From nobody Fri Mar 1 13:13:09 2019 Return-Path: X-Original-To: emu@ietf.org Delivered-To: emu@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id C998B130F16; Fri, 1 Mar 2019 13:10:01 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , Cc: ekr@rtfm.com, emu@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.92.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <155147460181.6101.11505110958512727569.idtracker@ietfa.amsl.com> Date: Fri, 01 Mar 2019 13:10:01 -0800 Archived-At: Subject: [Emu] emu - Requested session has been scheduled for IETF 104 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Mar 2019 21:10:12 -0000 Dear Mohit Sethi, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. emu Session 1 (2:00 requested) Monday, 25 March 2019, Morning Session I 0900-1100 Room Name: Berlin/Brussels size: 100 --------------------------------------------- iCalendar: https://datatracker.ietf.org/meeting/104/sessions/emu.ics Request Information: --------------------------------------------------------- Working Group Name: EAP Method Update Area Name: Security Area Session Requester: Mohit Sethi Number of Sessions: 1 Length of Session(s): 2 Hours Number of Attendees: 50 Conflicts to Avoid: First Priority: saag tls cfrg lwig Second Priority: curdle uta secdispatch oauth 6lo mls Third Priority: sacm quic kitten bier acme t2trg People who must be present: Eric Rescorla Jari Arkko Joseph A. Salowey John Mattsson Mohit Sethi Resources Requested: Special Requests: If possible, please schedule on Monday/Tuesday during the week. --------------------------------------------------------- From nobody Wed Mar 6 04:23:42 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E3691292F1 for ; Wed, 6 Mar 2019 04:23:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.289 X-Spam-Level: X-Spam-Status: No, score=-4.289 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ed4IfH98XjI2 for ; Wed, 6 Mar 2019 04:23:36 -0800 (PST) Received: from smtp-out-01.aalto.fi (smtp-out-01.aalto.fi [130.233.228.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A0C3B1286D8 for ; Wed, 6 Mar 2019 04:23:35 -0800 (PST) Received: from smtp-out-01.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id BF61F1154D7_C7FBA9AB; Wed, 6 Mar 2019 12:18:34 +0000 (GMT) Received: from exng2.org.aalto.fi (exng2.org.aalto.fi [130.233.223.21]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng2.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-01.aalto.fi (Sophos Email Appliance) with ESMTPS id 601DA1154D6_C7FBA9AF; Wed, 6 Mar 2019 12:18:34 +0000 (GMT) Received: from exng7.org.aalto.fi (130.233.223.26) by exng2.org.aalto.fi (130.233.223.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1591.10; Wed, 6 Mar 2019 14:23:30 +0200 Received: from exng8.org.aalto.fi (130.233.223.27) by exng7.org.aalto.fi (130.233.223.26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1591.10; Wed, 6 Mar 2019 14:23:30 +0200 Received: from exng8.org.aalto.fi ([fe80::edd7:7397:1f7f:cd7]) by exng8.org.aalto.fi ([fe80::edd7:7397:1f7f:cd7%17]) with mapi id 15.01.1591.008; Wed, 6 Mar 2019 14:23:30 +0200 From: Aura Tuomas To: Dan Garcia , "emu@ietf.org" Thread-Topic: [Emu] Questions about EAP-NOOB Thread-Index: AQHUtv4YZAoDasa4BUyOI5o1puTbU6X+uYww Date: Wed, 6 Mar 2019 12:23:30 +0000 Message-ID: <42f019ff036243f1afd9cb67f4517eb4@aalto.fi> References: <26418_1548675555_5C4EE9E1_26418_441_1_e069870a-1233-fb27-5f07-13da2df1e138@odins.es> In-Reply-To: <26418_1548675555_5C4EE9E1_26418_441_1_e069870a-1233-fb27-5f07-13da2df1e138@odins.es> Accept-Language: fi-FI, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.233.0.5] Content-Type: multipart/alternative; boundary="_000_42f019ff036243f1afd9cb67f4517eb4aaltofi_" MIME-Version: 1.0 X-SASI-RCODE: 200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=from:to:subject:date:message-id:references:in-reply-to:content-type:mime-version; s=its18; bh=2HuSc81gtw8f8wv0q0H6o0QhODfxoIDjYDwiuW//xO0=; b=yvFcu2CIt5Yfbxzic8o6JX585TiCdbDmp3OGMGseZaMND5AO1uSZQrcpc3uolft4hhgd3AYjNgjTyNbfWLS0YM4Wcq2AEM476mxA90FbHoBG1rNs6mNyvf+KoIk4liQ5qaVj1MR9L0vMbOby44qWoEiCNLJVl00hI2VC2X3k1Kb1dY54juldX1ZGzF4QL30DuHqZ3SWq1NZZxdojtVY+bzGezO1s9TRbexIVjvDcRF7hencm+lpPLh1sWYFEcPUdPvoTZ2NrP2cZAUA6XH8FbsuyWocUdjHDP0OJi3K9ChtdgEvIHIPAR+LmvuaXqNvH8Ej7qrNbQjhEKC8cizDZ7Q== Archived-At: Subject: Re: [Emu] Questions about EAP-NOOB X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Mar 2019 12:23:40 -0000 --_000_42f019ff036243f1afd9cb67f4517eb4aaltofi_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgRGFuIGFuZCBSYWZhLA0KDQpUaGFuayB5b3UgZm9yIHRoZSBxdWVzdGlvbnMhDQoNClllcywg dGhlIEluaXRpYWwgRXhjaGFuZ2UgaW4gRUFQLU5PT0IgYWx3YXlzIGVuZHMgaW4gRUFQLUZhaWx1 cmUuICBUaGVuLCB3ZSBnaXZlIHNvbWUgdGltZSBmb3IgdGhlIHVzZXIgdG8gdHJhbnNmZXIgdGhl IE9PQiBtZXNzYWdlLiBBZnRlciB0aGUgT09CIHN0ZXAsIHRoZSBwZWVyIHRyaWVzIGFnYWluIGFu ZCB0aGUgQ29tcGxldGlvbiBFeGNoYW5nZSBlbmRzIGluIEVBUC1TdWNjZXNzLg0KDQpZZXMsIHRo ZSBvdXQtb2YtYmFuZCAoT09CKSBtZXNzYWdlIGlzIGNyeXB0b2dyYXBoaWNhbGx5IGJvdW5kIHRv IHRoZSBFQ0hEIHJlc3VsdC4gVGhhdCwgaXMgdGhlIG1lc3NhZ2UgYXV0aGVudGljYXRpb24gY29k ZSAoSG9vYikgaW4gdGhlIE9PQiBtZXNzYWdlIHRha2VzIHRoZSBFQ0RIIG91dHB1dCBhcyBvbmUg b2YgaXRzIGlucHV0cy4NCg0KT3VyIGN1cnJlbnQgaW1wbGVtZW50YXRpb24gb3Bwb3J0dW5pc3Rp Y2FsbHkgdHJpZXMgYWxsIHRoZSBXLUZpIG5ldHdvcmsgdGhhdCBzdXBwb3J0IFdQQTItRW50ZXJw cmlzZS4gSXQgZGVmaW5pdGVseSB3b3VsZCBiZSBiZXR0ZXIgdG8gYWR2ZXJ0aXNlIHRoZSBjYXBh YmlsaXR5IGZvciBFQVAtTk9PQiBpbiBJRUVFIDgwMi4xMXUsIG9yIGV2ZW4gYWR2ZXJ0aXNlIHRo ZSBkb21haW4gb2YgdGhlIEVBUC1OT09CIHNlcnZlci4gSSB0aGluayBpdCB3aWxsIHRha2Ugc29t ZSB0aW1lIGJlZm9yZSB0aGUgODAyLjExIEFQcyBzdGFydCB0byBzdXBwb3J0IEVBUC1OT09CIGlu IHRoYXQgd2F5LCB0aG91Z2gsIGFuZCB3ZSB3YW50IHRoZSBwcm90b2NvbCB0byB3b3JrIHdpdGgg ZXhpc3RpbmcgV2ktRmkgbmV0d29ya3MuDQoNClRoZSByZWFsbSB1c2VkIGJ5IHRoZSBwZWVyIGlz IGluaXRpYWxseSDigJxlYXAtbm9vYi5uZXTigJ0uIFRoZSBzZXJ2ZXIgY2FuIGFzc2lnbiBhbm90 aGVyIHJlYWxtIGluIEluaXRpYWwgRXhjaGFuZ2UuIFRoZSBtYWluIHB1cnBvc2UgZm9yIGFzc2ln bmluZyBhbm90aGVyIHJlYWxtIGlzIHRoYXQgdGhlIHBlZXIgY2FuIGxhdGVyIHVzZSBpdCBmb3Ig cm9hbWluZyBpbiBhY2Nlc3MgbmV0d29ya3MgdGhhdCBoYXZlIEFBQSByb3V0aW5nIHNldCB1cCBm b3IgdGhlIGFzc2lnbmVkIHJlYWxtLg0KDQpXZSBoYXZlIG9ubHkgdGVzdGVkIEVBUC1OT09CIG9u IFdpLUZpOiBodHRwczovL2dpdGh1Yi5jb20vdHVvbWF1cmEvZWFwLW5vb2IuIEl0IGNhbiBiZSB1 c2VkIG9uIGFueSBuZXR3b3JrcyB0aGF0IHN1cHBvcnQgRUFQIGFuZCB3aGVyZSB0aGUgdXNlci1h c3Npc3RlZCBPT0IgYXV0aGVudGljYXRpb24gbWV0aG9kcyBtYWtlcyBzZW5zZSBmcm9tIHRoZSB1 c2VyIGV4cGVyaWVuY2UgcGVyc3BlY3RpdmUuDQoNClJlZ2FyZHMsDQpUdW9tYXMNCg0KDQpGcm9t OiBFbXUgPGVtdS1ib3VuY2VzQGlldGYub3JnPiBPbiBCZWhhbGYgT2YgRGFuIEdhcmNpYQ0KU2Vu dDogTW9uZGF5LCAyOCBKYW51YXJ5LCAyMDE5IDEzOjM5DQpUbzogZW11QGlldGYub3JnDQpTdWJq ZWN0OiBbRW11XSBRdWVzdGlvbnMgYWJvdXQgRUFQLU5PT0INCkltcG9ydGFuY2U6IEhpZ2gNCg0K RGVhciBUb3VtYXMsIE1vaGl0LA0KDQpXZSBoYXZlIGJlZW4gZGlzY3Vzc2luZyBFQVAgTk9PQiBk cmFmdCB3ZSB3b3VsZCBsaWtlIHRvIGFzayBzb21lIHF1ZXN0aW9ucyBhYm91dCBpdC4gSXQgaXMg YSB2ZXJ5IGludGVyZXN0aW5nIGFwcHJvYWNoIHJlbGF0ZWQgdG8gSW9ULg0KDQoNCkluIEVBUC1O T09CIGFzIGZpcnN0IHN0ZXAgdGhlIEVBUCBhdXRoZW50aWNhdG9yIHN0YXJ0cyB0aGUgYXV0aGVu Y3Rpb24gKGUuZy4gdGhlIEFQKSwgZWFwLW5vb2IgaGFwcGVucyBidXQgaXQgc2VlbXMgdGhlcmUg d2lsbCBiZSBhIEVBUCBmYWlsdXJlICwgaXMgdGhpcyBjb3JyZWN0Pw0KQXNzdW1pbmcgaXQgaXMs IGlmIHlvdSBzZW5kIGFuIEVBUCBmYWlsdXJlLCB3aWxsIHRoZSBFQVAgbWV0aG9kIHN0aWxsIGNv bnRpbnVlPyBIb3cgd291bGQgdGhpcyB3b3JrPyBTaW5jZSB3ZSBhcmUgd2FpdGluZywgd2UgYXNz dW1lLCBmcm9tIGFuIEVBUCBzdWNjZXNzLCBvciBhbiBhbHRlcm5hdGl2ZSB3YXkgb2YgY29uZmly bWF0aW9uIHRoYXQgdGhlIGF1dGhlbnRpY2F0aW9uIGhhcyBiZWVuIGNvbXBsZXRlZC4NCg0KSXQg c2VlbXMgdGhhdCB0aGUgdXNlciBnZXRzIHNvbWV0aGluZyBmcm9tIHRoZSBJb1QgZGV2aWNlIHRo aXMgc29tZXRoaW5nIGlzIGR1ZSB0byB0aGUgRUNESCwgcmlnaHQ/DQoNClJlZ2FyZGluZyB0aGUg ZGlzY292ZXJ5IG9mIHRoZSBFQVAgYXV0aGVudGljYXRvci4gVGhlIEFQIHNob3VsZCBhbm5vdW5j ZSB3aGF0IGFyZSB0aGUgYXZhaWxhYmxlIGRvbWFpbnMgdG8gd2hlcmUgaXQgaXMgY29ubmVjdGVk ICggYSBzb2x1dGlvbiBiYXNlZCBvbiB0aGUgQUFBIGluZnJhZXN0cnVjdHVyZSA/KSBDb3VsZCB0 aGlzIGluZm9ybWF0aW9uIGJlIHByb3ZpZGVkIHRvIHRoZSBBUCB1c2luZyBJRUVFIDgwMi4xMXU/ DQoNClJlbGF0ZWQgdG8gdGhpcywgd2hhdCB3b3VsZCBiZSB0aGUgcmVhbG0gcHJvdmlkZWQgYnkg dGhlIEVBUCBwZWVyIHRvIHRoZSBhdXRoZW50aWNhdG9yPw0KDQpBbm90aGVyIHF1ZXN0aW9uIHdv dWxkIGJlIHdoaWNoIGFyZSB0aGUgbWFpbiByYWRpbyB0ZWNobm9sb2dpZXMgd2hlcmUgRUFQIE5P T0IgaXMgZXhwZWN0ZWQgdG8gYmUgdXNlZC4gQXJlIHlvdSBwbGFubmluZyB0byBzdXBwb3J0IDgw Mi4xNS40LCBXSUZJLCBldGM/IEluIHRoaXMgbGluZSwgZG8geW91IGhhdmUgYW55IEVBUC1OT09C IGltcGxlbWVudGF0aW9uIGluIENvbnRpa2k/DQoNCg0KDQpUaGFuayB5b3UgaW4gYWR2YW5jZS4N CkJlc3QgUmVnYXJkcy4NCkRhbiBhbmQgUmFmYS4NCg0KDQotLQ0KPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0NCg0KRGFuIEdh cmNpYSBDYXJyaWxsbywgUGguRC4NCkRvY3RvcmFkbyBJbmR1c3RyaWFsIChNSU5FQ08pDQpFLW1h aWw6IGRnYXJjaWFAb2RpbnMuZXM8bWFpbHRvOmRnYXJjaWFAb2RpbnMuZXM+DQoNCk9kaW4gU29s dXRpb25zLCBTLkwuDQpQb2zDrWdvbm8gSW5kdXN0cmlhbCBPZXN0ZQ0KQy8gUGVyw7osIDUsIDPC uiwgT2ZpY2luYSAxMg0KMzA4MjAgLSBBbGNhbnRhcmlsbGEgKE11cmNpYSkgLSBTcGFpbg0KVGxm LjogKzM0IDkwMiA1NzAgMTIxDQpXZWI6IHd3dy5vZGlucy5lczxodHRwOi8vd3d3Lm9kaW5zLmVz Pg0KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0NCg0KQVZJU08gTEVHQUw6IExhIGluZm9ybWFjacOzbiBjb250ZW5pZGEgZW4g ZXN0ZSBjb3JyZW8gZWxlY3Ryw7NuaWNvLCB5IGVuIHN1IGNhc28gZW4gbG9zIGRvY3VtZW50b3Mg YWRqdW50b3MsIGVzIGluZm9ybWFjacOzbiBwcml2aWxlZ2lhZGEgcGFyYSB1c28gZXhjbHVzaXZv IGRlIGxhIHBlcnNvbmEgeS9vIHBlcnNvbmFzIGEgbGFzIHF1ZSB2YSBkaXJpZ2lkby4gTm8gZXN0 w6EgcGVybWl0aWRvIGVsIGFjY2VzbyBhIGVzdGUgbWVuc2FqZSBhIGN1YWxxdWllciBvdHJhIHBl cnNvbmEgZGlzdGludGEgYSBsb3MgaW5kaWNhZG9zLiBTaSB1c3RlZCBubyBlcyB1bm8gZGUgbG9z IGRlc3RpbmF0YXJpb3MsIGN1YWxxdWllciBkdXBsaWNhY2nDs24sIHJlcHJvZHVjY2nDs24sIGRp c3RyaWJ1Y2nDs24sIGFzw60gY29tbyBjdWFscXVpZXIgdXNvIGRlIGxhIGluZm9ybWFjacOzbiBj b250ZW5pZGEgZW4gw6lsIG8gY3VhbHF1aWVyYSBvdHJhIGFjY2nDs24gdSBvbWlzacOzbiB0b21h ZGEgZW4gcmVsYWNpw7NuIGNvbiBlbCBtaXNtbywgZXN0w6EgcHJvaGliaWRhIHkgcHVlZGUgc2Vy IGlsZWdhbC4gRW4gZGljaG8gY2FzbywgcG9yIGZhdm9yIG5vdGlmw61xdWVsbyBhbCByZW1pdGVu dGUgeSBwcm9jZWRhIGEgbGEgZWxpbWluYWNpw7NuIGRlIGVzdGUgY29ycmVvIGVsZWN0csOzbmlj bywgYXPDrSBjb21vIGRlIHN1cyBhZGp1bnRvcyBzaSBsb3MgaHViaWVyZS4NCg0KQXNpbWlzbW8s IHkgZW4gY3VtcGxpbWllbnRvIGRlIExleSBPcmfDoW5pY2EgMy8yMDE4IGRlIHByb3RlY2Npw7Nu IGRlIGRhdG9zIGRlIGNhcsOhY3RlciBwZXJzb25hbCB5IGdhcmFudMOtYSBkZSBsb3MgZGVyZWNo b3MgZGlnaXRhbGVzIHkgZGVsIFJlZ2xhbWVudG8gRXVyb3BlbyBSR1BEIDY3OS8yMDE2IGxlIGlu Zm9ybWFtb3MgcXVlIHN1cyBkYXRvcyBlc3TDoW4gc2llbmRvIG9iamV0byBkZSB0cmF0YW1pZW50 byBwb3IgcGFydGUgZGUgT0RJTiBTT0xVVElPTlMsIFMuTC4gY29uIE4uSS5GLiBCLTczLjg0NS44 OTMsIGNvbiBsYSBmaW5hbGlkYWQgZGVsIG1hbnRlbmltaWVudG8geSBnZXN0acOzbiBkZSByZWxh Y2lvbmVzIGNvbWVyY2lhbGVzIHkgYWRtaW5pc3RyYXRpdmFzLiBMYSBiYXNlIGp1csOtZGljYSBk ZWwgdHJhdGFtaWVudG8gZXMgZWwgY3VtcGxpbWllbnRvIGRlIGxhIGxlZ2lzbGFjacOzbiBmaXNj YWwsIG1lcmNhbnRpbCB5IGNvbnRhYmxlLiBObyBzZSBwcmV2w6luIGNlc2lvbmVzIHkvbyB0cmFu c2ZlcmVuY2lhcyBpbnRlcm5hY2lvbmFsZXMgZGUgZGF0b3MuIFBhcmEgZWplcmNpdGFyIHN1cyBk ZXJlY2hvcyBwdWVkZSBkaXJpZ2lyc2UgYSBPRElOIFNPTFVUSU9OUywgUy5MLiwgZG9taWNpbGlh ZGEgZW4gQy8gUGVyw7osIDUsIDPCuiwgT2ZpY2luYSAxMiwgUG9sLiBJbmQuIE9lc3RlLCAzMDgy MCBBbGNhbnRhcmlsbGEgKE11cmNpYSksIG8gYmllbiBwb3IgRS1tYWlsIGEgcHJvdGVjY2lvbmRl ZGF0b3NAb2RpbnMuZXM8bWFpbHRvOnByb3RlY2Npb25kZWRhdG9zQG9kaW5zLmVzPiwgY29uIGVs IGZpbiBkZSBlamVyY2VyIHN1cyBkZXJlY2hvcyBkZSBhY2Nlc28sIHJlY3RpZmljYWNpw7NuLCBz dXByZXNpw7NuIChkZXJlY2hvIGFsIG9sdmlkbyksIGxpbWl0YWNpw7NuIGRlIHRyYXRhbWllbnRv LCBwb3J0YWJpbGlkYWQgZGUgbG9zIGRhdG9zLCBvcG9zaWNpw7NuLCB5IGEgbm8gc2VyIG9iamV0 byBkZSBkZWNpc2lvbmVzIGF1dG9tYXRpemFkYXMsIGluZGljYW5kbyBjb21vIEFzdW50bzogwrdE ZXJlY2hvcyBMZXkgUHJvdGVjY2nDs24gZGUgRGF0b3PCtywgeSBhZGp1bnRhbmRvIGZvdG9jb3Bp YSBkZSBzdSBELk4uSS4NCg== --_000_42f019ff036243f1afd9cb67f4517eb4aaltofi_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6eD0idXJuOnNjaGVtYXMtbWljcm9z b2Z0LWNvbTpvZmZpY2U6ZXhjZWwiIHhtbG5zOm09Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5j b20vb2ZmaWNlLzIwMDQvMTIvb21tbCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnL1RSL1JFQy1o dG1sNDAiPg0KPGhlYWQ+DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9 InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+DQo8bWV0YSBuYW1lPSJHZW5lcmF0b3IiIGNvbnRl bnQ9Ik1pY3Jvc29mdCBXb3JkIDE1IChmaWx0ZXJlZCBtZWRpdW0pIj4NCjx0aXRsZT5GaXJtYSBD b3JyZW88L3RpdGxlPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250 LWZhY2UNCgl7Zm9udC1mYW1pbHk6SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAy IDIgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFu b3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNh bGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5p dGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFy Z2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjpibGFjazt9DQphOmxpbmss IHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVl Ow0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVy bGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJ dGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAs IGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOmJsYWNrO30NCnNwYW4uRW1haWxTdHls ZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7 bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBX b3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4w cHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRz IHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1h cCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRp Zl0tLT4NCjwvaGVhZD4NCjxib2R5IGJnY29sb3I9IndoaXRlIiBsYW5nPSJFTi1VUyIgbGluaz0i Ymx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQiPkhpIERhbiBhbmQg UmFmYSw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6d2luZG93dGV4dCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQiPlRoYW5rIHlv dSBmb3IgdGhlIHF1ZXN0aW9ucyEgPG86cD4NCjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOndp bmRvd3RleHQiPlllcywgdGhlIEluaXRpYWwgRXhjaGFuZ2UgaW4gRUFQLU5PT0IgYWx3YXlzIGVu ZHMgaW4gRUFQLUZhaWx1cmUuJm5ic3A7IFRoZW4sIHdlIGdpdmUgc29tZSB0aW1lIGZvciB0aGUg dXNlciB0byB0cmFuc2ZlciB0aGUgT09CIG1lc3NhZ2UuIEFmdGVyIHRoZSBPT0Igc3RlcCwgdGhl IHBlZXIgdHJpZXMgYWdhaW4gYW5kIHRoZSBDb21wbGV0aW9uIEV4Y2hhbmdlIGVuZHMNCiBpbiBF QVAtU3VjY2Vzcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQiPlll cywgdGhlIG91dC1vZi1iYW5kIChPT0IpIG1lc3NhZ2UgaXMgY3J5cHRvZ3JhcGhpY2FsbHkgYm91 bmQgdG8gdGhlIEVDSEQgcmVzdWx0LiBUaGF0LCBpcyB0aGUgbWVzc2FnZSBhdXRoZW50aWNhdGlv biBjb2RlIChIb29iKSBpbiB0aGUgT09CIG1lc3NhZ2UgdGFrZXMgdGhlIEVDREggb3V0cHV0IGFz IG9uZSBvZiBpdHMgaW5wdXRzLg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk91ciBjdXJyZW50IGltcGxlbWVudGF0 