a multi-part message in MIME format.
--------------F047527B14FDCC1B822215CD
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: quoted-printable

Hi Mohit, all,

somehow I skipped this message... :( Sorry ... anyhow - I do not have a=20
draft on that, and I am not even sure how this could be structured -=20
maybe this could be a BCP ? I actually came across another building=20
block that might be useful: an easy way to negotiate a key and an=20
encryption algorithm across the two parties.

Today, in the wild, we tend to use EAP-TLS, EAP-TTLS, or other more=20
ad-hoc mechanisms to provide channel authentication and encryption=20
(e.g., EAP-NOOB). However, also in this case, having a re-usable=20
mechanism (possibly more light-weight than=C2=A0 the full TLS stack) to d=
o=20
that, would be great. I admit that this might have broader applicability =

rather than "just" EAP, however it definitely fits the need in EAP.

In particular, what I am talking about is a "general" 3-way handshake :=20
what fields should be there, what should not be there in=C2=A0 the messag=
es.=20
Something on these lines (A =3D Client, B =3D Server):

  * [A] { Supported Encryption Algorithms List,
     =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Supported Key-Exchange Algorith=
ms List,
     =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Encryption Initialization Data,=

     =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 MSG Authentication } -> [B]

  * [B] { Selected Encryption Algorithm and Params,
     =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Selected Key-Exchange Algorithm=
 and Params,
     =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Key-Exchange Params (e.g., ECDH=
E),
     =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (Optional) Credentials (e.g., C=
ertificate Chain),
     =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Encryption Initialization Data,=

     =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 MSG Authentication } -> [A]

  * [A] { Selected Encryption Algorithm and Params,
     =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Selected Key-Exchange Params (e=
=2Eg., ECDHE),
     =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Key-Exchange Params (e.g., ECDH=
E),
     =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (Optional) My Credentials Encry=
pted (e.g., Certificate Chain),
     =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 MSG Authentication } -> [B]

that could be re-used by developers when they need a secure channel but=20
they do not need to support ALL the TLS features (e.g., session=20
resumption, key rotation, etc.). Can we have a generic message=20
definition that can then be encoded in different formats for different=20
environments. For EAP... we would use EAP messages :D In other=20
environments this could be encoded with different structures and=20
encodings (e.g., DER, JSON, XML, CBOR, etc.)

Maybe we can write a BCP for EAP that includes both building blocks=20
(i.e., Fragmentation and Simple Authentication and Encryption) ?

What do you think ?

Cheers,
Max


On 2/14/19 4:54 AM, Mohit Sethi M wrote:
>
> Dear Dr. Pala,
>
> On 2/12/19 7:36 PM, Dr. Pala wrote:
>>
>> Hi all,
>>
>> I am working on a draft for credentials management via EAP. When=20
>> looking at the different specifications, it seems a bit weird that=20
>> EAP does not provide Fragmentation control and requires each method=20
>> to define their own way.
>>
>> /*This, led me to my first question:*/ is there a de-facto "standard" =

>> way to add Fragmentation support we can just use (without having to=20
>> re-invent the wheel all the time) ? If we had such a mechanism, then=20
>> we could just say "implement the mechanism as defined in ... ". This=20
>> would definitely help developers that could safely re-use=20
>> code/libraries. The other approach would be to modify EAP to add=20
>> Fragmentation support there. The main reason to have a standard=20
>> behavior is to have also better management for ack and nak packets.=20
>> As far as the solution goes, the main ones I looked at are the ones=20
>> mentioned in EAP-TTLS and EAP-TEAP. They are both practically the=20
>> same, active ACK-based - are there other methods that have been=20
>> implemented ? Has anybody ever looked at how fragmentation is handled =

>> in practice and if there are better solutions than others ?
>>
> No hat: I think having a standard mechanism for supporting large=20
> messages and fragmentation independently of any particular EAP method=20
> would definitely be something useful. As you said, it would allow=20
> developers to safely re-use code. If you have a draft proposal, I=20
> would be happy to review it. Perhaps we could start by looking at=20
> existing mechanisms used by EAP-Pwd/EAP-TTLS.
>
> --Mohit
>
>> /*Further thinking let me to my second question:*/ the method we are=20
>> going to propose requires some form of authentication for the server, =