aW9uIG9wcG9ydHVuaXN0aWNhbGx5IHRyaWVzIGFsbCB0aGUgVy1GaSBuZXR3b3JrIHRoYXQgc3Vw cG9ydCBXUEEyLUVudGVycHJpc2UuIEl0IGRlZmluaXRlbHkgd291bGQgYmUgYmV0dGVyIHRvIGFk dmVydGlzZSB0aGUgY2FwYWJpbGl0eSBmb3IgRUFQLU5PT0IgaW4gSUVFRSA4MDIuMTF1LCBvciBl dmVuIGFkdmVydGlzZSB0aGUgZG9tYWluIG9mIHRoZSBFQVAtTk9PQiBzZXJ2ZXIuDQogSSB0aGlu ayBpdCB3aWxsIHRha2Ugc29tZSB0aW1lIGJlZm9yZSB0aGUgODAyLjExIEFQcyBzdGFydCB0byBz dXBwb3J0IEVBUC1OT09CIGluIHRoYXQgd2F5LCB0aG91Z2gsIGFuZCB3ZSB3YW50IHRoZSBwcm90 b2NvbCB0byB3b3JrIHdpdGggZXhpc3RpbmcgV2ktRmkgbmV0d29ya3MuPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImNvbG9yOndpbmRvd3RleHQiPlRoZSByZWFsbSB1c2VkIGJ5IHRoZSBwZWVyIGlzIGluaXRp YWxseSDigJxlYXAtbm9vYi5uZXTigJ0uIFRoZSBzZXJ2ZXIgY2FuIGFzc2lnbiBhbm90aGVyIHJl YWxtIGluIEluaXRpYWwgRXhjaGFuZ2UuIFRoZSBtYWluIHB1cnBvc2UgZm9yIGFzc2lnbmluZyBh bm90aGVyIHJlYWxtIGlzIHRoYXQgdGhlIHBlZXIgY2FuIGxhdGVyIHVzZSBpdCBmb3Igcm9hbWlu ZyBpbg0KIGFjY2VzcyBuZXR3b3JrcyB0aGF0IGhhdmUgQUFBIHJvdXRpbmcgc2V0IHVwIGZvciB0 aGUgYXNzaWduZWQgcmVhbG0uIDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93 dGV4dCI+V2UgaGF2ZSBvbmx5IHRlc3RlZCBFQVAtTk9PQiBvbiBXaS1GaToNCjxhIGhyZWY9Imh0 dHBzOi8vZ2l0aHViLmNvbS90dW9tYXVyYS9lYXAtbm9vYiI+aHR0cHM6Ly9naXRodWIuY29tL3R1 b21hdXJhL2VhcC1ub29iPC9hPi4gSXQgY2FuIGJlIHVzZWQgb24gYW55IG5ldHdvcmtzIHRoYXQg c3VwcG9ydCBFQVAgYW5kIHdoZXJlIHRoZSB1c2VyLWFzc2lzdGVkIE9PQiBhdXRoZW50aWNhdGlv biBtZXRob2RzIG1ha2VzIHNlbnNlIGZyb20gdGhlIHVzZXIgZXhwZXJpZW5jZSBwZXJzcGVjdGl2 ZS4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJjb2xvcjp3aW5kb3d0ZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dCI+UmVnYXJkcyw8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6d2luZG93dGV4dCI+VHVvbWFzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjp3 aW5kb3d0ZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHls ZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4w cHQgMGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImNv bG9yOndpbmRvd3RleHQiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93 dGV4dCI+IEVtdSAmbHQ7ZW11LWJvdW5jZXNAaWV0Zi5vcmcmZ3Q7DQo8Yj5PbiBCZWhhbGYgT2Yg PC9iPkRhbiBHYXJjaWE8YnI+DQo8Yj5TZW50OjwvYj4gTW9uZGF5LCAyOCBKYW51YXJ5LCAyMDE5 IDEzOjM5PGJyPg0KPGI+VG86PC9iPiBlbXVAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4g W0VtdV0gUXVlc3Rpb25zIGFib3V0IEVBUC1OT09CPGJyPg0KPGI+SW1wb3J0YW5jZTo8L2I+IEhp Z2g8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+RGVhciBUb3VtYXMsIE1vaGl0LDwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+V2UgaGF2ZSBiZWVuIGRpc2N1c3NpbmcgRUFQIE5PT0IgZHJhZnQgd2Ugd291bGQgbGlrZSB0 byBhc2sgc29tZSBxdWVzdGlvbnMgYWJvdXQgaXQuIEl0IGlzIGEgdmVyeSBpbnRlcmVzdGluZyBh cHByb2FjaCByZWxhdGVkIHRvIElvVC4mbmJzcDsmbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48 YnI+DQo8YnI+DQo8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5JbiBFQVAtTk9PQiBhcyBmaXJzdCBzdGVw IHRoZSBFQVAgYXV0aGVudGljYXRvciBzdGFydHMgdGhlIGF1dGhlbmN0aW9uIChlLmcuIHRoZSBB UCksIGVhcC1ub29iIGhhcHBlbnMgYnV0IGl0IHNlZW1zIHRoZXJlIHdpbGwgYmUgYSBFQVAgZmFp bHVyZSAsIGlzIHRoaXMgY29ycmVjdD88L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5Bc3N1bWluZyBpdCBp cywgaWYgeW91IHNlbmQgYW4gRUFQIGZhaWx1cmUsIHdpbGwgdGhlIEVBUCBtZXRob2Qgc3RpbGwg Y29udGludWU/IEhvdyB3b3VsZCB0aGlzIHdvcms/IFNpbmNlIHdlIGFyZSB3YWl0aW5nLCB3ZSBh c3N1bWUsIGZyb20gYW4gRUFQIHN1Y2Nlc3MsIG9yIGFuIGFsdGVybmF0aXZlDQogd2F5IG9mIGNv bmZpcm1hdGlvbiB0aGF0IHRoZSBhdXRoZW50aWNhdGlvbiBoYXMgYmVlbiBjb21wbGV0ZWQuPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OyxzYW5zLXNlcmlmIj5JdCBzZWVtcyB0aGF0IHRoZSB1c2VyIGdldHMgc29tZXRoaW5n IGZyb20gdGhlIElvVCBkZXZpY2UgdGhpcyBzb21ldGhpbmcgaXMgZHVlIHRvIHRoZSBFQ0RILCBy aWdodD88L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPlJlZ2FyZGluZyB0aGUgZGlzY292ZXJ5IG9mIHRo ZSBFQVAgYXV0aGVudGljYXRvci4gVGhlIEFQIHNob3VsZCBhbm5vdW5jZSB3aGF0IGFyZSB0aGUg YXZhaWxhYmxlIGRvbWFpbnMgdG8gd2hlcmUgaXQgaXMgY29ubmVjdGVkICggYSBzb2x1dGlvbiBi YXNlZCBvbiB0aGUgQUFBIGluZnJhZXN0cnVjdHVyZQ0KID8pIENvdWxkIHRoaXMgaW5mb3JtYXRp b24gYmUgcHJvdmlkZWQgdG8gdGhlIEFQIHVzaW5nIElFRUUgODAyLjExdT88L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNh bnMtc2VyaWYiPlJlbGF0ZWQgdG8gdGhpcywgd2hhdCB3b3VsZCBiZSB0aGUgcmVhbG0gcHJvdmlk ZWQgYnkgdGhlIEVBUCBwZWVyIHRvIHRoZSBhdXRoZW50aWNhdG9yPzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+QW5vdGhlciBxdWVzdGlvbiB3b3VsZCBiZSB3aGljaCBhcmUgdGhlIG1haW4gcmFkaW8g dGVjaG5vbG9naWVzIHdoZXJlIEVBUCBOT09CIGlzIGV4cGVjdGVkIHRvIGJlIHVzZWQuIEFyZSB5 b3UgcGxhbm5pbmcgdG8gc3VwcG9ydCA4MDIuMTUuNCwgV0lGSSwgZXRjPyBJbiB0aGlzIGxpbmUs IGRvIHlvdQ0KIGhhdmUgYW55IEVBUC1OT09CIGltcGxlbWVudGF0aW9uIGluIENvbnRpa2k/PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+VGhhbmsgeW91IGluIGFkdmFuY2UuJm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+QmVzdCBSZWdhcmRzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkRhbiBhbmQg UmFmYS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQo8YnI+DQo8L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tLSA8YnI+DQo8c3BhbiBz dHlsZT0iZm9udC1zaXplOjEwLjBwdDtjb2xvcjojNzc3NTc1Ij49PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQ0KPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHRhYmxlIGNsYXNzPSJNc29Ob3JtYWxUYWJsZSIgYm9yZGVyPSIwIiBj ZWxsc3BhY2luZz0iNCIgY2VsbHBhZGRpbmc9IjAiPg0KPHRib2R5Pg0KPHRyPg0KPHRkIHN0eWxl PSJwYWRkaW5nOi43NXB0IC43NXB0IC43NXB0IC43NXB0Ij48L3RkPg0KPHRkIHdpZHRoPSIzMCIg c3R5bGU9IndpZHRoOjIyLjVwdDtwYWRkaW5nOi43NXB0IC43NXB0IC43NXB0IC43NXB0Ij48L3Rk Pg0KPHRkIHN0eWxlPSJwYWRkaW5nOi43NXB0IC43NXB0IC43NXB0IC43NXB0Ij4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiM3Nzc1 NzUiPkRhbiBHYXJjaWEgQ2FycmlsbG8sIFBoLkQuDQo8YnI+DQpEb2N0b3JhZG8gSW5kdXN0cmlh bCAoTUlORUNPKSA8YnI+DQpFLW1haWw6IDxhIGhyZWY9Im1haWx0bzpkZ2FyY2lhQG9kaW5zLmVz Ij5kZ2FyY2lhQG9kaW5zLmVzPC9hPiA8L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC90ZD4N CjwvdHI+DQo8L3Rib2R5Pg0KPC90YWJsZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTAuMHB0O2NvbG9yOiM3Nzc1NzUiPk9kaW4gU29sdXRpb25zLCBTLkwu DQo8YnI+DQpQb2zDrWdvbm8gSW5kdXN0cmlhbCBPZXN0ZSA8YnI+DQpDLyBQZXLDuiwgNSwgM8K6 LCBPZmljaW5hIDEyIDxicj4NCjMwODIwIC0gQWxjYW50YXJpbGxhIChNdXJjaWEpIC0gU3BhaW4g PGJyPg0KVGxmLjogJiM0MzszNCA5MDIgNTcwIDEyMSA8YnI+DQpXZWI6IDxhIGhyZWY9Imh0dHA6 Ly93d3cub2RpbnMuZXMiPnd3dy5vZGlucy5lczwvYT4gPGJyPg0KPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0gPGJyPg0KPC9z cGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny41cHQ7Y29sb3I6Izc3NzU3NSI+PGJyPg0KQVZJ U08gTEVHQUw6IExhIGluZm9ybWFjacOzbiBjb250ZW5pZGEgZW4gZXN0ZSBjb3JyZW8gZWxlY3Ry w7NuaWNvLCB5IGVuIHN1IGNhc28gZW4gbG9zIGRvY3VtZW50b3MgYWRqdW50b3MsIGVzIGluZm9y bWFjacOzbiBwcml2aWxlZ2lhZGEgcGFyYSB1c28gZXhjbHVzaXZvIGRlIGxhIHBlcnNvbmEgeS9v IHBlcnNvbmFzIGEgbGFzIHF1ZSB2YSBkaXJpZ2lkby4gTm8gZXN0w6EgcGVybWl0aWRvIGVsIGFj Y2VzbyBhIGVzdGUgbWVuc2FqZSBhIGN1YWxxdWllcg0KIG90cmEgcGVyc29uYSBkaXN0aW50YSBh IGxvcyBpbmRpY2Fkb3MuIFNpIHVzdGVkIG5vIGVzIHVubyBkZSBsb3MgZGVzdGluYXRhcmlvcywg Y3VhbHF1aWVyIGR1cGxpY2FjacOzbiwgcmVwcm9kdWNjacOzbiwgZGlzdHJpYnVjacOzbiwgYXPD rSBjb21vIGN1YWxxdWllciB1c28gZGUgbGEgaW5mb3JtYWNpw7NuIGNvbnRlbmlkYSBlbiDDqWwg byBjdWFscXVpZXJhIG90cmEgYWNjacOzbiB1IG9taXNpw7NuIHRvbWFkYSBlbiByZWxhY2nDs24g Y29uIGVsIG1pc21vLA0KIGVzdMOhIHByb2hpYmlkYSB5IHB1ZWRlIHNlciBpbGVnYWwuIEVuIGRp Y2hvIGNhc28sIHBvciBmYXZvciBub3RpZsOtcXVlbG8gYWwgcmVtaXRlbnRlIHkgcHJvY2VkYSBh IGxhIGVsaW1pbmFjacOzbiBkZSBlc3RlIGNvcnJlbyBlbGVjdHLDs25pY28sIGFzw60gY29tbyBk ZSBzdXMgYWRqdW50b3Mgc2kgbG9zIGh1YmllcmUuDQo8L3NwYW4+PG86cD48L286cD48L3A+DQo8 cD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuNXB0O2NvbG9yOiM3Nzc1NzUiPkFzaW1pc21vLCB5 IGVuIGN1bXBsaW1pZW50byBkZSBMZXkgT3Jnw6FuaWNhIDMvMjAxOCBkZSBwcm90ZWNjacOzbiBk ZSBkYXRvcyBkZSBjYXLDoWN0ZXIgcGVyc29uYWwgeSBnYXJhbnTDrWEgZGUgbG9zIGRlcmVjaG9z IGRpZ2l0YWxlcyB5IGRlbCBSZWdsYW1lbnRvIEV1cm9wZW8gUkdQRCA2NzkvMjAxNiBsZSBpbmZv cm1hbW9zIHF1ZSBzdXMgZGF0b3MgZXN0w6FuIHNpZW5kbw0KIG9iamV0byBkZSB0cmF0YW1pZW50 byBwb3IgcGFydGUgZGUgT0RJTiBTT0xVVElPTlMsIFMuTC4gY29uIE4uSS5GLiBCLTczLjg0NS44 OTMsIGNvbiBsYSBmaW5hbGlkYWQgZGVsIG1hbnRlbmltaWVudG8geSBnZXN0acOzbiBkZSByZWxh Y2lvbmVzIGNvbWVyY2lhbGVzIHkgYWRtaW5pc3RyYXRpdmFzLiBMYSBiYXNlIGp1csOtZGljYSBk ZWwgdHJhdGFtaWVudG8gZXMgZWwgY3VtcGxpbWllbnRvIGRlIGxhIGxlZ2lzbGFjacOzbiBmaXNj YWwsIG1lcmNhbnRpbA0KIHkgY29udGFibGUuIE5vIHNlIHByZXbDqW4gY2VzaW9uZXMgeS9vIHRy YW5zZmVyZW5jaWFzIGludGVybmFjaW9uYWxlcyBkZSBkYXRvcy4gUGFyYSBlamVyY2l0YXIgc3Vz IGRlcmVjaG9zIHB1ZWRlIGRpcmlnaXJzZSBhIE9ESU4gU09MVVRJT05TLCBTLkwuLCBkb21pY2ls aWFkYSBlbiBDLyBQZXLDuiwgNSwgM8K6LCBPZmljaW5hIDEyLCBQb2wuIEluZC4gT2VzdGUsIDMw ODIwIEFsY2FudGFyaWxsYSAoTXVyY2lhKSwgbyBiaWVuIHBvciBFLW1haWwgYQ0KPGEgaHJlZj0i bWFpbHRvOnByb3RlY2Npb25kZWRhdG9zQG9kaW5zLmVzIj5wcm90ZWNjaW9uZGVkYXRvc0BvZGlu cy5lczwvYT4sIGNvbiBlbCBmaW4gZGUgZWplcmNlciBzdXMgZGVyZWNob3MgZGUgYWNjZXNvLCBy ZWN0aWZpY2FjacOzbiwgc3VwcmVzacOzbiAoZGVyZWNobyBhbCBvbHZpZG8pLCBsaW1pdGFjacOz biBkZSB0cmF0YW1pZW50bywgcG9ydGFiaWxpZGFkIGRlIGxvcyBkYXRvcywgb3Bvc2ljacOzbiwg eSBhIG5vIHNlciBvYmpldG8gZGUgZGVjaXNpb25lcw0KIGF1dG9tYXRpemFkYXMsIGluZGljYW5k byBjb21vIEFzdW50bzogwrdEZXJlY2hvcyBMZXkgUHJvdGVjY2nDs24gZGUgRGF0b3PCtywgeSBh ZGp1bnRhbmRvIGZvdG9jb3BpYSBkZSBzdSBELk4uSS4NCjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_42f019ff036243f1afd9cb67f4517eb4aaltofi_-- From nobody Wed Mar 6 04:45:03 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1BC0E1289FA for ; Wed, 6 Mar 2019 04:45:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 606XeU3VY0mP for ; Wed, 6 Mar 2019 04:44:57 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 9D7BD1292F1 for ; Wed, 6 Mar 2019 04:44:57 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 1EFCF2A0; Wed, 6 Mar 2019 12:44:56 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Alan DeKok In-Reply-To: <42f019ff036243f1afd9cb67f4517eb4@aalto.fi> Date: Wed, 6 Mar 2019 07:45:01 -0500 Cc: Dan Garcia , "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <1A69D852-25F4-40B7-8A8D-434CECB586D6@deployingradius.com> References: <26418_1548675555_5C4EE9E1_26418_441_1_e069870a-1233-fb27-5f07-13da2df1e138@odins.es> <42f019ff036243f1afd9cb67f4517eb4@aalto.fi> To: Aura Tuomas X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Emu] Questions about EAP-NOOB X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Mar 2019 12:45:00 -0000 On Mar 6, 2019, at 7:23 AM, Aura Tuomas wrote: > The realm used by the peer is initially =E2=80=9Ceap-noob.net=E2=80=9D. = The server can assign another realm in Initial Exchange. The main = purpose for assigning another realm is that the peer can later use it = for roaming in access networks that have AAA routing set up for the = assigned realm.=20 This is fine for an initial draft. I'd avoid implementing anything = that uses "eap-noob.net", though. The correct domain to use is .arpa: https://www.iana.org/domains/arpa The controlling document here is RFC 3172. It looks like EAP-TEAP-BRSKI requires a similar NAI for provisioning. = So it would best best to coordinate both the name, and the use of it. = Perhaps "provisioning.arpa" could be used as a generic name, and then = subdomains within that could be used for particular purposes. Alan DeKok. From nobody Wed Mar 6 05:28:10 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 600901277DB; Wed, 6 Mar 2019 05:27:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u2kAun65Ay_w; Wed, 6 Mar 2019 05:27:12 -0800 (PST) Received: from aer-iport-2.cisco.com (aer-iport-2.cisco.com [173.38.203.52]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 19563127979; Wed, 6 Mar 2019 05:27:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3970; q=dns/txt; s=iport; t=1551878832; x=1553088432; h=from:mime-version:subject:message-id:date:to; bh=ZAJ6jGWhOiN5Vx6t6lpfBXpKMlic2tWVX4iLH2ATqtk=; b=WHrSHTke8p0sA9Dt6nNM/FcpiZSVkmrr2ATX88UJc/dgtPCln6d2eFpG tLIO3WW8Gr6vhRu8L/CUaTcZq0HyOiXjbgdeahQg0DndETJey1LXQunzx Ne8RbQc3TWPtn7Ygbbbds9xaZX10QzAIHtYl+lrzz0jTf8o9u3xCdaoNj o=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ClAADYyX9c/xbLJq1kHAEBAQQBAQc?= =?us-ascii?q?EAQGBVAQBAQsBgndxEieECIh5nyiHbggDAQEjiR43Bg0BAQMBAQMBAwJtHAy?= =?us-ascii?q?FdHUBOgMCSBcBEoMiAYF1D6sdgS+KHAoFgS8BgUiJd4F/gTgfgh8Bg0oChGs?= =?us-ascii?q?xgiYCjBiFHZJaCYRUgnWLNxmKfogxim+FX4llgm0CBAYFAhSBXSKBVjMaCBs?= =?us-ascii?q?VZQGCQT6FOopUPgMwjhUBAQ?= X-IronPort-AV: E=Sophos;i="5.58,448,1544486400"; d="asc'?scan'208,217";a="10577222" Received: from aer-iport-nat.cisco.com (HELO aer-core-4.cisco.com) ([173.38.203.22]) by aer-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Mar 2019 13:27:09 +0000 Received: from [10.61.245.251] ([10.61.245.251]) by aer-core-4.cisco.com (8.15.2/8.15.2) with ESMTPS id x26DR8W3027087 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 6 Mar 2019 13:27:08 GMT From: Eliot Lear Content-Type: multipart/signed; boundary="Apple-Mail=_90011D31-8FEC-41CD-824D-D9EECF95D7B2"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Message-Id: <1861142E-CA19-49FD-B84E-C8CBA827D1A0@cisco.com> Date: Wed, 6 Mar 2019 14:27:07 +0100 To: anima@ietf.org, opsawg@ietf.org, iot-dir , emu@ietf.org, 6tisch@ietf.org, iot-onboarding@ietf.org X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.245.251, [10.61.245.251] X-Outbound-Node: aer-core-4.cisco.com Archived-At: Subject: [Emu] On boarding again X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Mar 2019 13:27:27 -0000 --Apple-Mail=_90011D31-8FEC-41CD-824D-D9EECF95D7B2 Content-Type: multipart/alternative; boundary="Apple-Mail=_CC22EA77-F876-456B-990C-1A173EF746E2" --Apple-Mail=_CC22EA77-F876-456B-990C-1A173EF746E2 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi everyone, For those who are interested in discussing onboarding, I=E2=80=99ve = reserved an hour on Wednesday afternoon (27 Mar) at 14:00 at the IETF in = Karlin 3. Since our last conversation, a few of us put a bit of an = inventory together, regarding the mechanisms that are available. Some = of the questions we have Aren=E2=80=99t Quite There Yet, but at least = the inventory is coming along. Goal of discussion this time around would a shared understanding of how = these mechanisms work, what sort of commonality they have, and to = perhaps have some notion of applicability of each. For your entertainment, you can take a look at a table=E2=80=A6 it=E2=80=99= s a Github table so you have to scroll a bit- see = https://github.com/iot-onboarding/catalog/blob/master/Onboard-Table.md = . = Feel free to issue PRs. Also, feel free to agenda bash on iot-onboarding@ietf.org = . Eliot --Apple-Mail=_CC22EA77-F876-456B-990C-1A173EF746E2 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = everyone,

For those = who are interested in discussing onboarding, I=E2=80=99ve reserved an = hour on Wednesday afternoon (27 Mar) at 14:00 at the IETF in Karlin 3. =  Since our last conversation, a few of us put a bit of an inventory = together, regarding the mechanisms that are available.  Some of the = questions we have Aren=E2=80=99t Quite There Yet, but at least the = inventory is coming along.

Goal of discussion this time around  would a shared = understanding of how these mechanisms work, what sort of commonality = they have, and to perhaps have some notion of applicability of = each.

For your = entertainment, you can take a look at a table=E2=80=A6 it=E2=80=99s a = Github table so you have to scroll a bit- see https://github.com/iot-onboarding/catalog/blob/master/Onboard-T= able.md.  Feel free to issue PRs.

Also, feel free to agenda bash on iot-onboarding@ietf.org.

Eliot
= --Apple-Mail=_CC22EA77-F876-456B-990C-1A173EF746E2-- --Apple-Mail=_90011D31-8FEC-41CD-824D-D9EECF95D7B2 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlx/yqsACgkQh7ZrRtnS ejOx8gf8DXTBCSH9tnZt9nQN8l7LMw3qT8prii5Fgty8s4nuxJ5RaGrRz/ZQ6lvc MsxtTVgZ+8nore496k4bAXvwLDs3DLusZVKQ3cuQJ8iS6ywapA150T8DV21rRkLe IRpldJ4WIitJxXWFybfoZ6hIGXK9wtRbSnH32f2pBwLgdUsqlyOQwvKSBJ+kMgqD R/fOpHB1KFyNGVcwBlJzvnXTBMo110cJuoIurxg65kd4AtW3IKvh39CWfs04hQ0N /1ShdYSqpJgkcg7/C/CXLuNWkPjB5Qs5+dmk4r/x55Ja7duf1B96Q7/AYCorfQNE pcu671PMkYbaj4s1iqz4+uwlwcRBFw== =g/OO -----END PGP SIGNATURE----- --Apple-Mail=_90011D31-8FEC-41CD-824D-D9EECF95D7B2-- From nobody Wed Mar 6 05:30:22 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D042612008F for ; Wed, 6 Mar 2019 05:30:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.49 X-Spam-Level: X-Spam-Status: No, score=-14.49 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LUDu2zwVaXDY for ; Wed, 6 Mar 2019 05:30:11 -0800 (PST) Received: from aer-iport-2.cisco.com (aer-iport-2.cisco.com [173.38.203.52]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 87E061279A1 for ; Wed, 6 Mar 2019 05:30:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4936; q=dns/txt; s=iport; t=1551879011; x=1553088611; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=8rwqnqw5NTZASHP6tipqLXvbXBUxGodL+Q4iwtXjBJ8=; b=UAPsLvIMZ/PBek+MPjUVBb2Z3tjW/B2pGGGOKRDyJ6yj97BdTt+WXeoh fPPc6/DYoqqgR0Pp0u1xMbQXRpQsdiCtKszHvFHjqf+7qVsCFDWyLin8y oDuhzpdcHeZm4FFpVYwmqbTa1b5mz+PRMoZ70oNGjyfOdgepdR8zpOkv3 A=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DmAADYyn9c/xbLJq1kGwEBAQEDAQE?= =?us-ascii?q?BBwMBAQGBZYEOgWpxEieECIh5jFMlkjCHbggDAQEbhFEChFM4EgEBAwEBAwE?= =?us-ascii?q?DAm0cDIVKAQEBAwEjVgULCwQUKgICVwYTgyIBgW0IqyWBL4VEhFgPgS+BSYl?= =?us-ascii?q?3gX+BEScME4JMhGuDIDGCJgKRNZJaCYRUgnWLNxmKfogxkE6JZYJtAgQGBQI?= =?us-ascii?q?UgV4hgVYzGggbFWUBgkEJNYoThXs+AzCOFQEB?= X-IronPort-AV: E=Sophos;i="5.58,448,1544486400"; d="asc'?scan'208,217";a="10577313" Received: from aer-iport-nat.cisco.com (HELO aer-core-3.cisco.com) ([173.38.203.22]) by aer-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Mar 2019 13:30:09 +0000 Received: from [10.61.245.251] ([10.61.245.251]) by aer-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id x26DU7s7021281 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 6 Mar 2019 13:30:08 GMT From: Eliot Lear Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_E86CADB1-3085-4781-AF88-CD639C62ADEF"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Wed, 6 Mar 2019 14:30:07 +0100 In-Reply-To: <42f019ff036243f1afd9cb67f4517eb4@aalto.fi> Cc: Dan Garcia , "emu@ietf.org" To: Aura Tuomas References: <26418_1548675555_5C4EE9E1_26418_441_1_e069870a-1233-fb27-5f07-13da2df1e138@odins.es> <42f019ff036243f1afd9cb67f4517eb4@aalto.fi> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.245.251, [10.61.245.251] X-Outbound-Node: aer-core-3.cisco.com Archived-At: Subject: Re: [Emu] Questions about EAP-NOOB X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Mar 2019 13:30:21 -0000 --Apple-Mail=_E86CADB1-3085-4781-AF88-CD639C62ADEF Content-Type: multipart/alternative; boundary="Apple-Mail=_6A0E7D20-DDF0-4994-97F6-D1F793D5FBC4" --Apple-Mail=_6A0E7D20-DDF0-4994-97F6-D1F793D5FBC4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Aura, Just on this one point: > On 6 Mar 2019, at 13:23, Aura Tuomas wrote: >=20 >=20 > The realm used by the peer is initially =E2=80=9Ceap-noob.net = =E2=80=9D. The server can assign another realm in = Initial Exchange. The main purpose for assigning another realm is that = the peer can later use it for roaming in access networks that have AAA = routing set up for the assigned realm. >=20 Since this is going to be somewhat common between new mechanisms as a = routing function (and it=E2=80=99s a very good idea!), it makes sense = for the realm to be properly registered as a protocol parameter. A few = of us had a discussion about this. The suggestion was made that this = should fall under the .ARPA domain, so that it is properly reserved. I = propose that we discuss this a bit in Prague. (FWIW, I didn=E2=80=99t = come up with the .ARPA idea, but I like it). Eliot --Apple-Mail=_6A0E7D20-DDF0-4994-97F6-D1F793D5FBC4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Aura,

Just on this = one point:

On 6 Mar 2019, at 13:23, Aura Tuomas <tuomas.aura@aalto.fi> wrote:


The realm used by the peer is initially =E2=80=9Ceap-noob.net=E2=80=9D. The server can assign = another realm in Initial Exchange. The main purpose for assigning = another realm is that the peer can later use it for roaming in access = networks that have AAA routing set up for the assigned realm. 
 

Since this is going to be somewhat common between new = mechanisms as a routing function (and it=E2=80=99s a very good idea!), = it makes sense for the realm to be properly registered as a protocol = parameter.  A few of us had a discussion about this.  The = suggestion was made that this should fall under the .ARPA domain, so = that it is properly reserved.  I propose that we discuss this a bit = in Prague.  (FWIW, I didn=E2=80=99t come up with the .ARPA idea, = but I like it).