>> therefore I can see its use mainly as a tunneled method where the=20
>> communication with the server is assumed to be already secure. If we=20
>> go down the route of requiring the use of an outer method that=20
>> provides authenticity and, optionally, confidentiality we would also=20
>> not need to provide support for Fragmentation control, since the=20
>> records would be encapsulated within the outer-method messages that=20
>> already provide fragmentation support. Would this be acceptable ? Or=20
>> should the method not have such assumptions and provide support for=20
>> explicit fragmentation control ? What would be the preferred path=20
>> here ? I personally would like to have a method that could be used=20
>> independently, but I would also like to focus on simplicity of=20
>> implementation so that if you already have EAP-TTLS/EAP-TEAP support, =

>> adding support for EAP-CREDS would be very simple.
>>
>> Looking forward to some great guidance and advice :D Also, if you=20
>> would like to collaborate/contribute, please let me know!
>>
>> --=20
>> Best Regards,
>> Massimiliano Pala, Ph.D.
>> OpenCA Labs Director
>> OpenCA Logo
>>
>> _______________________________________________
>> Emu mailing list
>> Emu@ietf.org
>> https://www.ietf.org/mailman/listinfo/emu
--=20
Best Regards,
Massimiliano Pala, Ph.D.
OpenCA Labs Director
OpenCA Logo

--------------F047527B14FDCC1B822215CD
Content-Type: multipart/related;
 boundary="------------555ED2ACB6C75A4043CD2965"


--------------555ED2ACB6C75A4043CD2965
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit


  
    
  
  
    
Hi Mohit, all,

    

    
somehow I skipped this message... :( Sorry ... anyhow - I do not
      have a draft on that, and I am not even sure how this could be
      structured - maybe this could be a BCP ? I actually came across
      another building block that might be useful: an easy way to
      negotiate a key and an encryption algorithm across the two
      parties.

    
Today, in the wild, we tend to use EAP-TLS, EAP-TTLS, or other
      more ad-hoc mechanisms to provide channel authentication and
      encryption (e.g., EAP-NOOB). However, also in this case, having a
      re-usable mechanism (possibly more light-weight than  the full TLS
      stack) to do that, would be great. I admit that this might have
      broader applicability rather than "just" EAP, however it
      definitely fits the need in EAP.

    
In particular, what I am talking about is a "general" 3-way
      handshake : what fields should be there, what should not be there
      in  the messages. Something on these lines (A = Client, B =
      Server):

    
    
      
  • [A] { Supported Encryption Algorithms List,
    
               Supported Key-Exchange Algorithms List,
    
               Encryption Initialization Data,
    
               MSG Authentication } -> [B]
    
        
    
      
    • 
      
  • [B] { Selected Encryption Algorithm and Params,
    
               Selected Key-Exchange Algorithm and Params,
    
               Key-Exchange Params (e.g., ECDHE),
    
               (Optional) Credentials (e.g., Certificate Chain),
    
               Encryption Initialization Data,
    
               MSG Authentication } -> [A]
    
        
    
      
    • 
      
  • [A] { Selected Encryption Algorithm and Params,
    
               Selected Key-Exchange Params (e.g., ECDHE),
    
               Key-Exchange Params (e.g., ECDHE),
    
               (Optional) My Credentials Encrypted (e.g., Certificate
        Chain),
    
               MSG Authentication } -> [B]
    • 
    

    
that could be re-used by developers when they need a secure
      channel but they do not need to support ALL the TLS features
      (e.g., session resumption, key rotation, etc.). Can we have a
      generic message definition that can then be encoded in different
      formats for different environments. For EAP... we would use EAP
      messages :D In other environments this could be encoded with
      different structures and encodings (e.g., DER, JSON, XML, CBOR,
      etc.)