Eliot

= --Apple-Mail=_6A0E7D20-DDF0-4994-97F6-D1F793D5FBC4-- --Apple-Mail=_E86CADB1-3085-4781-AF88-CD639C62ADEF Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlx/y18ACgkQh7ZrRtnS ejMETQgAk4Pxj22JarTQ6oSovcKBjuuVClkWqjvPexDExQhzO/i9bDc8O51KLl5b jZOPwxbPJSUWvSugwiuB6Z9wQ0J6KBk/DweN5GI7/jkVSwn6+sMftm/pe8/eutps MaCz1xrOS+MJRd0huBSaqYc/JmWtRY1Ld7M+eXtHaaM4jQZ1amiHGGeFBhAz/eW0 QIBVrTWmP4KaItK3NsKImGs854yTkRFTYEjI6pxgtPnK1edxIiHR1YEhK6aVwBq3 CDfficiZaPH0FefWkvVwusq1Hq8dUcVdscOWqB6LCmh9qhZNYBNoNDFJUYRWdzYx R1rF/138/JKooF3kKcVGgeUJojhzGQ== =UagT -----END PGP SIGNATURE----- --Apple-Mail=_E86CADB1-3085-4781-AF88-CD639C62ADEF-- From nobody Wed Mar 6 05:31:09 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 87B9812799B for ; Wed, 6 Mar 2019 05:31:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vy6cDRAT-kln for ; Wed, 6 Mar 2019 05:31:02 -0800 (PST) Received: from aer-iport-2.cisco.com (aer-iport-2.cisco.com [173.38.203.52]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BDB41294B6 for ; Wed, 6 Mar 2019 05:31:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2266; q=dns/txt; s=iport; t=1551879061; x=1553088661; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=vER/g4QeXJuSv+ujWUMe7WdO7+aC/ctbrZ8rXDDE7RM=; b=WLWc5S0ITkdEZgzWxeCPNP5Aqo+r6Y8n3jYfNL+MK8k/7T5M3NSNxl3D VBEAWTzjXuVSke9NB7O9yPY8gG0kapzICneMvTOR3Nn/B3MePXNyMUZv+ ecuY6tz8MTcxK4/+tFdISVZxfEbBq83ncVhL9iUO9Qy5Xp7jC1ZZQqvZ5 8=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0A9AADYyn9c/xbLJq1kGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBZYJ4cRInhAiIeYx4mh4IAwEBGAuESQKEUzgSAQEDAQE?= =?us-ascii?q?DAQMCbRwMhUoBAQEDAQEBIUsLBQsLGCoCAicwBhODIgGBbQgPqxaBL4VEhFg?= =?us-ascii?q?PgS+BSYl3gX+BEScfgkyDHgEBgUuDIDGCJgKJcoZ3TJJaCYRUgnWLNxmCTog?= =?us-ascii?q?wiDGaM4JtAgQGBQIUgV4hgVYzGggbFTsqAYJBCTWDaoYpO4VAPgMwjhUBAQ?= X-IronPort-AV: E=Sophos;i="5.58,448,1544486400"; d="asc'?scan'208";a="10577319" Received: from aer-iport-nat.cisco.com (HELO aer-core-3.cisco.com) ([173.38.203.22]) by aer-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Mar 2019 13:30:59 +0000 Received: from [10.61.245.251] ([10.61.245.251]) by aer-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id x26DU7s8021281 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 6 Mar 2019 13:30:58 GMT From: Eliot Lear Message-Id: <8E1E0840-C82B-4AE7-A6F2-106FC9834A1A@cisco.com> Content-Type: multipart/signed; boundary="Apple-Mail=_25DC0DC6-5B5A-4E4A-986F-F8CB67E18725"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Wed, 6 Mar 2019 14:30:58 +0100 In-Reply-To: <1A69D852-25F4-40B7-8A8D-434CECB586D6@deployingradius.com> Cc: Aura Tuomas , "emu@ietf.org" To: Alan DeKok References: <26418_1548675555_5C4EE9E1_26418_441_1_e069870a-1233-fb27-5f07-13da2df1e138@odins.es> <42f019ff036243f1afd9cb67f4517eb4@aalto.fi> <1A69D852-25F4-40B7-8A8D-434CECB586D6@deployingradius.com> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.245.251, [10.61.245.251] X-Outbound-Node: aer-core-3.cisco.com Archived-At: Subject: Re: [Emu] Questions about EAP-NOOB X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Mar 2019 13:31:09 -0000 --Apple-Mail=_25DC0DC6-5B5A-4E4A-986F-F8CB67E18725 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 And indeed it was Alan who I was referring to in my message. I = generally agree with Alan=E2=80=99s thinking below. Eliot > On 6 Mar 2019, at 13:45, Alan DeKok wrote: >=20 > On Mar 6, 2019, at 7:23 AM, Aura Tuomas wrote: >> The realm used by the peer is initially =E2=80=9Ceap-noob.net=E2=80=9D.= The server can assign another realm in Initial Exchange. The main = purpose for assigning another realm is that the peer can later use it = for roaming in access networks that have AAA routing set up for the = assigned realm. >=20 > This is fine for an initial draft. I'd avoid implementing anything = that uses "eap-noob.net", though. >=20 > The correct domain to use is .arpa: >=20 > https://www.iana.org/domains/arpa >=20 > The controlling document here is RFC 3172. >=20 > It looks like EAP-TEAP-BRSKI requires a similar NAI for provisioning. = So it would best best to coordinate both the name, and the use of it. = Perhaps "provisioning.arpa" could be used as a generic name, and then = subdomains within that could be used for particular purposes. >=20 > Alan DeKok. >=20 > _______________________________________________ > Emu mailing list > Emu@ietf.org > https://www.ietf.org/mailman/listinfo/emu --Apple-Mail=_25DC0DC6-5B5A-4E4A-986F-F8CB67E18725 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlx/y5IACgkQh7ZrRtnS ejOieQf/dc3za9LnqwZeXFMlG9bcbOq9fOHL5kMTkwn/b4Op6DjDxbSn/QgnVyYp vZ1dJrUqzd65ZPKMP0XADkRZwhLP2d7OvS+v1h5p4LIap2WI3r/hE2B3kHkzlCbr WZwE6MmWg+Is3tBW8/wVivUQxVG+kBJkl7Dj2qG7oEe3gEHVSxMOmLXzuSnErF0o rktFdRGJJnjKhs9XRDJ4xGaN37Ux63fvKTQMKnP7XlyOesPdVLQGkD+hpDD3hXe9 IPVrGJkmYyiaKb8aKB2Kunx7hXaABR+EnFD1AZI9DRFmM43JOIGSaipdDglNlE9q eDywUeY3AC3hUm8jTccwAI6l2pH+tw== =BFvW -----END PGP SIGNATURE----- --Apple-Mail=_25DC0DC6-5B5A-4E4A-986F-F8CB67E18725-- From nobody Wed Mar 6 12:03:44 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C02EC12EB11 for ; Wed, 6 Mar 2019 12:03:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.302 X-Spam-Level: X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=MdzydKXV; dkim=pass (1024-bit key) header.d=ericsson.com header.b=G/hrJfYk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mRxYu8GsWAVC for ; Wed, 6 Mar 2019 12:03:39 -0800 (PST) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 85639131187 for ; Wed, 6 Mar 2019 12:03:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1551902617; x=1554494617; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=G6Ktcg8OQmJQ5kOnNmTC40mvGcS6HA01xIxUbse/j6A=; b=MdzydKXVYnt5XJVNLoY/f3Z9Jp1HR8p+++8ElJGBd2LEXXYdjmOqIY1oSzX94fmp p6qwhQCXRfXAsjvVRrioeIGPpDlESD/5ANuzENgwVQuHK6iQAsApahxxAUhN1b5A Ohf3Hif80eYvDlOKmsEQDVp57QLcjlzuBzICRYS3FVo=; X-AuditID: c1b4fb3a-5c9c29e00000672c-5d-5c802799f0df Received: from ESESBMB501.ericsson.se (Unknown_Domain [153.88.183.114]) by sessmg22.ericsson.net (Symantec Mail Security) with SMTP id D6.C5.26412.997208C5; Wed, 6 Mar 2019 21:03:37 +0100 (CET) Received: from ESESBMR503.ericsson.se (153.88.183.135) by ESESBMB501.ericsson.se (153.88.183.114) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Wed, 6 Mar 2019 21:03:32 +0100 Received: from ESESBMB501.ericsson.se (153.88.183.168) by ESESBMR503.ericsson.se (153.88.183.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Wed, 6 Mar 2019 21:03:31 +0100 Received: from EUR04-VI1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB501.ericsson.se (153.88.183.168) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Wed, 6 Mar 2019 21:03:31 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=G6Ktcg8OQmJQ5kOnNmTC40mvGcS6HA01xIxUbse/j6A=; b=G/hrJfYkVdWFBYcGqfVlpZk8UtixwTubcJswGjkIU97j/Z51vtvXpgsfzm+BNfH0UZIVPPOc+qK/RIrrIH/Di9ksZOqqq2oNKp29UG7YZ6yBaJhnhJ+n5htdZZFqXl3dLUg8zFDKlLSb6sxCvBeh6sG3ywTp3H2bhxGgn/2nfiA= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3498.eurprd07.prod.outlook.com (10.170.247.157) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1686.16; Wed, 6 Mar 2019 20:03:29 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8%3]) with mapi id 15.20.1686.016; Wed, 6 Mar 2019 20:03:29 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: [Emu] Notes on session resumption with TLS-based EAP methods Thread-Index: AQHU1FeqEvyBJIfLwEi2z5vjTgpvnQ== Date: Wed, 6 Mar 2019 20:03:29 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 0c2fe756-b260-461f-58b3-08d6a26ecd8b x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3498; x-ms-traffictypediagnostic: HE1PR07MB3498: x-microsoft-exchange-diagnostics: =?utf-8?B?MTtIRTFQUjA3TUIzNDk4OzIzOnFaUm9lVGJJWnZ0R1dXY3pMS2RoQnJycVJC?= =?utf-8?B?VnJHUkFDeDRTS1NNdTJVNlBxZ05DV1VQTFlaR2lRaVZGdEtVdVVqMWszaFpm?= =?utf-8?B?M3VhU25DTHUwRlgyNlJzUWV4UVd1SWdzL2ZHNG5ybG9LNHVNM3RwZlJXNm5B?= =?utf-8?B?ODQycnNLODhoSGduWVk0MG9RRUZHR1JJTDdPUGpueEdwUjQxWnpoMkFaa2Y5?= =?utf-8?B?dERXOTBCaDFMM092bG5jS2RsVTA5Y3pxWnkvSFIyVFVPb0xwYVBRanhkTVEv?= =?utf-8?B?aGM4ZWkrVklLTHRQa3JMMlRvUWR0WWJteUFoeDBwMjRwRlVLZGpsWWtDNUow?= =?utf-8?B?TGIvWHhPLzRyS0RVNXJQS0d5cGVPelNMbEF6cTZoUXNjTFVhL3ZYc0phVWdK?= =?utf-8?B?TkkrbkxRbU1YdG1FemlkOUpHbGtFZmNsU25hdVNSRTlXTWhrektvaFZkZ24v?= =?utf-8?B?YTg5dm1wWGljd1dmY0NnY0Y1Tjc2WDliSzNCM1NudE9xTE44N1BJaTJwejVj?= =?utf-8?B?WWJwVHBZWGx2cXZORjhPT1lnL2VQNExyRmNUeEhMMWx5c1JOeU96QktvbEUr?= =?utf-8?B?enM1R1lINkc1cG00a0RiYmQ1Zlk1Z0NKRlM5b2piTnoxWXNDRkRaaSsyV1FU?= =?utf-8?B?eVFoYnpyUnE4b1F1aDJBQ2VTUzhwSlZvbGx5c3lKY3c1OWpSVWxSRks0NkNn?= =?utf-8?B?cTVuTmxzZDZHdUhyWC84UHI5cUlwRzAycG1pWUVHWDV4WlF4RTlJc2JaZmw3?= =?utf-8?B?Zjc4TVVxYUpDZko1emk3Mk9VN1Z6blFjM3NJdzVLelZtVisxcW9BVXJ1cmsv?= =?utf-8?B?bTFDRlpmOHJOODJaNG51VWVTUXI3THp3MlhaUXMrUVNjS2hrenRzN0hhY2RW?= =?utf-8?B?NW5vUWxIRkYrU2o4VzBYUGw1MXpVZHZNM0hnS3dHSGFKQkRuUzNZVVArMG5O?= =?utf-8?B?ZHRTR1lBeEpaeHVNQWtMOVM4SlcxQW4zMktKZ0kvVUNvd0UzTDlwdUxBQURC?= =?utf-8?B?L1NsZ3RnYUtrWFYxTnF6WDRkZjRUVDA3NmhGdW1JSUk1TE5nUzFqMkdIaFh6?= =?utf-8?B?SjBrQXIvTTNNUW8vSy9lYklxS0IxUCs0dWRVbmwxOHUrcUUvMmRGb2FlUVhF?= =?utf-8?B?TUdEQmV0eGRydlg4eEw2T1hZUDZLY045dWNmT1I2NGgrV3pVKzd4Y1ZiZ0dh?= =?utf-8?B?anhnWmxFb3QrVFR3TEt6cno2cVVOSVZHZFgvTWxJUWRNSHJUVUhrS1VYbE92?= =?utf-8?B?ZlNvUkRvTzNQOUJyclBWdU5nSFhBSVZ0eUFESkVYVjhJR1hQZSt1cFRoZGJC?= =?utf-8?B?d1FOQStrcjBhR3JwaHVlMkxCaFdJQ0Q5OTNqOUVRZXV4T3VtQ0ozenhoMjJu?= =?utf-8?B?UEduOXFwSkh6ME5UcTlBTHBsUkdlS1pOMDZMRXVNTGNkZXA0TU54TFJnYTQr?= =?utf-8?B?QUIyc1JCRDhyc3BSME5peEF2VzJWQmYvSVh4VldpdDQydGRjL1NhdU9DMWpw?= =?utf-8?B?Y3VmNkE4MHQ4RGZjWHdhQ241OE9HN3VLZ1RucmNKWmRmV0tiR1h6R25SQUQ2?= =?utf-8?B?d2NIUzh4U1NvSVJpYzBPOHh1cElkVG04cUNZR3JTYUVhK285VnFITVF0VzdH?= =?utf-8?B?OE5KalYxZjRRMHV0SjFNM1kxNlhBTStzTi9TNXhRTTdvbitXU2NTdVVjKzdR?= =?utf-8?B?ZnEzZkNJZ1RKN3p6QkdMVEtFK1I4N21xbTB1OUEydHkwQythcC84Y3NqazNH?= =?utf-8?B?WUo1cVFNOEhXVTk3YzJCMlJwUXA3elBReHBuSTFZMXZ0OXVEdVhNalBCYTFl?= =?utf-8?Q?i0Bli2yKFGXZp?= x-microsoft-antispam-prvs: x-forefront-prvs: 0968D37274 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(366004)(136003)(396003)(39860400002)(376002)(51914003)(189003)(199004)(81166006)(1730700003)(81156014)(99286004)(6436002)(97736004)(5640700003)(186003)(83716004)(6486002)(5660300002)(305945005)(33656002)(6116002)(6916009)(3846002)(14454004)(229853002)(102836004)(8676002)(476003)(53936002)(2906002)(26005)(66066001)(2616005)(7736002)(478600001)(44832011)(486006)(14444005)(6246003)(36756003)(105586002)(8936002)(71190400001)(58126008)(71200400001)(106356001)(2351001)(2501003)(6506007)(68736007)(25786009)(256004)(86362001)(6512007)(82746002)(316002)(558084003); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3498; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: j5/nMkDDSemKuzMSDx+/BYo6hOGh5SbP3t7FkoEAzfttvRfDzYfJPXFw88msolpsM2Hyo55wtHdAnHonx17nHQK9qlXupZ2bkO90k5msiZVgOAe7zl5nLIYiCegq+nEuMG1X8aU1TeZxqp9jIJpYU9VJK1cpm7sa5Z0n9y852LJDspMasPgvySJAr+K422Wo2JcMOrYvAtFVwrYYZ/l8SoenPTwJc/zCpT2qI60aLlcNA0XyvV2f7u3VagOwvScqOCsfkaTYWzGTN7B9PagkfVL1fLJuE4ME9Zx2e8z7lwQQ4fgPxlmPgjcKpp7c+y7C80prg8oYBYd3fN4JB1xpsde0ZWcxdzy5Bn3GTNNwzpvnSQjbsEDCao7QsfGN7XPHyeKVTnR1qkO1E8FmvocxlDtd9i3zkT3p6/Pa26/y+zQ= Content-Type: text/plain; charset="utf-8" Content-ID: <845F9B97E97EE34D84EDDCCDC515466D@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 0c2fe756-b260-461f-58b3-08d6a26ecd8b X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Mar 2019 20:03:29.6416 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3498 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA02SfUhTURjGO/febdfh6LicvllKLrESnB/0h4WkEolFRhhKxEJX3nTopu2q aUTNcJKKoija/EDJSTImoimpLb+YQfaJiGRBaa1aJVGxdJpYu94V/fd7n+d9OOc5HJqUGgQB tFpbwOi0qly5UEwZT9/VhRv36JWRXV2RMQ96e6h4lGQyrRIn0RlxbCaTqy5idBGHMsTZs6ML onwLUXy/rprQIxNRibxowPthqLNWWInEtBTbEDyfK6P44SeClbdO0b/Bul5OcREp7iRgZDiI MyhcS0L/7IDHqCegok3BJ94g+G1aQpwhxJHQZtULOfbFweCaKSc53oaPwqD5sUc/Bq3T3yme FTA3NrXJFA4B89qUe4emJTgOxmzenIywH6xMWzY7kNgfXtrbPX0wmKzPSJ5l8OndhoBjGY6A gZoFis+eBYOhScDvBMOj0W7PfiDMtFchnpPhusOAuC6A5xHYLV8o3giDr5Yhj2GQQsvahMfI gablp4i7KOCd0HP9AC87BTD/KoR/IAZu9xg8BwSBuXqRqkXhzf91aHanSbwPekcieDkJXlR8 IHkOhoaqRRHHEuwDD412qgMJzEjGMiyryYqOVjA69XmWzdMqtExBP3J/jomBXweH0MTHhEmE aST3llyV6ZVSgaqILdFMIqBJua/kSLBbkmSqSi4zurx0XWEuw06iHTQl95esS32UUpylKmBy GCaf0f11CdorQI+UibcGGxti75XViVOvtewK0DRmlFaVMpW4ONA593pj+0VC1HfznPa4K2pc +WTQXk+F4q2hhcknTsXVqNMKL/04PL8ynDZrS1x1RrsSHGtb3ocHhdzxWp5O726NYTv8nDdq bGmuMYFjN9WeYhn/1nchfnXvlSVjioOKSiU1n61yis1WRYWROlb1B6Wma5UYAwAA Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Mar 2019 20:03:42 -0000 VGhhbmtzIGZvciB0aGUgc3VnZ2VzdGVkIHNlY3VyaXR5IGNvbnNpZGVyYXRpb24gQWxhbiEgVGhp cyBoZWxwcyBhIGxvdCENCg0KSSdsbCB3aWxsIHdvcmsgd2l0aCB1cGRhdGluZyB0aGUgZHJhZnQg ZHVyaW5nIHRoZSBuZXh0IGRheXMuIFlvdXIgc3VnZ2VzdGVkIHRleHQgbG9vayB2ZXJ5IGdvb2Qg YXQgYSBmaXJzdCByZWFkdGhyb3VnaC4NCg0KQ2hlZXJzLA0KSm9obg0KDQoNCg0K From nobody Wed Mar 6 18:40:19 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 878BE13132C for ; Wed, 6 Mar 2019 18:40:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1GBDMGsonkH6 for ; Wed, 6 Mar 2019 18:40:16 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 0AFFC13131E for ; Wed, 6 Mar 2019 18:40:16 -0800 (PST) Received: from [192.168.2.16] (unknown [47.52.111.246]) by mail.networkradius.com (Postfix) with ESMTPSA id A227AE4; Thu, 7 Mar 2019 02:40:13 +0000 (UTC) From: Arran Cudbard-Bell Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_0C9EE6A6-0117-4C42-AC78-31F38F98BC46"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Thu, 7 Mar 2019 10:40:08 +0800 In-Reply-To: <1DDE7ED1-C539-4E11-81F8-EF557E2F6EB2@deployingradius.com> Cc: EMU WG To: Alan DeKok References: <84FA2D8F-17EF-4611-81E5-FCDD2C611423@ericsson.com> <8EC98343-E2F7-42DD-9962-EC89865039E1@deployingradius.com> <1DDE7ED1-C539-4E11-81F8-EF557E2F6EB2@deployingradius.com> X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2019 02:40:18 -0000 --Apple-Mail=_0C9EE6A6-0117-4C42-AC78-31F38F98BC46 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > The solution to this conundrum is to associate authentication > credentials and authorization information with the original > authentication. That information can then be obtained and applied > during resumption. >=20 > There are two ways to make this association. The first method is = via > [RFC5077], 'session tickets for TLS versions 1.2 and below, and [RFC 8446] session = tickets in TLS 1.3.' I know it's pedantic, but RFC 8446 obsoletes RFC 5077. ... > Any authorization applied during resumption MUST be done using the > cached data, 'or data resolved or obtained using that cached data.' authorization doesn't need to performed in a sandboxed environment with = only the cached data. ... > * MAC address of the EAP peer * IP address of the EAP peer * > Informtion about the ethernet switch to which the EAP peer is > connecting > * MAC address of the switch > * IP address of the switch > * switch port used by the EAP peer > * Wifi SSID > * Information about the ethernet layer used by the EAP peer * Media-Type Cross resumption between VPNs and Wired/Wireless infrastructure could be = a big issue. It might be worth mentioning that explicitly as I think it'll be a blind = spot for implementors. Out of the box, if someone used our EAP server implementation for = authenticating VPN users and wired/wireless users, we would allow cross resumption, because the = EAP server doesn't allocate session tickets based in different contexts by default. > The EAP server also has access to the cached EAP-Response / Identity > from the original authentication. >=20 > None of these fields are authenticated or secured. As a result, any > or all of these fields can change between the original > authentication, and resumption. This change creates a "Time of > check, time of use" (TOCTOU) security vulnerability. A malicious > user could supply one set of data during authentication, and a > different set of data during resumption. The malicious user could > then obtain different authorization during resumption, potentially > leading to them obtaining access that they should not have. >=20 > When EAP servers make policy decisions based on unauthenticated > information, they MUST then add that information to the cached data maybe 'then it MUST be used in combination with the cached data = described above' Took a couple of readings to understand exactly what you meant there. The cached data isn't being updated, but it's being used together with = the unauthenticated information, right? The majority of this sounds great though. -Arran --Apple-Mail=_0C9EE6A6-0117-4C42-AC78-31F38F98BC46 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEE6VbEmJeQrF8361hu/6TVgp+218oFAlyAhIgACgkQ/6TVgp+2 18o6Yw//YcWXPaSdQr2B+5OPOEHyXmnukx16R5qemLnDlf7R9RcBPKuFmspao2L8 KmmhnwqtXArK1XY/mnjtQOIzQ5Bhl2/oYfT32i0jL0pRXUhKLFWwWhtIK13LEnms AxQFHGwJglDYOSyD7GFzGG1rjL4vaw6y77+4Rj0FXpdVFiaQH6rUVIgVhiMznXru 7ovDaUf0HO8KBGUx7dTO8g0ekdQx1C6xwiHD0NNjr9+FRl8FAzd031mA5p/upPJf Iyb6l8ANy066RBqG7xLZojLQtI6hJVCcQbo+Lg1n1XnWj5rMJC51HAu0/zgQAmAH pv9MWQk2iszZYkXNyTswf3jUab9bDD3LStCjFJzwzU7g6AEUk6oge/83+aYM8IvW 0BtAdtF7oimknTl70s2WPDvr2wvhwIuxux0cd93ALusRsD9otKjOAU9y2LqkkS14 2p1YTGyjYuDB+EFdVzL4HLc8F0/PEfY8HXYbJYCdKZxQPgJgk7UFASmXugszr8sm 0UgZaDjC6cvBf1T3C0qyej7T9qm9IuoGYMw69HqrfoNyZxyzzZnhHf7bbjnmGaVf vfoTnnHPYMFzz5/DY7jFSbp3rGfR5KRgJZYrlJs2gN35quoTBNdPK1QFAnA40nou xAXnrEbYkjxP1lTGX/qmxrYWSK4tKekUQxvnXIZ+juUV4LDDsEI= =MHQi -----END PGP SIGNATURE----- --Apple-Mail=_0C9EE6A6-0117-4C42-AC78-31F38F98BC46-- From nobody Wed Mar 6 23:29:18 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6EE3E128AFB for ; Wed, 6 Mar 2019 23:29:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=silvair-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PU_NXF1EVlFM for ; Wed, 6 Mar 2019 23:29:01 -0800 (PST) Received: from mail-lf1-x129.google.com (mail-lf1-x129.google.com [IPv6:2a00:1450:4864:20::129]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 69218130ED0 for ; Wed, 6 Mar 2019 23:28:58 -0800 (PST) Received: by mail-lf1-x129.google.com with SMTP id a8so10893349lfi.7 for ; Wed, 06 Mar 2019 23:28:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=silvair-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=VTq3TR6gOeYZSrgkmf8W6IOC1Sk6VE/HogOa9W8jWyE=; b=eBfjOzqIl/f7J8MxY1XYzpWNTLVURxJpi6+duWHQpxwnT112aeXye9/Df6dMe/rpNX hA+jWcihwiD4U6YNe+YOn+WVls/nuZR3IRd3UasKE1Qq+xY2v3nkXynTUR7mQcM077lH nA1TNlfAgb4YcdijeeHibok4Ll+mfg0cKzNbhSCt2YWs20c7xsj803sEWyFJI+MbjbzG GyvZ6IQ6IPIaKu1AG3xnFxd1MLlSK1//blZBypM1/oz/mNcAakjc4uuN16XC/Dbr1mUc WsRd/Wu1rqouVHIoDZkfGk85FLhMKIKc8O/PQTxeeKNQjyKFc7GFHED8+2DPL7TC0BbL yJLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=VTq3TR6gOeYZSrgkmf8W6IOC1Sk6VE/HogOa9W8jWyE=; b=b31FHXDAAjI8OweLttdWBNcmCxGLWDd6iIt6GbT263qu1gxhpMcbQfhFW7d8ksXvVE RlIlgGYoKLTKtA1CSgh9T5Y+hZ0tUDY0nP6WF5qYgtd1hBUGQGrSIWMQebeCjaebg1tM fx/yW04e+DTyzSr5QNvOx0jiaC2j30IhXzuw9VUuqDwael+h3pTsxIcPKFYYfMFeOAHr 0OQEtLvPdwzUpxrmSPnHWGDN2m/KcV6E8Ca0qRcfNW/9nfNuLawjRDE0T1VGNj7dvZV6 gnRTBdFX0XTds6+0pHyDzk3xx3nVfB3+w5e8A5A2PAlPvJIYgTD65MhMOZ5d4rR+QgdU 6byg== X-Gm-Message-State: APjAAAWqJ1pJcuIe0UAUe+nfUZNrxXGPeoOYfvMbMtZCR4P3r/COOsSJ FyquQPUucL3FXUZv589nAB7ezQaJRLBLdlp3N9RnYQ== X-Google-Smtp-Source: APXvYqwt1efP+C1ndA+i/xYt5iE6cnZBB4NQ1BmKw0BS5J/zM7j3rPv2ek4e4bUREHe+KXLX7zdDi3XloR9Eu426YjY= X-Received: by 2002:a19:f10d:: with SMTP id p13mr5613116lfh.52.1551943736148; Wed, 06 Mar 2019 23:28:56 -0800 (PST) MIME-Version: 1.0 References: <1861142E-CA19-49FD-B84E-C8CBA827D1A0@cisco.com> In-Reply-To: <1861142E-CA19-49FD-B84E-C8CBA827D1A0@cisco.com> From: =?UTF-8?Q?Szymon_S=C5=82upik?= Date: Thu, 7 Mar 2019 08:28:20 +0100 Message-ID: To: Eliot Lear Cc: anima@ietf.org, opsawg@ietf.org, iot-dir , emu@ietf.org, 6tisch@ietf.org, iot-onboarding@ietf.org Content-Type: multipart/alternative; boundary="0000000000001ad34005837c0fcb" Archived-At: Subject: Re: [Emu] [Iot-onboarding] On boarding again X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2019 07:29:03 -0000 --0000000000001ad34005837c0fcb Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Eliot, It'd be great to include Bluetooth mesh in here, as (despite sharing the brand and the underlying radio with Bluetooth LE) it is a completely different animal, when it comes to onboarding, authentication, security. I will add some initial bullets for Bluetooth mesh here, hope to do this next week. Best Szymon Slupik President, CTO +1-415-696-9111 [image: Silvair] ul. Jasnog=C3=B3rska 44 31-358 Krak=C3=B3w Poland www.silvair.com [image: Facebook] [image: LinkedIn] [image: Twitter= ] NOTICE TO RECIPIENT We inform you that Silvair sp. z o.o. with its registered office in Cracow (31-358), at Jasnog=C3=B3rska Street 44 is the controller of your personal = data. You can find more information about processing personal data and your rights here . This e-mail message and any documents accompanying it contain information that belongs to SILVAIR. This e-mail is meant for only the intended recipient of the transmission, and may be a communication privileged by law, confidential and/or otherwise protected from disclosure. If you received this e-mail in error and you are not the intended recipient, any review, use, dissemination, distribution, or copying of this e-mail or attachment is strictly prohibited. Please notify us immediately of the error by return e-mail and please delete this message from your system. On Wed, Mar 6, 2019 at 2:32 PM Eliot Lear wrote: > Hi everyone, > > For those who are interested in discussing onboarding, I=E2=80=99ve reser= ved an > hour on Wednesday afternoon (27 Mar) at 14:00 at the IETF in Karlin 3. > Since our last conversation, a few of us put a bit of an inventory > together, regarding the mechanisms that are available. Some of the > questions we have Aren=E2=80=99t Quite There Yet, but at least the invent= ory is > coming along. > > Goal of discussion this time around would a shared understanding of how > these mechanisms work, what sort of commonality they have, and to perhaps > have some notion of applicability of each. > > For your entertainment, you can take a look at a table=E2=80=A6 it=E2=80= =99s a Github > table so you have to scroll a bit- see > https://github.com/iot-onboarding/catalog/blob/master/Onboard-Table.md. > Feel free to issue PRs. > > Also, feel free to agenda bash on iot-onboarding@ietf.org. > > Eliot > -- > Iot-onboarding mailing list > Iot-onboarding@ietf.org > https://www.ietf.org/mailman/listinfo/iot-onboarding > --0000000000001ad34005837c0fcb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Eliot,

It'd be great to include = Bluetooth mesh in here, as (despite sharing the brand and the underlying ra= dio with Bluetooth LE) it is a completely different animal, when it comes t= o onboarding, authentication, security. I will add some initial bullets for= Bluetooth mesh here, hope to do this next=C2=A0week.

<= div>Best

Szymon Slupik
Pre= sident, CTO
+1-415-696-9111


ul.= Jasnog=C3=B3rska 44
31-358 Krak=C3=B3w
Poland

www.silvair.com

= =C2=A0 3D"LinkedIn" =C2=A0 3D"T=

NOTICE TO RECIPIENT
We inform you that Silvair sp. z o.o. with its registered office in Cracow (31-358), at Jasnog=C3=B3rska Street 44 is the controller of your personal= =20 data. You can find more information about processing personal data and=20 your rights here.
This e-mail message and any documents accompanying it contain information=20 that belongs to SILVAIR. This e-mail is meant for only the intended=20 recipient of the transmission, and may be a communication privileged by=20 law, confidential and/or otherwise protected from disclosure. If you=20 received this e-mail in error and you are not the intended recipient,=20 any review, use, dissemination, distribution, or copying of this e-mail=20 or attachment is strictly prohibited. Please notify us immediately of=20 the error by return e-mail and please delete this message from your=20 system.=C2=A0



On Wed, Mar 6, 2019 at 2:32 PM Eliot Le= ar <lear@cisco.com> wrote:
<= /div>
Hi everyone,

For those who are int= erested in discussing onboarding, I=E2=80=99ve reserved an hour on Wednesda= y afternoon (27 Mar) at 14:00 at the IETF in Karlin 3.=C2=A0 Since our last= conversation, a few of us put a bit of an inventory together, regarding th= e mechanisms that are available.=C2=A0 Some of the questions we have Aren= =E2=80=99t Quite There Yet, but at least the inventory is coming along.

Goal of discussion this time around =C2=A0would a sha= red understanding of how these mechanisms work, what sort of commonality th= ey have, and to perhaps have some notion of applicability of each.

For your entertainment, you can take a look at a table=E2= =80=A6 it=E2=80=99s a Github table so you have to scroll a bit- see=C2=A0https://github.com/iot-onboarding/catalog/blob/mast= er/Onboard-Table.md.=C2=A0 Feel free to issue PRs.

=
Also, feel free to agenda bash on iot-onboarding@ietf.org.

<= div>Eliot
--
Iot-onboarding mailing list
Iot-onboarding= @ietf.org
https://www.ietf.org/mailman/listinfo/iot-onboar= ding
--0000000000001ad34005837c0fcb-- From nobody Wed Mar 6 23:45:44 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13A50130ED0; Wed, 6 Mar 2019 23:45:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cnOE45T5EL1b; Wed, 6 Mar 2019 23:45:27 -0800 (PST) Received: from aer-iport-3.cisco.com (aer-iport-3.cisco.com [173.38.203.53]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6878F128AFB; Wed, 6 Mar 2019 23:45:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=12444; q=dns/txt; s=iport; t=1551944727; x=1553154327; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=IEFvKpe321J+1v0IgPQ9KfkDmTwHR3oDwiz6lKWVrYM=; b=AXHHjOrD4PxIYaxo445EHA7l+u1RGbW7m427HzUAnPtR0c6470BL7U1Q /dhEozMRiM3bw5bdF3sVbN8WT76xQlTkBQhJxLu5xZF1ucsnCLwKTmiL8 3GWgSrald3xhtdNt1ZyY+DhrMwlCrT5Ie9TH0KcR15h6vBPbP/XwZILkS E=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0A5AAD3yoBc/xbLJq1hAxwBAQEEAQE?= =?us-ascii?q?HBAEBgVIGAQELAYENWIESD0EzJ4QJiHmMRyWSMIVzFIFnCAMBARgBB4RMAoR?= =?us-ascii?q?VNQgNAQEDAQEHAQMCbRwMhUoBAQECAQEBASEmJQsFCwsHEScDAgInHxEGE4M?= =?us-ascii?q?iAYFtCA+qS4EvhC8BAwQBgQyEWg+BGxQBgUiDboRUgTWBfyaBEgwTgU5+gjo?= =?us-ascii?q?+JgEBAQeBHV0LG4JDFxqCJgKIMIFKASqBdIUdhjyMHwmEVoINaYEbhh2BVYI?= =?us-ascii?q?rGYF2KYU9gyKINJANQolpgm4CBAYFAhSBSQE1gVYzGggbFTsqAYJBCTWCbwE?= =?us-ascii?q?CgkiFFIVAPgMwjhEBAQ?= X-IronPort-AV: E=Sophos;i="5.58,451,1544486400"; d="asc'?scan'208,217";a="10538013" Received: from aer-iport-nat.cisco.com (HELO aer-core-3.cisco.com) ([173.38.203.22]) by aer-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 07 Mar 2019 07:45:23 +0000 Received: from [10.61.245.251] ([10.61.245.251]) by aer-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id x277jM9Q003274 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Thu, 7 Mar 2019 07:45:23 GMT From: Eliot Lear Message-Id: <504E7EB5-3151-4C25-9E0D-4B8A90E7C3A5@cisco.com> Content-Type: multipart/signed; boundary="Apple-Mail=_9B57825A-BBDE-45E9-89EC-8D6E90D77042"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Thu, 7 Mar 2019 08:45:22 +0100 In-Reply-To: Cc: anima@ietf.org, opsawg@ietf.org, iot-dir , emu@ietf.org, 6tisch@ietf.org, iot-onboarding@ietf.org To: =?utf-8?Q?Szymon_S=C5=82upik?= References: <1861142E-CA19-49FD-B84E-C8CBA827D1A0@cisco.com> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.245.251, [10.61.245.251] X-Outbound-Node: aer-core-3.cisco.com Archived-At: Subject: Re: [Emu] [Iot-onboarding] On boarding again X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2019 07:45:31 -0000 --Apple-Mail=_9B57825A-BBDE-45E9-89EC-8D6E90D77042 Content-Type: multipart/alternative; boundary="Apple-Mail=_B4EB295A-86F9-4F34-8A76-B2A2B5222ED5" --Apple-Mail=_B4EB295A-86F9-4F34-8A76-B2A2B5222ED5 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 PRs welcome! > On 7 Mar 2019, at 08:28, Szymon S=C5=82upik wrote: >=20 > Hi Eliot, >=20 > It'd be great to include Bluetooth mesh in here, as (despite sharing = the brand and the underlying radio with Bluetooth LE) it is a completely = different animal, when it comes to onboarding, authentication, security. = I will add some initial bullets for Bluetooth mesh here, hope to do this = next week. >=20 > Best > Szymon Slupik > President, CTO > +1-415-696-9111 >=20 > ul. Jasnog=C3=B3rska 44 > 31-358 Krak=C3=B3w > Poland >=20 > www.silvair.com > = = > NOTICE TO RECIPIENT > We inform you that Silvair sp. z o.o. with its registered office in = Cracow (31-358), at Jasnog=C3=B3rska Street 44 is the controller of your = personal data. You can find more information about processing personal = data and your rights here = . > This e-mail message and any documents accompanying it contain = information that belongs to SILVAIR. This e-mail is meant for only the = intended recipient of the transmission, and may be a communication = privileged by law, confidential and/or otherwise protected from = disclosure. If you received this e-mail in error and you are not the = intended recipient, any review, use, dissemination, distribution, or = copying of this e-mail or attachment is strictly prohibited. Please = notify us immediately of the error by return e-mail and please delete = this message from your system. >=20 >=20 >=20 > On Wed, Mar 6, 2019 at 2:32 PM Eliot Lear > wrote: > Hi everyone, >=20 > For those who are interested in discussing onboarding, I=E2=80=99ve = reserved an hour on Wednesday afternoon (27 Mar) at 14:00 at the IETF in = Karlin 3. Since our last conversation, a few of us put a bit of an = inventory together, regarding the mechanisms that are available. Some = of the questions we have Aren=E2=80=99t Quite There Yet, but at least = the inventory is coming along. >=20 > Goal of discussion this time around would a shared understanding of = how these mechanisms work, what sort of commonality they have, and to = perhaps have some notion of applicability of each. >=20 > For your entertainment, you can take a look at a table=E2=80=A6 it=E2=80= =99s a Github table so you have to scroll a bit- see = https://github.com/iot-onboarding/catalog/blob/master/Onboard-Table.md = . = Feel free to issue PRs. >=20 > Also, feel free to agenda bash on iot-onboarding@ietf.org = . >=20 > Eliot > -- > Iot-onboarding mailing list > Iot-onboarding@ietf.org > https://www.ietf.org/mailman/listinfo/iot-onboarding = --Apple-Mail=_B4EB295A-86F9-4F34-8A76-B2A2B5222ED5 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 PRs = welcome!

On 7 Mar 2019, at 08:28, Szymon S=C5=82upik = <simon@silvair.com> wrote:

Hi Eliot,

It'd be great to include Bluetooth mesh = in here, as (despite sharing the brand and the underlying radio with = Bluetooth LE) it is a completely different animal, when it comes to = onboarding, authentication, security. I will add some initial bullets = for Bluetooth mesh here, hope to do this next week.

Best

Szymon Slupik
President, CTO
+1-415-696-9111

3D"Silvair"
ul. = Jasnog=C3=B3rska 44
31-358 Krak=C3=B3w
Poland

www.silvair.com

3D"Facebook"   3D"LinkedIn"   3D"Twitter"

NOTICE TO RECIPIENT
We inform you that Silvair sp. z o.o. with its registered office in Cracow (31-358), at Jasnog=C3=B3rska Street 44 is the controller of your = personal=20 data. You can find more information about processing personal data and=20= your rights here.
= This e-mail message and any documents accompanying it contain information=20 that belongs to SILVAIR. This e-mail is meant for only the intended=20 recipient of the transmission, and may be a communication privileged by=20= law, confidential and/or otherwise protected from disclosure. If you=20 received this e-mail in error and you are not the intended recipient,=20 any review, use, dissemination, distribution, or copying of this e-mail=20= or attachment is strictly prohibited. Please notify us immediately of=20 the error by return e-mail and please delete this message from your=20 system. 



On Wed, Mar = 6, 2019 at 2:32 PM Eliot Lear <lear@cisco.com> wrote:
Hi everyone,

For those who are interested in = discussing onboarding, I=E2=80=99ve reserved an hour on Wednesday = afternoon (27 Mar) at 14:00 at the IETF in Karlin 3.  Since our = last conversation, a few of us put a bit of an inventory together, = regarding the mechanisms that are available.  Some of the questions = we have Aren=E2=80=99t Quite There Yet, but at least the inventory is = coming along.

Goal of discussion this time around  would a shared = understanding of how these mechanisms work, what sort of commonality = they have, and to perhaps have some notion of applicability of = each.

For your = entertainment, you can take a look at a table=E2=80=A6 it=E2=80=99s a = Github table so you have to scroll a bit- see https://github.com/iot-onboarding/catalog/blob/master/Onboard-T= able.md.  Feel free to issue PRs.

Also, feel free to agenda bash on iot-onboarding@ietf.org.

Eliot
--
Iot-onboarding mailing list
Iot-onboarding@ietf.org
https://www.ietf.org/mailman/listinfo/iot-onboarding