    
Maybe we can write a BCP for EAP that includes both building
      blocks (i.e., Fragmentation and Simple Authentication and
      Encryption) ?

    

    
What do you think ?

    
Cheers,

      Max

    


    

    
On 2/14/19 4:54 AM, Mohit Sethi M
      wrote:

    

    

      
      
Dear Dr. Pala,

      
On 2/12/19 7:36 PM, Dr. Pala wrote:

      

      

        
Hi all,

        
I am working on a draft for credentials management via EAP.
          When looking at the different specifications, it seems a bit
          weird that EAP does not provide Fragmentation control and
          requires each method to define their own way.
          

        

        
This, led me to my first question: is there a
          de-facto "standard" way to add Fragmentation support we can
          just use (without having to re-invent the wheel all the time)
          ? If we had such a mechanism, then we could just say
          "implement the mechanism as defined in ... ". This would
          definitely help developers that could safely re-use
          code/libraries. The other approach would be to modify EAP to
          add Fragmentation support there. The main reason to have a
          standard behavior is to have also better management for ack
          and nak packets. As far as the solution goes, the main ones I
          looked at are the ones mentioned in EAP-TTLS and EAP-TEAP.
          They are both practically the same, active ACK-based - are
          there other methods that have been implemented ? Has anybody
          ever looked at how fragmentation is handled in practice and if
          there are better solutions than others ?

      

      
No hat: I think having a standard mechanism for supporting
        large messages and fragmentation independently of any particular
        EAP method would definitely be something useful. As you said, it
        would allow developers to safely re-use code. If you have a
        draft proposal, I would be happy to review it. Perhaps we could
        start by looking at existing mechanisms used by
        EAP-Pwd/EAP-TTLS.

      

      
--Mohit

      

      

        
Further thinking let me to my second question:
          the method we are going to propose requires some form of
          authentication for the server, therefore I can see its use
          mainly as a tunneled method where the communication with the
          server is assumed to be already secure. If we go down the
          route of requiring the use of an outer method that provides
          authenticity and, optionally, confidentiality we would also
          not need to provide support for Fragmentation control, since
          the records would be encapsulated within the outer-method
          messages that already provide fragmentation support. Would
          this be acceptable ? Or should the method not have such
          assumptions and provide support for explicit fragmentation
          control ? What would be the preferred path here ? I personally
          would like to have a method that could be used independently,
          but I would also like to focus on simplicity of implementation
          so that if you already have EAP-TTLS/EAP-TEAP support, adding
          support for EAP-CREDS would be very simple.

        
Looking forward to some great guidance and advice :D Also, if
          you would like to collaborate/contribute, please let me know!

        

        
-- 

          
Best Regards,
            
Massimiliano
              Pala, Ph.D.

              OpenCA Labs Director

            

            OpenCA Logo

          

        

        

        

        
_______________________________________________
Emu mailing list
Emu@ietf.org
https://www.ietf.org/mailman/listinfo/emu


      

    

    
-- 

      

        Best Regards,
        

          Massimiliano Pala, Ph.D.

          OpenCA Labs Director

        

        OpenCA Logo

      

    

  


--------------555ED2ACB6C75A4043CD2965
Content-Type: image/png;
 name="hcfiklccgjlnbnjj.png"
Content-Transfer-Encoding: base64
Content-ID: 
Content-Disposition: inline;
 filename="hcfiklccgjlnbnjj.png"