= --Apple-Mail=_B4EB295A-86F9-4F34-8A76-B2A2B5222ED5-- --Apple-Mail=_9B57825A-BBDE-45E9-89EC-8D6E90D77042 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlyAzBIACgkQh7ZrRtnS ejObNwf/S9p0ryCeM+wRvrAXLJ9Hm3eWsdS7ovMalP910xKYX2hjmVKytiyxiAIq JJ27zw18ijEHivNd1zLzMJOgCR04v5YjlVpjGRpqwPuxSFQiRm4LLhJ8sRHrD5rv /dYMrtEcclTkF/4fO6WFmeNhnPzsf5FJCdNNCDAfqIcRmoSIoNcDsfZ3J7xRrGTN qy9FELTnNk41eUJ0GH98byFJvKvKpe4d6NLXo65r8CYkya6kQwARNgqXmRMAKNnn TZoTcqi5Y2CI18XeyykkQANlwlTUrrvrjCASfzRBoLwrFSgs+pXP8ythUBujhqw1 wUjYaQs0v8hh1YX6BhwdXyWLBZdZ6w== =BM1Z -----END PGP SIGNATURE----- --Apple-Mail=_9B57825A-BBDE-45E9-89EC-8D6E90D77042-- From nobody Thu Mar 7 17:41:22 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBC051311DD for ; Thu, 7 Mar 2019 17:41:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LE_yHKhoNrMw for ; Thu, 7 Mar 2019 17:41:18 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id C24991311D2 for ; Thu, 7 Mar 2019 17:41:18 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 73DD2E4; Fri, 8 Mar 2019 01:41:17 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Alan DeKok In-Reply-To: Date: Thu, 7 Mar 2019 20:41:16 -0500 Cc: EMU WG Content-Transfer-Encoding: quoted-printable Message-Id: References: <84FA2D8F-17EF-4611-81E5-FCDD2C611423@ericsson.com> <8EC98343-E2F7-42DD-9962-EC89865039E1@deployingradius.com> <1DDE7ED1-C539-4E11-81F8-EF557E2F6EB2@deployingradius.com> To: Arran Cudbard-Bell X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Mar 2019 01:41:21 -0000 On Mar 6, 2019, at 9:40 PM, Arran Cudbard-Bell = wrote: > 'session tickets for TLS versions 1.2 and below, and [RFC 8446] = session tickets in TLS 1.3.' >=20 > I know it's pedantic, but RFC 8446 obsoletes RFC 5077. Sure. >> Any authorization applied during resumption MUST be done using the >> cached data, >=20 > 'or data resolved or obtained using that cached data.' >=20 > authorization doesn't need to performed in a sandboxed environment = with only the cached data. True. It can be used to look up data in a database, or to do = something else. > Cross resumption between VPNs and Wired/Wireless infrastructure could = be a big issue. > It might be worth mentioning that explicitly as I think it'll be a = blind spot for implementors. >=20 > Out of the box, if someone used our EAP server implementation for = authenticating VPN users > and wired/wireless users, we would allow cross resumption, because the = EAP server > doesn't allocate session tickets based in different contexts by = default. That depends on the deployment, too. To be strictly technical, an HTTPS server and EAP server could share = TLS session tickets. It would then be possible for users to = authenticate via HTTPS, and "resume" via EAP-TLS. The only reason resumption works across media types in EAP is that = there's generally one common EAP server for all media types. If instead = there are multiple EAP servers, or the TLS implementations don't share = data, then cross-method resumption won't work. >> When EAP servers make policy decisions based on unauthenticated >> information, they MUST then add that information to the cached data >=20 > maybe 'then it MUST be used in combination with the cached data = described above' Perhaps. > Took a couple of readings to understand exactly what you meant there. It's a difficult subject to explain properly. > The cached data isn't being updated, but it's being used together with = the unauthenticated > information, right? Yes. Alan DeKok. From nobody Fri Mar 8 17:17:33 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B9BBF124B0C for ; Fri, 8 Mar 2019 17:17:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gab1D78SftJc for ; Fri, 8 Mar 2019 17:17:28 -0800 (PST) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 22E191279A2 for ; Fri, 8 Mar 2019 17:17:28 -0800 (PST) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 8 Mar 2019 17:17:19 -0800 From: Jim Schaad To: 'Alan DeKok' , 'Arran Cudbard-Bell' CC: 'EMU WG' References: <84FA2D8F-17EF-4611-81E5-FCDD2C611423@ericsson.com> <8EC98343-E2F7-42DD-9962-EC89865039E1@deployingradius.com> <1DDE7ED1-C539-4E11-81F8-EF557E2F6EB2@deployingradius.com> In-Reply-To: Date: Fri, 8 Mar 2019 17:17:17 -0800 Message-ID: <031401d4d615$d7b249b0$8716dd10$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQI/mt++Keqc+8bQojuqAILCSXvysAIhTij4A5m6dtwCHbSjzAICcOf1AsKweeoCJtXITqS2zeoQ Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 09 Mar 2019 01:17:31 -0000 I am finally getting caught up on this thread and I have found it to be very frustrating because it appears to make an assumption which I do not believe is warranted. I do not see any problems with allowing TLS session to be used across different types of EAP assuming that EAP correctly checks the output of TLS before continuing. When a session ticket is issued for a TLS session it contains the authentication done by that TLS authentication session. It does not contain any of the containing EAP authentication information that has been done. Example: Run EAP where you do TLS anonymous followed by a password and get the session ticket. This session ticket is associated with ZERO client authentication information, not even the password because the session ticket would be issued before the password was obtained. Take that session ticket and run it in an EAP-TLS session. The TLS would check to see if there was client authentication associated with the session ticket and either a) say that the ticket is not valid or b) validates the ticket and then does a post handshake client authentication for the client certificate. It could then issue a new ticket which contained the client authentication information obtained in TLS. A similar analysis can be done for all EAP methods. The session ticket only has the information that is discovered by TLS and as such any new TLS session that is created needs to look a the client authentication that was done when the ticket was issued. Jim > -----Original Message----- > From: Emu On Behalf Of Alan DeKok > Sent: Thursday, March 7, 2019 5:41 PM > To: Arran Cudbard-Bell > Cc: EMU WG > Subject: Re: [Emu] Notes on session resumption with TLS-based EAP > methods > > On Mar 6, 2019, at 9:40 PM, Arran Cudbard-Bell > wrote: > > 'session tickets for TLS versions 1.2 and below, and [RFC 8446] session > tickets in TLS 1.3.' > > > > I know it's pedantic, but RFC 8446 obsoletes RFC 5077. > > Sure. > > >> Any authorization applied during resumption MUST be done using the > >> cached data, > > > > 'or data resolved or obtained using that cached data.' > > > > authorization doesn't need to performed in a sandboxed environment with > only the cached data. > > True. It can be used to look up data in a database, or to do something else. > > > Cross resumption between VPNs and Wired/Wireless infrastructure could > be a big issue. > > It might be worth mentioning that explicitly as I think it'll be a blind spot for > implementors. > > > > Out of the box, if someone used our EAP server implementation for > > authenticating VPN users and wired/wireless users, we would allow > > cross resumption, because the EAP server doesn't allocate session tickets > based in different contexts by default. > > That depends on the deployment, too. > > To be strictly technical, an HTTPS server and EAP server could share TLS > session tickets. It would then be possible for users to authenticate via > HTTPS, and "resume" via EAP-TLS. > > The only reason resumption works across media types in EAP is that there's > generally one common EAP server for all media types. If instead there are > multiple EAP servers, or the TLS implementations don't share data, then > cross-method resumption won't work. > > >> When EAP servers make policy decisions based on unauthenticated > >> information, they MUST then add that information to the cached data > > > > maybe 'then it MUST be used in combination with the cached data > described above' > > Perhaps. > > > Took a couple of readings to understand exactly what you meant there. > > It's a difficult subject to explain properly. > > > The cached data isn't being updated, but it's being used together with > > the unauthenticated information, right? > > Yes. > > Alan DeKok. > > _______________________________________________ > Emu mailing list > Emu@ietf.org > https://www.ietf.org/mailman/listinfo/emu From nobody Sat Mar 9 15:50:37 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78207131017 for ; Sat, 9 Mar 2019 15:50:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y82mdSEiiMVm for ; Sat, 9 Mar 2019 15:50:32 -0800 (PST) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5358A129A86 for ; Sat, 9 Mar 2019 15:50:32 -0800 (PST) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 7AFBB38263 for ; Sat, 9 Mar 2019 18:50:18 -0500 (EST) Received: by sandelman.ca (Postfix, from userid 179) id 95F6A22ED; Sat, 9 Mar 2019 18:50:30 -0500 (EST) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 9385712E7 for ; Sat, 9 Mar 2019 18:50:30 -0500 (EST) From: Michael Richardson To: "'EMU WG'" In-Reply-To: <031401d4d615$d7b249b0$8716dd10$@augustcellars.com> References: <84FA2D8F-17EF-4611-81E5-FCDD2C611423@ericsson.com> <8EC98343-E2F7-42DD-9962-EC89865039E1@deployingradius.com> <1DDE7ED1-C539-4E11-81F8-EF557E2F6EB2@deployingradius.com> <031401d4d615$d7b249b0$8716dd10$@augustcellars.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 09 Mar 2019 23:50:35 -0000 --=-=-= Content-Type: text/plain Jim Schaad wrote: > I am finally getting caught up on this thread and I have found it to be very > frustrating because it appears to make an assumption which I do not believe > is warranted. > I do not see any problems with allowing TLS session to be used across > different types of EAP assuming that EAP correctly checks the output of TLS > before continuing. When a session ticket is issued for a TLS session it > contains the authentication done by that TLS authentication session. It > does not contain any of the containing EAP authentication information that > has been done. I have been following along the discussion, and I think that I missed the use case. Why are we having this discussion? alan> i.e. a user starts with EAP-TLS, and then tries to "resume" his alan> session, but this time uses TTLS. It's not clear that anything in the alan> spec forbids or prevents this. What's in it for the user? Is this an attack? Does it avoid an interaction with a human? Does it enable mobility between different networks? Does this avoid some interaction with a two-factor authenticator? -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAlyEUUYACgkQgItw+93Q 3WXG/wf/cCCcX0PNWgILZsWhTftov6UVhMEKJlkCyvMBsj92MpvHJk5L+n6nmm6S 8ZevTmu4NgekpxprQ8BiZYPQOjOphVlYeaniN3ad+OadGUggQL65mF6nK24NdeS7 JN8VtUOaeTGN5E8a83gvaIcrdN/qLsRmFxxE3RzPtL0wzmZtdRp1P5WdvVu5Pn2c 8jzyiFHhfJKJ+26Jc59p7GzbQigWU209fk1oWh3O7PqN5txSXeD617uSuD2ra8Jl NTIGyQzi8BuH5U17l+q4/qGGgDpQSWT/VD/MNUWgCaB+UcVTffxhGPUaOMoJAy70 o0g8EPlC0b2b1RpBJDc2KxZbN2fJyQ== =yO9b -----END PGP SIGNATURE----- --=-=-=-- From nobody Sat Mar 9 16:21:58 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB04F131017 for ; Sat, 9 Mar 2019 16:21:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cco_YX5a5eYZ for ; Sat, 9 Mar 2019 16:21:51 -0800 (PST) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 26C391286CD for ; Sat, 9 Mar 2019 16:21:51 -0800 (PST) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id E892C33E; Sun, 10 Mar 2019 00:21:49 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Alan DeKok In-Reply-To: <24625.1552175430@localhost> Date: Sat, 9 Mar 2019 19:21:47 -0500 Cc: EMU WG Content-Transfer-Encoding: quoted-printable Message-Id: References: <84FA2D8F-17EF-4611-81E5-FCDD2C611423@ericsson.com> <8EC98343-E2F7-42DD-9962-EC89865039E1@deployingradius.com> <1DDE7ED1-C539-4E11-81F8-EF557E2F6EB2@deployingradius.com> <031401d4d615$d7b249b0$8716dd10$@augustcellars.com> <24625.1552175430@localhost> To: Michael Richardson X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 00:21:57 -0000 On Mar 9, 2019, at 6:50 PM, Michael Richardson = wrote: > I have been following along the discussion, and I think that I missed = the use case. > Why are we having this discussion? It's good to understand the edge conditions of the protocol. = Otherwise, it might have designed-in flaws. Or, implementations might = be vulnerable to attacks which aren't discussed in the specification. > alan> i.e. a user starts with EAP-TLS, and then tries to "resume" his > alan> session, but this time uses TTLS. It's not clear that anything = in the > alan> spec forbids or prevents this. >=20 > What's in it for the user? s/user/attacker/ Answer: lots. Systems may have different policies for different EAP types. Being = able to undetectably change EAP types seems bad. The issue is larger than just resumption with different EAP types. = It's the whole set of information around the authentication. All of = that data is unsecured, and can be forged. > Is this an attack? Yes. If the user changes the unauthenticated data associated with the EAP = session (MAC address, switch port, etc), it may be possible to bypass = poorly designed policies. e.g. changing the EAP-Request / Identity field. > Does it avoid an interaction with a human? > Does it enable mobility between different networks? > Does this avoid some interaction with a two-factor authenticator? It bypasses security policies. That seems bad. The other huge issue is how do we enforce policies with TLS = resumption? The EAP-Request / Identity is insecure and can be forged. = So that can't be relied on. Maybe the EAP server doesn't associate *any* policy data or = authentication credentials with that TLS session. In that case, you can = "resume", but we have no idea *who* is being "resumed", or what policies = should be applied to that user. That seems like a rather enormous = security issue. Since nothing in the protocol prevents people from playing games with = it, attackers *will* play games, with unknown consequences. It = therefore seems prudent to discuss these issues. Also to give guidance = on the possible attacks. And, to give guidance on good practices. I think the issue of "resumption across EAP methods" is a minor one, = but it has opened up a series of additional issues which need = addressing. The previous EAP-TLS spec was written largely to describe EAP-TLS and = nothing more. Realistically, EAP-TLS is almost always used inside of a = larger ecosystem. It is therefore also prudent to discuss how these = systems can interact, and what security issues may arise from this = interactions. Alan DeKok. From nobody Sat Mar 9 16:47:12 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A96DE1277E7 for ; Sat, 9 Mar 2019 16:47:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Avjy1bqjgGLL for ; Sat, 9 Mar 2019 16:47:08 -0800 (PST) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4E274127968 for ; Sat, 9 Mar 2019 16:47:08 -0800 (PST) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sat, 9 Mar 2019 16:47:02 -0800 From: Jim Schaad To: 'Michael Richardson' , 'EMU WG' References: <84FA2D8F-17EF-4611-81E5-FCDD2C611423@ericsson.com> <8EC98343-E2F7-42DD-9962-EC89865039E1@deployingradius.com> <1DDE7ED1-C539-4E11-81F8-EF557E2F6EB2@deployingradius.com> <031401d4d615$d7b249b0$8716dd10$@augustcellars.com> <24625.1552175430@localhost> In-Reply-To: <24625.1552175430@localhost> Date: Sat, 9 Mar 2019 16:46:58 -0800 Message-ID: <035001d4d6da$c613d4b0$523b7e10$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQI/mt++Keqc+8bQojuqAILCSXvysAIhTij4A5m6dtwCHbSjzAICcOf1AsKweeoCJtXITgLDlxD/An7sTNGkjkOBwA== Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 00:47:11 -0000 > -----Original Message----- > From: Emu On Behalf Of Michael Richardson > Sent: Saturday, March 9, 2019 3:51 PM > To: 'EMU WG' > Subject: Re: [Emu] Notes on session resumption with TLS-based EAP > methods > > > Jim Schaad wrote: > > I am finally getting caught up on this thread and I have found it to be very > > frustrating because it appears to make an assumption which I do not > believe > > is warranted. > > > I do not see any problems with allowing TLS session to be used across > > different types of EAP assuming that EAP correctly checks the output of > TLS > > before continuing. When a session ticket is issued for a TLS session it > > contains the authentication done by that TLS authentication session. It > > does not contain any of the containing EAP authentication information > that > > has been done. > > I have been following along the discussion, and I think that I missed the use > case. > Why are we having this discussion? > > alan> i.e. a user starts with EAP-TLS, and then tries to "resume" his > alan> session, but this time uses TTLS. It's not clear that anything in > alan> the spec forbids or prevents this. > > What's in it for the user? For the user, the win is that the TLS handshake is much smaller and therefore runs both faster and more reliably. > Is this an attack? Depends on what you think session resumption gives you. From my point of view there is absolutely no attack as the server still needs to check that the client certificate credentials are acceptable. Whether this is none or specific trust anchors. > Does it avoid an interaction with a human? Yes - this would be cached locally in some way. The assumption is that you would not do this on a kiosk type situation or make sure that they are strongly protected to the user. > Does it enable mobility between different networks? Yes - The resumption credential is on the user's device and on the TLS server. If the user's device moves then things are just fine. Again, the TLS server would need to check the credentials from the cached session against the new network to make sure that nothing bad is happening and the client can operate on that new network. > Does this avoid some interaction with a two-factor authenticator? That depends on how the two-factor authentication is being