iVBORw0KGgoAAAANSUhEUgAAAGQAAAA2CAMAAAAGesyaAAADAFBMVEUsJiEAAQAKAwMABwoX
BwESCQAqDgEkEQItFQESGykaGh0WGyE1FwE9GwJHHwElJiY4JBQmKDE1KCAfLUQ8KygoMEAq
MjpXKgs/MilMMR0pOFEyOUo4OTo1OkRqMgpjOBlpNxUwQV1DPz48QExdOyM4QVV+OQRRQzo1
SGdDR0lDSFJfRDFASVyaPwF+RRpNT1I9UXlwSi8+UnNDUm6hQgCPRhBdUEZTUlBKVGlPVF27
PgCaSANtUT57VBerSQOMUgxHW4KMUiepTwmJVDh6WT6KVjGCWDpRYH21TwFiYF57YgJXYXae
VR+lVRZrYld1ZiB7YEuSYQBgZW+8VAlkZWjBVQCfXiqqXwG1WhPLVgedYDazXiDZVgCWZEDV
WQJ1blapYjbXWgDRXACMaU6WbgCiZjnIXw9mcIixZC6pZjJ/cUeLbFdycmZ4cGnnWwNwc3Wq
aS6BcGeobwndXwzkXwLgYgDaYwyMeCq/bQHJaBi9ajDMagWVegvRZxzVaAvXaQDLainqZAuv
cEPrZQDQaSyockrFbSvmZwnabQLvZwDpaQB0fpPkaxGld1d+f3/3aACfeV6RfG2JfnLebSF7
gYy2fQmugQCigxW8d0K3eEr1bQXaciTicRqKgnzNewHuchbUdzKYiDzrdwKah1erjAvOfEXl
eSq5g1qYjGikiHO2kADigwC2hmSZjIGGj6aHkJzQiwCximixim/EkAORkZGVkYrOh0rPiVL5
giTvhDKkk4LMjF23mR+zmTrhikrviDzsi0TAlHDCnwvKlGqpnJLdlF2boKy+m324nImkoZ+e
o6XKpgrloATwl1WypZPOn3zfqQjYrgLBrVDdo3nGq5mysa/SrI7dq4bqqXTOrpWttL+6s6uw
tbe/t4rhvALetpjQuqnuwwe9v8LAv7vauqD3xA68w9XBw83rvJfRwbXFyMvbxbPNyMP8zgTc
zMDr0mb91xLM1ODQ1NfS1c7p0sD70bPd19PX4qj83cje4+Xr4tv54NLp7/Hy9PHw9fj6/v3Y
ktvJAAAAAXRSTlMAQObYZgAAAAFiS0dEAIgFHUgAAAjrSURBVFjDtVcNWFPXGT6E+l9BZ0EF
sTKEIQaUAIrTZdYqxqG0I3UjIuiDM0ipoyO5l0rFh2PE472EoIJKL9hQV2OxqM+USgFL4r9g
EaIoQxgqKBZBR+nGGhXYdwNro0Kfkcp3ntzce/7e8/2e70PoJVDl3bMlZyurUSsaKnqESrMp
lYrByozCjUOEUZORodMRVsViTjJc8GbLUGCUUstLv1SyLCGch8DGRiDPe/kY5/2HCQQTxZEE
y4fb2gDI8KjjLxsjfyyc3lZgM3KixwgeY4TEzk7+kjHODbeb6u0xAhiw8XgFMOxolpP6J75U
jLZfp6dzHIcBYCQbIBB4sCxDOLK6eMAVT39it57+e09ysCnDUtnrJ0vS5ZMW0PBFWDbd40G/
85sH2KeXvj94u/flX8/2J6kYQkhkHbzWbkdH0N0UDN8sURS8uMd9dMzPL7BxIIjOayuWLBIf
70RPUPjxLouBEgVhMaYuWXQlMjwsN+eFTR4cDZ4werRDYOoAIFkrptm/Ni0gthOt9Q4yWQxc
AwyWTbacW0sTDGoJen4P002/2S7LjgV6BpY1N6OO5g5eeiZTY/P9b1FzRwfKWuk9p/72ct+N
puKpq32qLVaexOCCJB91aezt5y6zt7fXILSdJZjlVr1w0mCR66x6FL3QOXiUQ2a0k/sFlDlq
1LzUMQ4uxxycjl0LWO1bBsY6yXR3wSTJGxqLhdsJHDsS9cwF47XlvcQGQiXhRbih/HkQv4XO
cajZb6GDu7PTFEdPkVu0k4vQyd3Jc/SUwNnB+RJ/XsI9ptZDIxMly3dbLNwGnGBJF+Id3cZM
9ui8Gjq5P/TDiRCegbOFgSKRo5e7yNHV2dnPdVb0bHfHQCevNIV/rxqrX48oFQdYcpKMtYRb
juxtfqRypNACK28+j3FsqcilAD0ADuIWCt0yRa7zRNEOY2YELhW5CV2dXVKixH8BC+s8GDN9
wWKxf94zpsRiJuWmBYjgndsKFmu5Bc+D3HQXCcu7QTFTMl3HF0SLxruLvGa4zUqdMGFWqqfX
3GSxN0y6NT154i+v75zvH2thXiWgY2YVElhwYl9NYxarlr0grlQn92DQt1vBUk+nUFeHGZme
gUIvl1RXr1AnV/fx6zd4v3HptM/YaXbrzmYFePu2WpowYRlJo+2PGLb2d9WE5bw1L4DcnOco
9HIcH3o02HOecMqMJhQqdLPXpArHl2uEo+Na8qZPXxw0+bVx46bFzhw3eZylM2dgwkbWW3Iy
Jp9lMDe9H2/raiqPCy5/fHSCu+M7mkffoQuzQhvRhWVlj1FcWTfq6dwdElJmarxedr/u3P6C
Nn7Fk95ol8wRjIMsOLGJSwLm/OMGjlFHJ7hqelDuxdMlpbU16JvqlJTamivoBjrfUgNB69zf
b6Fr1TWPKmtOw9xCdLayEFWvBlaSfmEBsk6LSdTMNnQaldTe7Qfj20yveddR2toVEevCi9/f
fmntR7ErtvompmyICM9qyYpZsG3FhqwNYRH5KUtyW7eGRRxfH1OHDv0ZXH6ihbSyVYzSY3Fu
BkVR9LaS2wPxUxyTFpu2eGverr+dezvi0ttpOy/tTKlL2ZkWs6p4VV1Kyq60nevS8iLyi1tW
hfNWzMfhYT+ArAQ+5odRBENjlRW5F/vH6O7u7urpXtvR/bQbmX/dPd3w7Ok+2Ij4ry5o0N/d
Y1p7qA21FodhFRc1ctjIsXZ2Y18VcwCixNgcWlgVbUiue3b3J33te7497vv/oT1Bj5/7br1R
grYlfrReSqmwPDyK0GqOUHKWj/RwP0J0ZlmsK3o2HP+7Qt9HBr3BYH5aNL3FG/+ul8sjKcxH
dRJFGJkhfKxgmM2rUoaSg5h4GAwXJsF00dRGq+/21k2EF7o50oNswrNfsYUQKRBIZWIFh3lu
aLNe1F++bjXGyWyzZiGoYFYLx5Ys4v0R3GWRdBHNErBiSiqVRhHMyeaYrMQ4SENWCvEcfhCm
GIzpqKlm27KTSWUcAX1goBw5oATctDb33aLTYV5SWoaXP5+gyqlFdnZ23nB+plcnREv0RWJC
BVkrrBJ1BewMmlVpgRUQF7wpItMJTcsJ34GBRVaFdQZaqoqxFmSb3qDQgu1A2GI4YAnODkQY
IOhklDKzo2C1IV2sijzdhjorqwefNdL6ihxzegU7SynexHgBMXy+xWFG8qvdf91D8WpRi41q
KFl02YaswYNkULTeLC9CFFK4bDHDMmZbhnuXSOdAsnN1LxgfVu7ZvG8LpSJUlO/gnaWQFwYv
JpZeKdUaSC8ApuhIShYQYp5yWQ0oPgVXPtkcHz/fx5rqqzosHSSlBYHIxKSolJcUsIIpnzkh
mt4b7Z/tOzBRQWaA6uNCNdet0nxLkL8CgzeQKIlCXaHjXR9MlqQn9Y1fNd5RE0zF/ryKwVR/
JMnsI3S8Umcw6NRYxRuUKqk3lfnKeGcTySAx5hy+7WfgZOv4uLLl0w8wUah71QLBpJeXq/eM
VVivV8jz6lB2ofWF6i1dEYRZfMJ4piE+ZweNeb7A2VVyKEx6vjt1z/ghMehVKiUpyt1VYBXC
N6j0Q4Mazp7TvvndhIaGhqqvP1bwFk0YRYR5RoLR+PkWmlIpV/oEDQ6jB9Wc3Z6bm6zLTtLl
gLC4LVWXz5Q1ffbV5oZ24wmsV/NeKTlirmg+u/q7w7/38PDdeKF8UBgXs2kV4WUC0YR/KOLv
Pby3L5O30yvG9vY/6vX8JSbb2je96coXX5QPznqfokKKEPWBAwd20ApaTWsP7LnTfsd42at3
+B+H7+zRUfwZZMutN6baHCX5+Ou9Zy4f3nuiKr7KaHxoNDbsSwhp6htvfyg3Zw901G+ttVlT
Ja34/E+fvrXmvY3713xy6tSZfadOJby7X1P/vwn/MeaYr0mF7IMEq690Gu95KwQq5L5K+f59
qGUtaZMSciHMKjdVbY6zFqRC/pv3LgxY5tcW0pjIpGGJ7+89kxBnbXZSmjuz7CeyihyG8fbd
XXYdrWlqQg+sZWTdzPqBB68VEdnkzDY0lHSjSD9/GRpaMt3OWqLpQENOTf/PpP8CK9ZVVe2a
8XoAAAAASUVORK5CYII=
--------------555ED2ACB6C75A4043CD2965
Content-Type: image/png;
 name="ojefdppcgmfeleai.png"
Content-Transfer-Encoding: base64
Content-ID: 
Content-Disposition: inline;
 filename="ojefdppcgmfeleai.png"

iVBORw0KGgoAAAANSUhEUgAAAGQAAAA2CAMAAAAGesyaAAADAFBMVEUsJiEAAQAKAwMABwoX
BwESCQAqDgEkEQItFQESGykaGh0WGyE1FwE9GwJHHwElJiY4JBQmKDE1KCAfLUQ8KygoMEAq
MjpXKgs/MilMMR0pOFEyOUo4OTo1OkRqMgpjOBlpNxUwQV1DPz48QExdOyM4QVV+OQRRQzo1
SGdDR0lDSFJfRDFASVyaPwF+RRpNT1I9UXlwSi8+UnNDUm6hQgCPRhBdUEZTUlBKVGlPVF27
PgCaSANtUT57VBerSQOMUgxHW4KMUiepTwmJVDh6WT6KVjGCWDpRYH21TwFiYF57YgJXYXae
VR+lVRZrYld1ZiB7YEuSYQBgZW+8VAlkZWjBVQCfXiqqXwG1WhPLVgedYDazXiDZVgCWZEDV
WQJ1blapYjbXWgDRXACMaU6WbgCiZjnIXw9mcIixZC6pZjJ/cUeLbFdycmZ4cGnnWwNwc3Wq
aS6BcGeobwndXwzkXwLgYgDaYwyMeCq/bQHJaBi9ajDMagWVegvRZxzVaAvXaQDLainqZAuv
cEPrZQDQaSyockrFbSvmZwnabQLvZwDpaQB0fpPkaxGld1d+f3/3aACfeV6RfG2JfnLebSF7
gYy2fQmugQCigxW8d0K3eEr1bQXaciTicRqKgnzNewHuchbUdzKYiDzrdwKah1erjAvOfEXl
eSq5g1qYjGikiHO2kADigwC2hmSZjIGGj6aHkJzQiwCximixim/EkAORkZGVkYrOh0rPiVL5
giTvhDKkk4LMjF23mR+zmTrhikrviDzsi0TAlHDCnwvKlGqpnJLdlF2boKy+m324nImkoZ+e
o6XKpgrloATwl1WypZPOn3zfqQjYrgLBrVDdo3nGq5mysa/SrI7dq4bqqXTOrpWttL+6s6uw
tbe/t4rhvALetpjQuqnuwwe9v8LAv7vauqD3xA68w9XBw83rvJfRwbXFyMvbxbPNyMP8zgTc
zMDr0mb91xLM1ODQ1NfS1c7p0sD70bPd19PX4qj83cje4+Xr4tv54NLp7/Hy9PHw9fj6/v3Y
ktvJAAAAAXRSTlMAQObYZgAAAAFiS0dEAIgFHUgAAAjrSURBVFjDtVcNWFPXGT6E+l9BZ0EF
sTKEIQaUAIrTZdYqxqG0I3UjIuiDM0ipoyO5l0rFh2PE472EoIJKL9hQV2OxqM+USgFL4r9g
EaIoQxgqKBZBR+nGGhXYdwNro0Kfkcp3ntzce/7e8/2e70PoJVDl3bMlZyurUSsaKnqESrMp
lYrByozCjUOEUZORodMRVsViTjJc8GbLUGCUUstLv1SyLCGch8DGRiDPe/kY5/2HCQQTxZEE
y4fb2gDI8KjjLxsjfyyc3lZgM3KixwgeY4TEzk7+kjHODbeb6u0xAhiw8XgFMOxolpP6J75U
jLZfp6dzHIcBYCQbIBB4sCxDOLK6eMAVT39it57+e09ysCnDUtnrJ0vS5ZMW0PBFWDbd40G/
85sH2KeXvj94u/flX8/2J6kYQkhkHbzWbkdH0N0UDN8sURS8uMd9dMzPL7BxIIjOayuWLBIf
70RPUPjxLouBEgVhMaYuWXQlMjwsN+eFTR4cDZ4werRDYOoAIFkrptm/Ni0gthOt9Q4yWQxc
AwyWTbacW0sTDGoJen4P002/2S7LjgV6BpY1N6OO5g5eeiZTY/P9b1FzRwfKWuk9p/72ct+N
puKpq32qLVaexOCCJB91aezt5y6zt7fXILSdJZjlVr1w0mCR66x6FL3QOXiUQ2a0k/sFlDlq
1LzUMQ4uxxycjl0LWO1bBsY6yXR3wSTJGxqLhdsJHDsS9cwF47XlvcQGQiXhRbih/HkQv4XO
cajZb6GDu7PTFEdPkVu0k4vQyd3Jc/SUwNnB+RJ/XsI9ptZDIxMly3dbLNwGnGBJF+Id3cZM
9ui8Gjq5P/TDiRCegbOFgSKRo5e7yNHV2dnPdVb0bHfHQCevNIV/rxqrX48oFQdYcpKMtYRb
juxtfqRypNACK28+j3FsqcilAD0ADuIWCt0yRa7zRNEOY2YELhW5CV2dXVKixH8BC+s8GDN9
wWKxf94zpsRiJuWmBYjgndsKFmu5Bc+D3HQXCcu7QTFTMl3HF0SLxruLvGa4zUqdMGFWqqfX
3GSxN0y6NT154i+v75zvH2thXiWgY2YVElhwYl9NYxarlr0grlQn92DQt1vBUk+nUFeHGZme
gUIvl1RXr1AnV/fx6zd4v3HptM/YaXbrzmYFePu2WpowYRlJo+2PGLb2d9WE5bw1L4DcnOco
9HIcH3o02HOecMqMJhQqdLPXpArHl2uEo+Na8qZPXxw0+bVx46bFzhw3eZylM2dgwkbWW3Iy
Jp9lMDe9H2/raiqPCy5/fHSCu+M7mkffoQuzQhvRhWVlj1FcWTfq6dwdElJmarxedr/u3P6C
Nn7Fk95ol8wRjIMsOLGJSwLm/OMGjlFHJ7hqelDuxdMlpbU16JvqlJTamivoBjrfUgNB69zf
b6Fr1TWPKmtOw9xCdLayEFWvBlaSfmEBsk6LSdTMNnQaldTe7Qfj20yveddR2toVEevCi9/f
fmntR7ErtvompmyICM9qyYpZsG3FhqwNYRH5KUtyW7eGRRxfH1OHDv0ZXH6ihbSyVYzSY3Fu
BkVR9LaS2wPxUxyTFpu2eGverr+dezvi0ttpOy/tTKlL2ZkWs6p4VV1Kyq60nevS8iLyi1tW
hfNWzMfhYT+ArAQ+5odRBENjlRW5F/vH6O7u7urpXtvR/bQbmX/dPd3w7Ok+2Ij4ry5o0N/d
Y1p7qA21FodhFRc1ctjIsXZ2Y18VcwCixNgcWlgVbUiue3b3J33te7497vv/oT1Bj5/7br1R
grYlfrReSqmwPDyK0GqOUHKWj/RwP0J0ZlmsK3o2HP+7Qt9HBr3BYH5aNL3FG/+ul8sjKcxH
dRJFGJkhfKxgmM2rUoaSg5h4GAwXJsF00dRGq+/21k2EF7o50oNswrNfsYUQKRBIZWIFh3lu
aLNe1F++bjXGyWyzZiGoYFYLx5Ys4v0R3GWRdBHNErBiSiqVRhHMyeaYrMQ4SENWCvEcfhCm
GIzpqKlm27KTSWUcAX1goBw5oATctDb33aLTYV5SWoaXP5+gyqlFdnZ23nB+plcnREv0RWJC
BVkrrBJ1BewMmlVpgRUQF7wpItMJTcsJ34GBRVaFdQZaqoqxFmSb3qDQgu1A2GI4YAnODkQY
IOhklDKzo2C1IV2sijzdhjorqwefNdL6ihxzegU7SynexHgBMXy+xWFG8qvdf91D8WpRi41q
KFl02YaswYNkULTeLC9CFFK4bDHDMmZbhnuXSOdAsnN1LxgfVu7ZvG8LpSJUlO/gnaWQFwYv
JpZeKdUaSC8ApuhIShYQYp5yWQ0oPgVXPtkcHz/fx5rqqzosHSSlBYHIxKSolJcUsIIpnzkh
mt4b7Z/tOzBRQWaA6uNCNdet0nxLkL8CgzeQKIlCXaHjXR9MlqQn9Y1fNd5RE0zF/ryKwVR/
JMnsI3S8Umcw6NRYxRuUKqk3lfnKeGcTySAx5hy+7WfgZOv4uLLl0w8wUah71QLBpJeXq/eM
VVivV8jz6lB2ofWF6i1dEYRZfMJ4piE+ZweNeb7A2VVyKEx6vjt1z/ghMehVKiUpyt1VYBXC
N6j0Q4Mazp7TvvndhIaGhqqvP1bwFk0YRYR5RoLR+PkWmlIpV/oEDQ6jB9Wc3Z6bm6zLTtLl
gLC4LVWXz5Q1ffbV5oZ24wmsV/NeKTlirmg+u/q7w7/38PDdeKF8UBgXs2kV4WUC0YR/KOLv
Pby3L5O30yvG9vY/6vX8JSbb2je96coXX5QPznqfokKKEPWBAwd20ApaTWsP7LnTfsd42at3
+B+H7+zRUfwZZMutN6baHCX5+Ou9Zy4f3nuiKr7KaHxoNDbsSwhp6htvfyg3Zw901G+ttVlT
Ja34/E+fvrXmvY3713xy6tSZfadOJby7X1P/vwn/MeaYr0mF7IMEq690Gu95KwQq5L5K+f59
qGUtaZMSciHMKjdVbY6zFqRC/pv3LgxY5tcW0pjIpGGJ7+89kxBnbXZSmjuz7CeyihyG8fbd
XXYdrWlqQg+sZWTdzPqBB68VEdnkzDY0lHSjSD9/GRpaMt3OWqLpQENOTf/PpP8CK9ZVVe2a
8XoAAAAASUVORK5CYII=
--------------555ED2ACB6C75A4043CD2965--

--------------F047527B14FDCC1B822215CD--