done. If both factors are some how bound up in the TLS protocol itself, then it boils down to single factor authentication. If the two factors are a client certificate - using TLS - and some type of pass phrase which is being passed in EAP or over the application protocol - then there is nothing that is being released. One assumes that the same type of access to the private key is still needed for running TLS and then the second factor is going to be required to be entered in some manner and sent as part of EAP or the application. Jim > > -- > Michael Richardson , Sandelman Software Works > -= IPv6 IoT consulting =- From nobody Sun Mar 10 04:40:25 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2446130E73 for ; Sun, 10 Mar 2019 04:40:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.302 X-Spam-Level: X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=SS9Zj5vC; dkim=pass (1024-bit key) header.d=ericsson.com header.b=UyFTXgxW Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xspQgVXY0ijk for ; Sun, 10 Mar 2019 04:40:17 -0700 (PDT) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 80DC11279A0 for ; Sun, 10 Mar 2019 04:40:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1552218015; x=1554810015; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=pk+AeA8bb5MozVBGl7+pJV8LvyzeEKogcNLIpWU6COE=; b=SS9Zj5vCpTZf9bBsb7tiSsdeUz+p8qmvlD/GHRe18zeXL9VNpUnzl/K8UQOXY+lK gMpjRE+C1yjLWoxrPZLJMYAw78QxCFYnRdurfz9c/gXIcKoWFiVZLOQB69QNWivF pckApl81xuJD7vQnvcts/LnGKzITzwn7LTRqPwu/wgc=; X-AuditID: c1b4fb3a-14fff7000000672c-ec-5c84f79fdd29 Received: from ESESBMB504.ericsson.se (Unknown_Domain [153.88.183.117]) by sessmg22.ericsson.net (Symantec Mail Security) with SMTP id 22.1A.26412.F97F48C5; Sun, 10 Mar 2019 12:40:15 +0100 (CET) Received: from ESESBMR502.ericsson.se (153.88.183.134) by ESESBMB504.ericsson.se (153.88.183.117) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Sun, 10 Mar 2019 12:40:15 +0100 Received: from ESESBMB504.ericsson.se (153.88.183.171) by ESESBMR502.ericsson.se (153.88.183.134) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Sun, 10 Mar 2019 12:40:15 +0100 Received: from EUR04-VI1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB504.ericsson.se (153.88.183.171) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Sun, 10 Mar 2019 12:40:15 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pk+AeA8bb5MozVBGl7+pJV8LvyzeEKogcNLIpWU6COE=; b=UyFTXgxWJE/YgD1SeebExEQNbpS0eL+Ole7VkSYOC+q3w/UBZvspQWs+3OwoIx+DRNuLEKzQXA23ZdTFT5b3EX1sZx6YBQZG4AjHsoZHzgz8ZuyztQPVHHGzgYYTCD07Yc2r1rQXHfeDhEJLrbJlhUD9uoSShlAwUToBNu3wCI8= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.9; Sun, 10 Mar 2019 11:40:13 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8%3]) with mapi id 15.20.1709.010; Sun, 10 Mar 2019 11:40:13 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: [Emu] Question about draft-ietf-emu-eap-tls13-03 && application data Thread-Index: AQHU1zYG1VV9p6zgH0yTRLh0dhPS4w== Date: Sun, 10 Mar 2019 11:40:13 +0000 Message-ID: <8C1526A6-58A3-4A5A-AD58-C65E5127AFD4@ericsson.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: a1f33d2a-99fc-42fc-3cd6-08d6a54d28fa x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB4169; x-ms-traffictypediagnostic: HE1PR07MB4169: x-microsoft-antispam-prvs: x-forefront-prvs: 0972DEC1D9 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(376002)(346002)(136003)(396003)(39860400002)(189003)(199004)(316002)(99286004)(25786009)(1730700003)(2501003)(8676002)(81156014)(58126008)(81166006)(3846002)(6116002)(5640700003)(68736007)(6246003)(53936002)(106356001)(82746002)(71190400001)(71200400001)(2351001)(6486002)(6512007)(97736004)(83716004)(6916009)(66066001)(6436002)(105586002)(8936002)(102836004)(6506007)(476003)(14444005)(33656002)(2616005)(256004)(44832011)(36756003)(486006)(186003)(14454004)(26005)(6346003)(2906002)(5660300002)(478600001)(305945005)(4744005)(229853002)(86362001)(7736002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB4169; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: wR84gUN+ABaXnt6VBGlnK9fBh65lF5AOldTCXHyd1U6UkeT3b4G+3aBj4edbk7mLg0zcaZd7eb07lVVQwojCy7IAP8fsdfpfwYP8LolqolnLBd09QIK7e9jhVIofmaBy5RkeR4kH8pehz5WdI8GFA1Vcn/XC7try3lNQJG9oQrMuhKN6/ilvvQomRq+fXMcaSdhH0AVfCtCE75vqWuyt05DKY6G/VoK+r7eRSUNk7rOjvkIArOnCmFDLLE315+Ok56ZuDAv6LRid7ypcp1eZa9a8BGhYNhJOtbBQY0hp0FDhV3lj4VKtwXvreLPmvEKLlr2DIdEDcqoyqYASkko/Y6BPoZLgUWp0kcBLTjd1YDAqtD9TcHSz1m5L2NTAdZaEiAYav9QFLCgroRwhnFk18s3fYkDuPXUTTPIzQgj78pI= Content-Type: text/plain; charset="utf-8" Content-ID: <2FD65EFF0873B8449041A390096A9FFC@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: a1f33d2a-99fc-42fc-3cd6-08d6a54d28fa X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Mar 2019 11:40:13.3673 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB4169 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA02Sa0iTYRTHed7LfB0NHpfmwVRw1Yc0nYlBWWl+qGxQdMUIpYa+XnBO27tJ RpEfnNbES1lN12UWK2upQ9G8JikyySHqEMlIvDRcigiRuCKxtr0r+vb7/8//HJ5zeBhSXE6H MLlKNatSyhUSgZCqv9ipiTa6StNi37tC91stzdQRlGIy/SROo0vCQ5msIreIVUkTrwhz1sr0 qHBNeG121UiXoHGhDvkzgONhpdtB65CQEeMhBIaORYIX6wgmZ+z0P9F2x+bHCxMBta2vSY+g cA0JhuGPhGeYGN8jwNqVyqfmEFQuPPAWBDgWnvSVCDwciCPgh72M9PBWfA5aps2UDjFu/zx8 /urPYww8HlZ5EhTeBVOLq960CCfB07ZyysMIbwPXSJN3OomD4ZPDSPD7YDD1jZE8B8HSl03a w0FYCu1VcxTvR4Ct/5UvEwZ2YwXi+SS8tPZ4lwQ8jcB2d9Y3NBIcFTUCnvOg1fbcNygU1pe6 Sb7hGw2N1UbfIVhobNYi/qXpoNXqab4hHMyV8xTfMEbC6NA7ogbtMfy3hcF9ABLvBkuPlLdT 4PttHclzBNyvmPczeI8RAB/qHVQDos0oiGM5Lj87Li6GVeVmcFyBMkbJqtuQ+3sMtP9K6EID zuRBhBkk2SJKnS1NE9PyIq44fxABQ0oCRWeX3ZYoU158nVUVXFZpFCw3iLYzlCRYtCEOSBPj bLmazWPZQlb1t0ow/iElKN6ckSwIsbwpfqp/cbz51pisY+LghEJ21LKWrlZOJmR0azazdsrs Z/qMMbasptr4legAQ2+Ua9/4jUcdp6qaq52jG9pQ0wlp3ULn8qRUpOm3PkSSXlmDM/FCyttn rqJjcNh5oEsf9bsvfKZudsRyc6q8y5YZpk9qidpxtXDVT0JxOfK9kaSKk/8B1s1ZYxoDAAA= Archived-At: Subject: Re: [Emu] Question about draft-ietf-emu-eap-tls13-03 && application data X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 11:40:24 -0000 IEhpLA0KDQpBcyB0aGVyZSB3YXMgbm8gb2JqZWN0aW9ucywgSSBtYWRlIHRoZSBmb2xsb3dpbmcg Y2hhbmdlcyB0byB0aGUgR2l0SHViIHZlcnNpb24gdGhhdCB3aWxsIGFwcGVhciBpbiBkcmFmdC1p ZXRmLWVtdS1lYXAtdGxzMTMtMDQNCg0KU2VjdGlvbiAyLjEuMQ0KDQpPTEQ6DQogDQogICBBcyBz dGF0ZWQgaW4gW1JGQzUyMTZdLCB0aGUgVExTIGNpcGhlciBzdWl0ZSBzaGFsbCBub3QgYmUgdXNl ZCB0bw0KICAgcHJvdGVjdCBhcHBsaWNhdGlvbiBkYXRhLiAgVGhpcyBhcHBsaWVzIGFsc28gZm9y IGVhcmx5IGFwcGxpY2F0aW9uDQogICBkYXRhLiAgV2hlbiBFQVAtVExTIGlzIHVzZWQgd2l0aCBU TFMgMS4zLCBlYXJseSBhcHBsaWNhdGlvbiBkYXRhDQogICBTSEFMTCBOT1QgYmUgdXNlZC4NCg0K TkVXOg0KDQogICBUTFMgMS4zIGludHJvZHVjZXMgZWFybHkgYXBwbGljYXRpb24gZGF0YTsgZWFy bHkgYXBwbGljYXRpb24gZGF0YQ0KICAgU0hBTEwgTk9UIGJlIHVzZWQgd2l0aCBFQVAtVExTLg0K DQpTZWN0aW9uIDIuNA0KDQpBRERFRDoNCg0KICAgV2hpbGUgRUFQLVRMUyBkb2VzIG5vdCBwcm90 ZWN0IGFueSBhcHBsaWNhdGlvbiBkYXRhLCB0aGUgbmVnb3RpYXRlZA0KICAgY2lwaGVyIHN1aXRl cyBhbmQgYWxnb3JpdGhtcyBNQVkgYmUgdXNlZCB0byBzZWN1cmUgZGF0YSBhcyBkb25lIGluDQog ICBvdGhlciBUTFMtYmFzZWQgRUFQIG1ldGhvZHMuIA0KDQpTZWN0aW9uIDIuNQ0KDQpERUxFVEVE Og0KDQogICBOb3RlIHRoYXQgdGhlIHVzZSBvZiBhbiBlbXB0eSBhcHBsaWNhdGlvbiBkYXRhIHJl Y29yZCBkb2VzIG5vdA0KICAgdmlvbGF0ZSB0aGUgcmVxdWlyZW1lbnQgdGhhdCB0aGUgVExTIGNp cGhlciBzdWl0ZSBzaGFsbCBub3QgYmUgdXNlZA0KICAgdG8gcHJvdGVjdCBhcHBsaWNhdGlvbiBk YXRhLCBhcyB0aGUgYXBwbGljYXRpb24gZGF0YSBpcyB0aGUgZW1wdHkNCiAgIHN0cmluZywgbm8g YXBwbGljYXRpb24gZGF0YSBpcyBwcm90ZWN0ZWQuDQoNCkNoZWVycywNCkpvaG4NCg0K From nobody Sun Mar 10 05:40:02 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53730127979 for ; Sun, 10 Mar 2019 05:40:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.302 X-Spam-Level: X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=Oe3DWlYX; dkim=pass (1024-bit key) header.d=ericsson.com header.b=L1vigTWX Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UOasR1wXMpeJ for ; Sun, 10 Mar 2019 05:39:58 -0700 (PDT) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E78B12796B for ; Sun, 10 Mar 2019 05:39:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1552221595; x=1554813595; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=kweclGgJAfncZ7mBXNQNW3SViOuI3AzD/aTlo4Z4KRM=; b=Oe3DWlYX6weLjUUv6C5iM3y475vUrbT5/2kCIV3Qkz5TtuF+e8LuUM97bQUsET45 L9EVCA1YR3FYf3vatbGZ+KDzXHGGYkzYWDHAZkdC6D4RRkCg0UtaZSAXvFvJ2igg Xbj835/OeYeiAlX0FViKmI+2jZHVXcxTLFrxfGHaacU=; X-AuditID: c1b4fb2d-db5ff7000000062f-f2-5c85059b8770 Received: from ESESBMB502.ericsson.se (Unknown_Domain [153.88.183.115]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id 6D.36.01583.B95058C5; Sun, 10 Mar 2019 13:39:55 +0100 (CET) Received: from ESESSMR503.ericsson.se (153.88.183.112) by ESESBMB502.ericsson.se (153.88.183.169) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Sun, 10 Mar 2019 13:39:55 +0100 Received: from ESESBMB504.ericsson.se (153.88.183.171) by ESESSMR503.ericsson.se (153.88.183.112) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Sun, 10 Mar 2019 13:39:55 +0100 Received: from EUR02-HE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB504.ericsson.se (153.88.183.171) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Sun, 10 Mar 2019 13:39:55 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=kweclGgJAfncZ7mBXNQNW3SViOuI3AzD/aTlo4Z4KRM=; b=L1vigTWXtTEyhQBMZaMgxg2AHGEuKaW+kFRDndw40xDqK4SSdI0VFJ4Lzc3PLZGO6dUhDRh+cXn8PmqeVi5biymeBFsqi+kDxXK4KlLALTLYjT0cinnzrdi7VUJqBjMUDg/WVYxiVo3UQdgP9Y1RVOUQYh5v38c+7ykBUcW9Z/w= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3370.eurprd07.prod.outlook.com (10.170.247.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.9; Sun, 10 Mar 2019 12:39:54 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8%3]) with mapi id 15.20.1709.011; Sun, 10 Mar 2019 12:39:53 +0000 From: John Mattsson To: slon v sobstvennom palto , Mohit Sethi M , "Dr. Pala" , Alan DeKok , "emu@ietf.org" Thread-Topic: [Emu] EAP and Fragmentation Thread-Index: AQHU1z5cRf0rDRYRbkO3/kVAb/3xIw== Date: Sun, 10 Mar 2019 12:39:53 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b956cf4e-5c0d-41fc-2759-08d6a5557eef x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3370; x-ms-traffictypediagnostic: HE1PR07MB3370: x-microsoft-antispam-prvs: x-forefront-prvs: 0972DEC1D9 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(366004)(136003)(39860400002)(376002)(346002)(189003)(199004)(25786009)(99286004)(2501003)(83716004)(71200400001)(71190400001)(2906002)(33656002)(82746002)(6506007)(102836004)(7736002)(305945005)(66066001)(6246003)(8676002)(14454004)(81166006)(81156014)(8936002)(97736004)(106356001)(6486002)(256004)(5660300002)(44832011)(2616005)(58126008)(110136005)(478600001)(86362001)(229853002)(316002)(68736007)(36756003)(186003)(6512007)(476003)(6436002)(6116002)(3846002)(105586002)(53936002)(486006)(26005); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3370; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: v/RKE8tP0I5vuL2WKb0Tm2mrZ2PKScAuuJP9GwAvmzXzk6p9nTNTXJWjxag7CzCLB+2eMY3T83Zlfg1B7oyk6c9Lphw+ixv0kCNfRZDlte2YDDqXqV8Syzunv/9ET9f+FfrJoQc5GRcD3+WhGGC9Y18CgbSBiPk2o63My+w3PD5SISxdUZUgGEty+kBUr8PB7HspK+7OY9zy/pQewFn/CNarixToS8Von7VOBosX2NgZPuUNhMBdhrqLl0E/Ig8b5x8OMCERWcQNS5jYUUodfkAaaRswucug10x7UdaR4eHLVv6iT8MiiZrUD9g8gdUwPngRzu39TsxDHU0WUX+iUsf7nZNKjsYL2UasaVwN0dd7EIgpmMJm93zJ6enmRmRDHsr8+KhQ4gGqTowIVc4AXOFE8gcrsbmyaP8nRzRBqkY= Content-Type: text/plain; charset="utf-8" Content-ID: <3D1679EFD2E1AE4686512B8886203475@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: b956cf4e-5c0d-41fc-2759-08d6a5557eef X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Mar 2019 12:39:53.7958 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3370 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrKKsWRmVeSWpSXmKPExsUyM2J7se5s1tYYg7t/TC2aPjexW+zf4GNx bP1aFotnew6yO7B4tBxtYfHYOesuu8eSJT+ZPKZPvM8SwBLFZZOSmpNZllqkb5fAlXH8RUjB NIGKkyeuMjYwPuDvYuTgkBAwkbg7U6yLkYtDSOAIo8TLeX2MEM43RokXG9YywTkH776CcpYw SXSvng5WxiIwgVni4465UJlJTBLLTk5ih3AeMEq8vfORrYuRk4NNwEBi7p4GNpCEiMAZRolj B7eygySEBTQk5k47ClYkIqApcfbIVmYIW0/iyvutYHEWAVWJpW/3M4LYvAL2Em+6OsBsRgEx ie+n1jCB2MwC4hK3nswHsyUEBCSW7DnPDGGLSrx8/I8VxBYV0JfY0veABaI3VqK1dTorRI2i xOl9K6DqZSUuze9mhLB9Jeas+MYKcrSEwE1GiS2zF0A1aEns+Dobalm2xP7tR6AaZCS+vdzJ DNGwjVXi0+oNYNuEBFIllq9thSqSk1jV+5AFoug8s8SqbytZJzDqzELyxSxgxDADQ2P9Ln0I 00Pi5DIRiApFiSndD9lngcNCUOLkzCcsCxhZVzGKFqcWF+emGxnrpRZlJhcX5+fp5aWWbGIE Jp6DW37r7mBc/drxEKMAB6MSD2/z/5YYIdbEsuLK3EOMEhzMSiK85/4AhXhTEiurUovy44tK c1KLDzFKc7AoifP+ERKMERJITyxJzU5NLUgtgskycXBKNTAGaE4wuh1tlPPlVNNy61xlDntP N/nqSD5rhluVG093HjwU8fDj1R2cO39azj5yfEZe5XGW6yfPGuU/Ul8a53r2wdmE99tcA9SS Rey0/f97HY2ePmPelu6beluuLSp7sctPQqon7pE52wrNL+Wvt08SN1FZxX7gfYrbwYrompt7 nnrOdnH8nG6nxFKckWioxVxUnAgApqkGCTgDAAA= Archived-At: Subject: Re: [Emu] EAP and Fragmentation X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 12:40:00 -0000 V2VsY29tZSBhbmQgdGhhbmtzIGZvciB5b3VyIGNvbW1lbnRzIE9sZWchDQoNCnNsb24gdiBzb2Jz dHZlbm5vbSBwYWx0byA8c2xvbnZwYWx0b0BnbWFpbC5jb20+OyB3cm90ZToNCg0KPlBlciBteSBl eHBlcmllbmNlIHRoZSBleGlzdGluZyBmcmFnbWVudGF0aW9uIG1ldGhvZCBkZXNjcmliZWQgaW4g RUFQLVRMUw0KPlJGQyA1MjE2IHNlcnZlcyBnb29kIGZvciBhbGwgZnJhZ21lbnRhdGlvbiBuZWVk cy4gVGhlIG1ldGhvZCBpcyByZXVzZWQgYnkNCj5QRUFQLCBFQVAtRkFTVCwgVEVBUCBhbmQgRUFQ LVRUTFMuIFRoZXJlJ3MgYW4gYW1iaWd1aXR5IGluIEVBUC1UTFMgUkZDIHRoYXQNCj5kb2Vzbid0 IHNwZWNpZnkgd2hldGhlciBhIG5vdC1mcmFnbWVudGVkIG1lc3NhZ2Ugc2hvdWxkIGhhdmUgdGhl IEwgYml0IGFuZA0KPnRoZSA0IG9jdGV0cyBsZW5ndGggZmllbGQgc28gZGlmZmVyZW50IHBlZXJz IHRyZWF0IGl0IGRpZmZlcmVudGx5LiBIb3dldmVyLA0KPmZvciBleGFtcGxlLCBFQVAtVFRMUyBS RkMgY2xvc2VkIGl0IHRpZ2h0bHkgc2F5aW5nIHRoYXQgZXZlbiBhDQo+c2luZ2xlLWZyYWdtZW50 IG1lc3NhZ2Ugc2hvdWxkIGhhdmUgaXQgbmV2ZXJ0aGVsZXNzIG9uIGl0cyByZWR1bmRhbmN5Lg0K DQpJIGNhbm5vdCBmaW5kIGFueXRoaW5nIGluIEVBUC1UVExTIChSRkMgNTI4MSkgc2F5aW5nIHRo YXQgdGhlIEwgYml0IHNob3VsZCBiZSBzZXQuIEFzIHlvdSBoYXZlIG5vdGljZWQsIEVBUC1UTFMg KFJGQyA1MjE2KSBkb2VzIG5vdCBzYXkgYW55dGhpbmcgYWJvdXQgdGhlIEwgYml0IGluIHVuZnJh Z21lbnRlZCBtZXNzYWdlcyBhbmQgbXkgdW5kZXJzdGFuZGluZyBpcyB0aGF0IHRoZSBhbWJpZ3Vp dHkgaXMgaWYgdW5mcmFnbWVudGVkIG1lc3NhZ2VzIGNhbiAobm90IHNob3VsZCkgaGF2ZSB0aGUg TCBiaXQgc2V0LiBBcyBmYXIgYXMgSSBjYW4gc2VlLCBFQVAtVFRMUyAoUkZDIDUyODEpIHN0YXRl cyB0aGF0IHVuZnJhZ21lbnRlZCBtZXNzYWdlcyBNQVkgc2V0IHRoZSBMIGJpdC4NCg0KUkZDIDUy ODEgU2VjdGlvbiA5LjIuMjoNCg0KICAg4oCcVW5mcmFnbWVudGVkIG1lc3NhZ2VzIE1BWSBoYXZl IHRoZSBMIGJpdCBzZXQgYW5kIGluY2x1ZGUgdGhlDQogICAgbGVuZ3RoIG9mIHRoZSBtZXNzYWdl ICh0aG91Z2ggdGhpcyBpbmZvcm1hdGlvbiBpcyByZWR1bmRhbnQpLuKAnQ0KDQpJIGxvb2tlZCB0 aHJvdWdoIHRoZSBvdGhlciBUTFMtYmFzZWQgRUFQIG1ldGhvZHMgKGJvdGggUkZDcyBhbmQgZHJh ZnRzKSBhbmQgbm9uZSBvZiB0aGVtIHNlZW1zIHRvIHNheSBhbnl0aGluZyBuZXcgYWJvdXQgdGhl IEwgYml0LiBkcmFmdC1pZXRmLWVtdS1lYXAtdGxzMTMgc2hvdWxkIGNsYXJpZnkgYW55IGFtYmln dWl0eS4NCg0KU2hvdWxkIGRyYWZ0LWlldGYtZW11LWVhcC10bHMxMy0wNCBqdXN0IGNvcHkgdGhl IHNlbnRlbmNlIGZyb20gUkZDIDUyODEgb3IgZG8gdGhlIGdyb3VwIHdhbnQgc29tZXRoaW5nIGRp ZmZlcmVudD8NCg0KQ2hlZXJzLA0KSm9obg0KDQo= From nobody Sun Mar 10 05:58:26 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EABE512796B for ; Sun, 10 Mar 2019 05:58:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cljq7fsH4xd3 for ; Sun, 10 Mar 2019 05:58:22 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id BD3581200ED for ; Sun, 10 Mar 2019 05:58:22 -0700 (PDT) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 699CB2A0; Sun, 10 Mar 2019 12:58:21 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Alan DeKok In-Reply-To: <035001d4d6da$c613d4b0$523b7e10$@augustcellars.com> Date: Sun, 10 Mar 2019 08:58:19 -0400 Cc: Michael Richardson , EMU WG Content-Transfer-Encoding: quoted-printable Message-Id: <966A395E-DF1E-4988-9817-E7E0DC076CAD@deployingradius.com> References: <84FA2D8F-17EF-4611-81E5-FCDD2C611423@ericsson.com> <8EC98343-E2F7-42DD-9962-EC89865039E1@deployingradius.com> <1DDE7ED1-C539-4E11-81F8-EF557E2F6EB2@deployingradius.com> <031401d4d615$d7b249b0$8716dd10$@augustcellars.com> <24625.1552175430@localhost> <035001d4d6da$c613d4b0$523b7e10$@augustcellars.com> To: Jim Schaad X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 12:58:25 -0000 On Mar 9, 2019, at 7:46 PM, Jim Schaad wrote: > Yes - The resumption credential is on the user's device and on the TLS > server. If the user's device moves then things are just fine. Again, = the > TLS server would need to check the credentials from the cached session My point is that neither RFC 5216 nor this document gives any guidance = here. They don't even mention checking cached authentication data. Alan DeKok. From nobody Sun Mar 10 07:43:06 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6CD7012787D for ; Sun, 10 Mar 2019 07:43:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gJA1zuTkW1bD for ; Sun, 10 Mar 2019 07:43:03 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 02A9C127817 for ; Sun, 10 Mar 2019 07:43:02 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sun, 10 Mar 2019 07:42:35 -0700 From: Jim Schaad To: 'Alan DeKok' CC: 'Michael Richardson' , 'EMU WG' References: <84FA2D8F-17EF-4611-81E5-FCDD2C611423@ericsson.com> <8EC98343-E2F7-42DD-9962-EC89865039E1@deployingradius.com> <1DDE7ED1-C539-4E11-81F8-EF557E2F6EB2@deployingradius.com> <031401d4d615$d7b249b0$8716dd10$@augustcellars.com> <24625.1552175430@localhost> <035001d4d6da$c613d4b0$523b7e10$@augustcellars.com> <966A395E-DF1E-4988-9817-E7E0DC076CAD@deployingradius.com> In-Reply-To: <966A395E-DF1E-4988-9817-E7E0DC076CAD@deployingradius.com> Date: Sun, 10 Mar 2019 07:42:32 -0700 Message-ID: <037201d4d74f$80c995f0$825cc1d0$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQI/mt++Keqc+8bQojuqAILCSXvysAIhTij4A5m6dtwCHbSjzAICcOf1AsKweeoCJtXITgLDlxD/An7sTNEDSyFJtgHuTqYApGVj2LA= Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 14:43:06 -0000 I would totally agree that this type of guidance needs to be added to this document. Jim > -----Original Message----- > From: Alan DeKok > Sent: Sunday, March 10, 2019 5:58 AM > To: Jim Schaad > Cc: Michael Richardson ; EMU WG > > Subject: Re: [Emu] Notes on session resumption with TLS-based EAP > methods > > On Mar 9, 2019, at 7:46 PM, Jim Schaad wrote: > > Yes - The resumption credential is on the user's device and on the TLS > > server. If the user's device moves then things are just fine. Again, > > the TLS server would need to check the credentials from the cached > > session > > My point is that neither RFC 5216 nor this document gives any guidance > here. They don't even mention checking cached authentication data. > > Alan DeKok. From nobody Sun Mar 10 10:27:45 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ABAE5127980 for ; Sun, 10 Mar 2019 10:27:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FpnxtHIOybDq for ; Sun, 10 Mar 2019 10:27:42 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E817312796C for ; Sun, 10 Mar 2019 10:27:41 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 064EB38263; Sun, 10 Mar 2019 13:27:27 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 33B963975; Sun, 10 Mar 2019 13:27:40 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 30EC7478; Sun, 10 Mar 2019 13:27:40 -0400 (EDT) From: Michael Richardson To: Alan DeKok cc: EMU WG In-Reply-To: References: <84FA2D8F-17EF-4611-81E5-FCDD2C611423@ericsson.com> <8EC98343-E2F7-42DD-9962-EC89865039E1@deployingradius.com> <1DDE7ED1-C539-4E11-81F8-EF557E2F6EB2@deployingradius.com> <031401d4d615$d7b249b0$8716dd10$@augustcellars.com> <24625.1552175430@localhost> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 17:27:44 -0000 --=-=-= Content-Type: text/plain If there is no legit use case for TLS resumption, then it seems that EAP servers SHOULD disable TLS resumption. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAlyFSQsACgkQgItw+93Q 3WWuwgf+IBz3vJgSMf4BnqG+MYwJ1ZRuymu3T4HVmiEaW1P39XPOeELIKnLLaodd 7qNDimdxmBjSvGjDNPRa45/bqDd1Eohf/EY0nsx/04dhwaKK0rWz56RcIh+lLsai pJLXZjjlydcv4SGaBk4Mw9yiEh4dtDZZ7MC4JJKdb2QECCtWnJ61xki8/5KG53PR IoxKdoyMc1mUwI9hlziyHDKmPIx/BlCXAldPOd0g9CiVqEDSNO4zwhfRXFdN1f+V K3HIaUSKJzIb2ODB9YUZuSeLsR6MB/u38c0zFrzg5EKXybGkuFN/V2SKtRRiVh+C TUKCiYnDWlXh1PSHKO18G2FB745z+Q== =y5Nx -----END PGP SIGNATURE----- --=-=-=-- From nobody Sun Mar 10 11:32:40 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2137127873 for ; Sun, 10 Mar 2019 11:32:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8hdXdRiUHBgS for ; Sun, 10 Mar 2019 11:32:36 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id B56E91200ED for ; Sun, 10 Mar 2019 11:32:36 -0700 (PDT) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 8232A2A0; Sun, 10 Mar 2019 18:32:35 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Alan DeKok In-Reply-To: <2917.1552238860@localhost> Date: Sun, 10 Mar 2019 14:32:33 -0400 Cc: EMU WG Content-Transfer-Encoding: quoted-printable Message-Id: References: <84FA2D8F-17EF-4611-81E5-FCDD2C611423@ericsson.com> <8EC98343-E2F7-42DD-9962-EC89865039E1@deployingradius.com> <1DDE7ED1-C539-4E11-81F8-EF557E2F6EB2@deployingradius.com> <031401d4d615$d7b249b0$8716dd10$@augustcellars.com> <24625.1552175430@localhost> <2917.1552238860@localhost> To: Michael Richardson X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 18:32:39 -0000 On Mar 10, 2019, at 1:27 PM, Michael Richardson = wrote: >=20 > If there is no legit use case for TLS resumption, then it seems that = EAP > servers SHOULD disable TLS resumption. There are very many use-cases for TLS resumption. The point is that all of these use-cases require additional = information. i.e. the credentials from the original authentication. As such, this document needs to give guidance on this topic. Alan DeKok. From nobody Mon Mar 11 09:52:41 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 92D64131185 for ; Mon, 11 Mar 2019 09:52:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.302 X-Spam-Level: X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=IMODp+A7; dkim=pass (1024-bit key) header.d=ericsson.com header.b=gsOyTuPg Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wXNo0R27zQs3 for ; Mon, 11 Mar 2019 09:52:30 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0349C13113E for ; Mon, 11 Mar 2019 09:52:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1552323147; x=1554915147; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=K5QFqu/xGs93jh2hT0X/UwdS7veOxlHLAHkPFwmwYP4=; b=IMODp+A7fqJX8Y9wK05MzDpb+BpjsI4Phsoo+d99lmI1FvKaAvvoYGq4y3npyT7g Ke+/vY91VbUsJpFoOgqoNCGXwdznyucOZMwQk+4MGf6Ym1xN88FepUixG65mcg7l CAYRrKHhHRdid/64jbA0NZYL497V+S/Cx4j0dowV3Kk=; X-AuditID: c1b4fb30-fabff7000000355c-31-5c86924bb46c Received: from ESESSMB502.ericsson.se (Unknown_Domain [153.88.183.120]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id 57.9A.13660.B42968C5; Mon, 11 Mar 2019 17:52:27 +0100 (CET) Received: from ESESSMR503.ericsson.se (153.88.183.112) by ESESSMB502.ericsson.se (153.88.183.163) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Mon, 11 Mar 2019 17:52:26 +0100 Received: from ESESSMB505.ericsson.se (153.88.183.166) by ESESSMR503.ericsson.se (153.88.183.112) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Mon, 11 Mar 2019 17:52:26 +0100 Received: from EUR03-DB5-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB505.ericsson.se (153.88.183.166) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Mon, 11 Mar 2019 17:52:26 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=K5QFqu/xGs93jh2hT0X/UwdS7veOxlHLAHkPFwmwYP4=; b=gsOyTuPgLthwDDxvTRz0rhTCt3vh6U6cM8r+exDTl3dFk44KL10NiLUqLK6j4Ea1HnGryp9u/ai8JpaXMDZyqAPq5Et2PdGzPVOk8jXf6jtKdhP+Jwe7Ib9H4AomifpY+dcRVivlUktaur78+LLorOHeG4AJZAMWT/Qss3zH28k= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3194.eurprd07.prod.outlook.com (10.170.245.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.11; Mon, 11 Mar 2019 16:52:25 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8%3]) with mapi id 15.20.1709.011; Mon, 11 Mar 2019 16:52:25 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: [Emu] Notes on session resumption with TLS-based EAP methods Thread-Index: AQHU2CrMRdaikKf0y02BbYMOCGZ5xw== Date: Mon, 11 Mar 2019 16:52:25 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 x-originating-ip: [95.192.121.86] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ff05db74-c4b8-450d-49ba-08d6a641f04b x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3194; x-ms-traffictypediagnostic: HE1PR07MB3194: x-microsoft-antispam-prvs: x-forefront-prvs: 09730BD177 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(396003)(376002)(136003)(346002)(39860400002)(199004)(189003)(6512007)(5640700003)(82746002)(6436002)(53936002)(68736007)(58126008)(1730700003)(81156014)(81166006)(6246003)(102836004)(8936002)(6116002)(3846002)(6916009)(26005)(105586002)(106356001)(478600001)(14454004)(6346003)(186003)(2351001)(36756003)(316002)(6506007)(256004)(14444005)(5660300002)(8676002)(2501003)(476003)(2616005)(2906002)(25786009)(486006)(66066001)(305945005)(6486002)(7736002)(229853002)(97736004)(83716004)(71190400001)(71200400001)(44832011)(33656002)(86362001)(99286004); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3194; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: EsvapXoFhE8GMTSLN+ZOkGjVoelxSW7Cq6FggLoDpBCWLaY8X/0soIrtbgvl2uL69A9LTXjXjmYkE8PYvakKsJ/6eFL7oAWIx8pjhAk3doWS2DbkM+hzJ+C3OjucPqQJa1ap2TgzvPCqAl35Ktim/oGai9N6LY2GJRXR/hYi1Byh9AcTFkR85trenlj8OH7o/9ATBN558ngQI1b+nrP9ZMbHsyaJuPCzPOMIErwY1QgYe3QlHVO0FHtdz3biakea+MOneAlmmba7UQe+C1V6r0aLIEPqgizYe4JuzOoJidOkGVm1HIgdIKAq4nozcQVxQjaAML6RZYKw4iICST5vgZC979C/ayjMwOcHtZ0sjGuUbZ6poCKA+dEspXu5274bPnvKY/NQJlck9jcbKsuGefrByK+t50JX8WIEV8Wy7Rw= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: ff05db74-c4b8-450d-49ba-08d6a641f04b X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Mar 2019 16:52:25.2363 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3194 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA02SfUhTYRTGee+9267i4nW5PLo+3Ewh0flBUJBUFpEmQiCBmJIrrx+oU3aX qBSscFNnmmYqaqLRRFouJcymmdF0QX4gjaDUylmazgIpKDMt2u0a9d/vec4573MOvDQpKRP4 09lqLaNRq3IVQk+qKelBUVj8NUNKROUX0f6n3RbqMIo1mdaIkyjZMzqdyc0uZDThB9M8s37e eocKzAlFgzMWQoe64o3Igwa8Fx5NPxQZkSctwSMI6ocmNsU3BG87Zv+Jxql5IS9MBNR9XCU5 QeEaEqpfdSK+UkfArO4ywQsngitWI8XFCHEEtA7qhBz7YDl8dxhIjrfiOLhvHt/0T8CN0c8U z0owtZeKOKZwEDRcbXX7NC3Gh6DOEsjZCG+D1dEugmMS+8L0fBvBX4TBNDhJ8iwF1/tfAo6l OBx6q50U78vBtly+2b8DHG2ViHsecAJ8tV7k1gc8hcA1PCTi/RDom4nj23PAqXsp5Hk7NLc4 RXz/kgAqbpf/yZJgBjotesTvmQp6faOAH9gJ5qo5ih+YJGG0pUdQg0Kb/7uh2Z1H4j3QPRDO 27FgnzBTPMvheuWciGMx9oZnTfNUOxKYkZRl2LN5mVFRSkaTfY5l89VKNaO9h9zf40nveoQV uRZjbAjTSOElfpNhSJEIVIVscZ4NAU0qfMTqErclTlcVlzCa/DOa87kMa0MymlL4ijck3ikS nKnSMjkMU8Bo/lYJ2sNfh7yDFiKbOlsX/EqC+26GLS5vqZAFOxqM2mNxZavNifr6gQQvpjbG r3Tf49DU9l0OnwuJtNToVfS6fzhj2r4WbTd0fDiwYnvBymLuHPmUueTa6C9Ns04VqJ/PjKlX tEr9aVny0VPjl34cr20bGVvvCcmT392dtKC31wbEBxBVOFBBsVmqyBBSw6p+A8o5DW0aAwAA Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 16:52:37 -0000 IEhpLA0KDQpUaGVyZSBzZWVtcyB0byBiZSBhZ3JlZW1lbnQgb24gdGhlIGxpc3QgdG8gYWRkIHNl Y3VyaXR5IGNvbnNpZGVyYXRpb25zIG9uIGF1dGhvcml6YXRpb24gYW5kIHJlc3VtcHRpb24uIFdp dGggdGhlIHRleHQgZnJvbSBBbGFuIGFzIGEgYmFzaXMgKHRoYW5rcyBhZ2FpbiBBbGFuISksIEkg aGF2ZSBhZGRlZCB0aGUgc2VjdGlvbnMgYmVsb3cgdG8gZHJhZnQtaWV0Zi1lbXUtZWFwLXRsczEz Lg0KDQpTb21lIGhpZ2ggbGV2ZWwgY2hhbmdlcyBmcm9tIEFsYXMgdGV4dDoNCiAtIFNvbWUgY29u c2lkZXJhdGlvbnMgYWxzbyBjb3ZlciB0aGUgRUFQIHBlZXINCiAtIERlc2NyaXB0aW9uIG9mIGVu Y2Fwc3VsYXRpb24gcHJvdG9jb2xzIG1vdmVkIGZyb20gcmVzdW1wdGlvbiB0byBhdXRob3JpemF0 aW9uDQogLSBBZGRlZCB0aGF0IHJldm9jYXRpb24gc3RhdHVzIGFuZCBhdXRob3JpemF0aW9uIG1h eSBjaGFuZ2UgYmVmb3JlIHJlc3VtcHRpb24NCg0KRGlzY3Vzc2luZyB3aXRoIG1lIGNvLWF1dGhv ciwgd2UgYWdyZWVkIHRoYXQgY3Jvc3MtbWV0aG9kIHJlc3VtcHRpb24gbWF5IGJlIGJlc3QgdG8g ZGlzY3VzcyBpbiBBbGFucyBkb2N1bWVudCB0aGF0IHRhbGtzIGFib3V0IHZhcmlvdXMgVExTLWJh c2VkIEVBUCBtZXRob2RzLiBUaGF0IGRvY3VtZW50IGlzIGV4cGVjdGVkIHRvIGdvIGludG8gdGhl IHZhcmlvdXMgbWV0aG9kcyBpbiBtb3JlIGRldGFpbC4NCg0KVGhlIHRleHQgYmVsb3cgaXMgd2hh dCBJIHBsYW4gdG8gc3VibWl0IGF0IG1pZG5pZ2h0IFVUQyB0aW1lLiBJIHRoZXJlIGFyZSBjb21t ZW50cyBiZWZvcmUgdGhhdCwgSSBjYW4gdHJ5IHRvIHVwZGF0ZSB0aGUgdGV4dCwgb3RoZXJ3aXNl IHdlIGNhbiB3b3JrIG9uIHRoZSB0ZXh0IGluIHRoZSBjb21pbmcgd2Vla3MgYmVmb3JlIFByYWd1 ZS4NCg0KQ2hlZXJzLA0KSm9obg0KDQoyLjIuICBJZGVudGl0eSBWZXJpZmljYXRpb24NCg0KICAg VGhlIGlkZW50aXR5IHByb3ZpZGVkIGluIHRoZSBFQVAtUmVzcG9uc2UvSWRlbnRpdHkgaXMgbm90 DQogICBhdXRoZW50aWNhdGVkIGJ5IEVBUC1UTFMuICBVbmF1dGhlbnRpY2F0ZWQgaW5mb3JtYXRp b24gU0hBTEwgTk9UIGJlDQogICB1c2VkIGZvciBhY2NvdW50aW5nIHB1cnBvc2VzIG9yIHRvIGdp dmUgYXV0aG9yaXphdGlvbi4gIFRoZQ0KICAgYXV0aGVudGljYXRvciBhbmQgdGhlIEVBUCBzZXJ2 ZXIgTUFZIGV4YW1pbmUgdGhlIGlkZW50aXR5IHByZXNlbnRlZA0KICAgaW4gRUFQLVJlc3BvbnNl L0lkZW50aXR5IGZvciBwdXJwb3NlcyBzdWNoIGFzIHJvdXRpbmcgYW5kIEVBUCBtZXRob2QNCiAg IHNlbGVjdGlvbi4gIFRoZXkgTUFZIHJlamVjdCBjb252ZXJzYXRpb25zIGlmIHRoZSBpZGVudGl0 eSBkb2VzIG5vdA0KICAgbWF0Y2ggdGhlaXIgcG9saWN5LiAgTm90ZSB0aGF0IHRoaXMgYWxzbyBh cHBsaWVzIHRvIHJlc3VtcHRpb24sIHNlZQ0KICAgU2VjdGlvbnMgMi4xLjIsIDUuNiwgYW5kIDUu Ny4NCg0KNS42LiAgQXV0aG9yaXphdGlvbg0KDQogICBFQVAtVExTIG1heSBiZSBlbmNhcHN1bGF0 ZWQgaW4gb3RoZXIgcHJvdG9jb2xzLCBzdWNoIGFzIFBQUA0KICAgW1JGQzE2NjFdLCBSQURJVVMg W1JGQzI4NjVdLCBEaWFtZXRlciBbUkZDNjczM10sIG9yIFBBTkEgW1JGQzUxOTFdLg0KICAgU3lz dGVtcyBpbXBsZW1lbnRpbmcgdGhvc2UgcHJvdG9jb2xzIGludGVyYWN0IHdpdGggRUFQLVRMUyBh bmQgY2FuDQogICBtYWtlIHBvbGljeSBkZWNpc2lvbnMgYW5kIGVuZm9yY2UgYXV0aG9yaXphdGlv biBiYXNlZCBvbiBpbmZvcm1hdGlvbg0KICAgZnJvbSB0aGUgRUFQLVRMUyBleGNoYW5nZS4gIFRo ZSBlbmNhcHN1bGF0aW5nIHByb3RvY29scyBjYW4gYWxzbw0KICAgcHJvdmlkZSBhZGRpdGlvbmFs LCBub24tRUFQIGluZm9ybWF0aW9uIHRvIHRoZSBFQVAgc2VydmVyLiAgVGhpcw0KICAgaW5mb3Jt YXRpb24gY2FuIGluY2x1ZGUsIGJ1dCBpcyBub3QgbGltaXRlZCB0bywgaW5mb3JtYXRpb24gYWJv dXQgdGhlDQogICBhdXRoZW50aWNhdG9yLCBpbmZvcm1hdGlvbiBhYm91dCB0aGUgRUFQIHBlZXIs IG9yIGluZm9ybWF0aW9uIGFib3V0DQogICB0aGUgcHJvdG9jb2wgbGF5ZXJzIGJlbG93IEVBUCAo TUFDIGFkZHJlc3NlcywgSVAgYWRkcmVzc2VzLCBwb3J0DQogICBudW1iZXJzLCBXaUZpIFNTSUQs IGV0Yy4pLg0KDQogICBBcyBub3RlZCBpbiBTZWN0aW9uIDIuMiwgdGhlIGlkZW50aXR5IHByZXNl bnRlZCBpbiBFQVAtUmVzcG9uc2UvDQogICBJZGVudGl0eSBpcyBub3QgYXV0aGVudGljYXRlZCBi eSBFQVAtVExTIGFuZCB0aGVyZWZvcmUgdHJpdmlhbCBmb3IgYW4NCiAgIGF0dGFja2VyIHRvIGZv cmdlLCBtb2RpZnksIG9yIHJlcGxheS4gIEF1dGhvcml6YXRpb24gYW5kIGFjY291bnRpbmcNCiAg IE1VU1QgYmUgYmFzZWQgb24gYXV0aGVudGljYXRlZCBpbmZvcm1hdGlvbiBzdWNoIGFzIGluZm9y bWF0aW9uIGluIHRoZQ0KICAgY2VydGlmaWNhdGUgb3IgdGhlIFBTSyBpZGVudGl0eSBhbmQgY2Fj aGVkIGRhdGEgcHJvdmlzaW9uZWQgZm9yDQogICByZXN1bXB0aW9uIGFzIGRlc2NyaWJlZCBpbiBT ZWN0aW9uIDUuNy4gIE5vdGUgdGhhdCB0aGUgcmVxdWlyZW1lbnRzDQogICBmb3IgTmV0d29yayBB Y2Nlc3MgSWRlbnRpZmllcnMgKE5BSXMpIHNwZWNpZmllZCBpbiBTZWN0aW9uIDQgb2YNCiAgIFtS RkM3NTQyXSBzdGlsbCBhcHBseSBhbmQgTVVTVCBiZSBmb2xsb3dlZC4NCg0KICAgUG9saWN5IGRl Y2lzaW9ucyBhcmUgb2Z0ZW4gYmFzZWQgb24gYSBtaXh0dXJlIG9mIGluZm9ybWF0aW9uIGZyb20N CiAgIFRMUywgRUFQLCBhbmQgZW5jYXBzdWxhdGluZyBwcm90b2NvbHMuICBFQVAgc2VydmVycyBN QVkgcmVqZWN0DQogICBjb252ZXJzYXRpb25zIGJhc2VkIG9uIHVuYXV0aGVudGljYXRlZCBpbmZv cm1hdGlvbiBzdWNoIGFzIGFuIHVua25vd24NCiAgIE1BQyBhZGRyZXNzIG9yIGFuIGlkZW50aXR5 IHByb3ZpZGVkIGluIGluIEVBUC1SZXNwb25zZS9JZGVudGl0eSB0aGF0DQogICBkbyBub3QgbWF0 Y2ggYSBjZXJ0YWluIHBvbGljeS4NCg0KNS43LiAgUmVzdW1wdGlvbg0KDQogICBUaGVyZSBhcmUg YSBudW1iZXIgb2Ygc2VjdXJpdHkgaXNzdWVzIHJlbGF0ZWQgdG8gcmVzdW1wdGlvbiB0aGF0IGFy ZQ0KICAgbm90IGRlc2NyaWJlZCBpbiBbUkZDNTIxNl0uICBUaGUgcHJvYmxlbXMsIGd1aWRlbGlu ZXMsIGFuZA0KICAgcmVxdWlyZW1lbnRzIGluIHRoaXMgc2VjdGlvbiB0aGVyZWZvcmUgYXBwbGll cyB0byBhbGwgdmVyc2lvbiBvZiBUTFMuDQoNCiAgIFdoZW4gcmVzdW1wdGlvbiBvY2N1cnMsIGl0 IGlzIGJhc2VkIG9uIGNhY2hlZCBpbmZvcm1hdGlvbiBhdCB0aGUgVExTDQogICBsYXllci4gIEFz IGRlc2NyaWJlZCBpbiBTZWN0aW9uIDIuMiwgdGhlIGlkZW50aXR5IHByb3ZpZGVkIGluIHRoZQ0K ICAgRUFQLVJlc3BvbnNlL0lkZW50aXR5IGlzIG5vdCBhdXRoZW50aWNhdGVkIGJ5IEVBUC1UTFMu DQoNCiAgIFRvIHBlcmZvcm0gcmVzdW1wdGlvbiBpbiBhIHNlY3VyZSB3YXksIHRoZSBFQVAgcGVl ciBhbmQgRUFQIHNlcnZlcg0KICAgbmVlZCB0byBiZSBhYmxlIHRvIHNlY3VyZWx5IHJldHJpZXZl IGluZm9ybWF0aW9uIHN1Y2ggYXMgY2VydGlmaWNhdGUNCiAgIGNoYWlucywgcmV2b2NhdGlvbiBz dGF0dXMsIGFuZCBvdGhlciBhdXRob3JpemF0aW9uIGluZm9ybWF0aW9uIGZyb20NCiAgIHRoZSBp bml0aWFsIGZ1bGwgaGFuZHNoYWtlLiAgV2UgdXNlIHRoZSB0ZXJtICJjYWNoZWQgZGF0YSIgdG8N CiAgIGRlc2NyaWJlIHN1Y2ggaW5mb3JtYXRpb24uICBBbnkgYXV0aG9yaXphdGlvbiBhcHBsaWVk IGR1cmluZw0KICAgcmVzdW1wdGlvbiBNVVNUIGJlIGRvbmUgdXNpbmcgdGhpcyBjYWNoZWQgZGF0 YS4NCg0KICAgVGhlcmUgYXJlIHR3byB3YXlzIHRvIHJldHJpZXZlIHRoZSBuZWVkZWQgaW5mb3Jt YXRpb24uICBUaGUgZmlyc3QNCiAgIG1ldGhvZCBpcyB0aGF0IHRoZSBUTFMgc2VydmVyIGFuZCBj bGllbnQgY2FjaGVzIHRoZSBpbmZvcm1hdGlvbg0KICAgbG9jYWxseSwgaWRlbnRpZmllZCBieSBh biBpZGVudGlmaWVyIGFuZCBzZWN1cmVkIGJ5IHRoZSBvdGhlciBwYXJ0eQ0KICAgc2hvd2luZyBw cm9vZi1vZi1wb3NpdGlvbiBvZiBhIGtleSBvYnRhaW5lZCBmcm9tIHRoZSBpbml0aWFsIGZ1bGwN CiAgIGhhbmRzaGFrZS4gIEZvciBUTFMgdmVyc2lvbnMgYmVmb3JlIDEuMywgdGhlIGlkZW50aWZp ZXIgY2FuIGJlIHRoZQ0KICAgc2Vzc2lvbiBJRCwgZm9yIFRMUyAxLjMsIHRoZSBpZGVudGlmaWVy IGlzIHRoZSBQU0sgaWRlbnRpdHkuICBUaGUNCiAgIHNlY29uZCBtZXRob2QgaXMgdmlhIFtSRkM1 MDc3XSwgd2hlcmUgdGhlIFRMUyBzZXJ2ZXIgZW5jYXBzdWxhdGVzIHRoZQ0KICAgaW5mb3JtYXRp b24gaW50byBhIHRpY2tldCBhbmQgZm9yd2FyZHMgaXQgdG8gdGhlIGNsaWVudC4gIFRoZSBjbGll bnQNCiAgIGNhbiBzdWJzZXF1ZW50bHkgZG8gcmVzdW1wdGlvbiB1c2luZyB0aGUgb2J0YWluZWQg dGlja2V0LiAgTm90ZSB0aGF0DQogICB0aGUgY2xpZW50IHN0aWxsIG5lZWQgdG8gY2FjaGUgdGhl IGluZm9ybWF0aW9uIGxvY2FsbHkuICBUaGUNCiAgIGZvbGxvd2luZyByZXF1aXJlbWVudHMgYXBw bHkgdG8gYm90aCBtZXRob2RzLg0KDQogICBJZiB0aGUgRUFQIHNlcnZlciBvciBFQVAgY2xpZW50 IGRvIG5vdCBhcHBseSBhbnkgYXV0aG9yaXphdGlvbg0KICAgcG9saWNpZXMsIHRoZXkgTUFZIGFs bG93IHJlc3VtcHRpb24gd2hlcmUgbm8gY2FjaGVkIGRhdGEgaXMNCiAgIGF2YWlsYWJsZS4gIElu IGFsbCBvdGhlciBjYXNlcywgdGhleSBNVVNUIGNhY2hlIGRhdGEgZHVyaW5nIHRoZQ0KICAgaW5p dGlhbCBmdWxsIGF1dGhlbnRpY2F0aW9uIHRvIGVuYWJsZSByZXN1bXB0aW9uLiAgVGhlIGNhY2hl ZCBkYXRhDQogICBNVVNUIGJlIHN1ZmZpY2llbnQgdG8gbWFrZSBhdXRob3JpemF0aW9uIGRlY2lz aW9ucyBkdXJpbmcgcmVzdW1wdGlvbi4NCiAgIElmIGNhY2hlZCBkYXRhIGNhbm5vdCBiZSByZXRy aWV2ZWQgaW4gYSBzZWN1cmUgd2F5LCByZXN1bXB0aW9uIE1VU1QNCiAgIE5PVCBiZSBkb25lLg0K DQogICBUaGUgYWJvdmUgcmVxdWlyZW1lbnRzIGFsc28gYXBwbHkgaWYgdGhlIEVBUCBzZXJ2ZXIg ZXhwZWN0cyBzb21lDQogICBzeXN0ZW0gdG8gcGVyZm9ybSBhY2NvdW50aW5nIGZvciB0aGUgc2Vz c2lvbi4gIFNpbmNlIGFjY291bnRpbmcgbXVzdA0KICAgYmUgdGllZCB0byBhbiBhdXRoZW50aWNh dGVkIGlkZW50aXR5LCBhbmQgcmVzdW1wdGlvbiBkb2VzIG5vdCBzdXBwbHkNCiAgIHN1Y2ggYW4g aWRlbnRpdHksIGFjY291bnRpbmcgaXMgaW1wb3NzaWJsZSB3aXRob3V0IGFjY2VzcyB0byBjYWNo ZWQNCiAgIGRhdGEuDQoNCiAgIFNvbWUgaW5mb3JtYXRpb24gc3VjaCBhcyBJUCBhZGRyZXNzZXMg YW5kIHRoZSBpZGVudGl0eSBwcm92aWRlZCBpbg0KICAgRUFQLVJlc3BvbnNlL0lkZW50aXR5IG1h eSBjaGFuZ2UgYmV0d2VlbiB0aGUgaW5pdGlhbCBmdWxsIGhhbmRzaGFrZQ0KICAgYW5kIHJlc3Vt cHRpb24uICBUaGlzIGNoYW5nZSBjcmVhdGVzIGEgIlRpbWUgb2YgY2hlY2ssIHRpbWUgb2YgdXNl Ig0KICAgKFRPQ1RPVSkgc2VjdXJpdHkgdnVsbmVyYWJpbGl0eS4gIEEgbWFsaWNpb3VzIG9yIGNv bXByb21pc2VkIHVzZXINCiAgIGNvdWxkIHN1cHBseSBvbmUgc2V0IG9mIGRhdGEgZHVyaW5nIHRo ZSBpbml0aWFsIGF1dGhlbnRpY2F0aW9uLCBhbmQgYQ0KICAgZGlmZmVyZW50IHNldCBvZiBkYXRh IGR1cmluZyByZXN1bXB0aW9uLCBwb3RlbnRpYWxseSBsZWFkaW5nIHRvIHRoZW0NCiAgIG9idGFp bmluZyBhY2Nlc3MgdGhhdCB0aGV5IHNob3VsZCBub3QgaGF2ZS4NCg0KICAgSWYgYW55IGF1dGhv cml6YXRpb24sIGFjY291bnRpbmcsIG9yIHBvbGljeSBkZWNpc2lvbnMgd2VyZSBtYWRlIHdpdGgN CiAgIGluZm9ybWF0aW9uIHRoYXQgaGF2ZSBjaGFuZ2VkIHNpbmNlIHRoZSBpbml0aWFsIGZ1bGwg aGFuZHNoYWtlIGFuZA0KICAgcmVzdW1wdGlvbiwgYW5kIGlmIGNoYW5nZSBtYXkgbGVhZCB0byBh IGRpZmZlcmVudCBkZWNpc2lvbiwgc3VjaA0KICAgZGVjaXNpb25zIE1VU1QgYmUgcmVldmFsdWF0 ZWQuICBJdCBpcyBSRUNPTU1FTkRFRCB0aGF0IGF1dGhvcml6YXRpb24sDQogICBhY2NvdW50aW5n LCBhbmQgcG9saWN5IGRlY2lzaW9ucyBhcmUgcmVldmFsdWF0ZWQgYmFzZWQgb24gdGhlDQogICBp bmZvcm1hdGlvbiBnaXZlbiBpbiB0aGUgcmVzdW1wdGlvbi4gIEVBUCBzZXJ2ZXJzIE1BWSByZWpl Y3QNCiAgIHJlc3VtcHRpb24gd2hlcmUgdGhlIGluZm9ybWF0aW9uIHN1cHBsaWVkIGR1cmluZyBy ZXN1bXB0aW9uIGRvZXMgbm90DQogICBtYXRjaCB0aGUgaW5mb3JtYXRpb24gc3VwcGxpZWQgZHVy aW5nIHRoZSBvcmlnaW5hbCBhdXRoZW50aWNhdGlvbi4NCiAgIFdoZXJlIGEgZ29vZCBkZWNpc2lv biBpcyB1bmNsZWFyLCBFQVAgc2VydmVycyBTSE9VTEQgZXJyIG9uIHRoZSBzaWRlDQogICBvZiBj YXV0aW9uLCBhbmQgdGhlcmVmb3JlIHJlamVjdCB0aGUgcmVzdW1wdGlvbi4NCg0KICAgQW55IHNl Y3VyaXR5IHBvbGljaWVzIGZvciBhdXRob3JpemF0aW9uIGFuZCByZXZvY2F0aW9uIE1VU1QgYmUN CiAgIGZvbGxvd2VkIGFsc28gZm9yIHJlc3VtcHRpb24uICBUaGUgRUFQIGNsaWVudCBhbmQgc2Vy dmVyIE1BWSBuZWVkIHRvDQogICByZWNoZWNrIHRoZSBhdXRob3JpemF0aW9uIGFuZCByZXZvY2F0 aW9uIHN0YXR1cyBvZiB0aGUgb3RoZXIgcGFydHkuDQogICBUaGUgY2VydGlmaWNhdGVzIG1heSBo YXZlIGJlZW4gcmV2b2tlZCBzaW5jZSB0aGUgaW5pdGlhbCBmdWxsDQogICBoYW5kc2hha2UgYW5k IHRoZSBhdXRob3JpemF0aW9ucyBvZiB0aGUgb3RoZXIgcGFydHkgbWF5IGhhdmUgYmVlbg0KICAg cmVkdWNlZC4NCg0KICAgSXQgaXMgZGlmZmljdWx0IHRvIHN0YXRlIHRoZSBhYm92ZSByZXF1aXJl bWVudHMgbW9yZSBwcmVjaXNlbHkuICBJZg0KICAgdGhlIEVBUCBzZXJ2ZXIgZGV0ZXJtaW5lIHRo YXQgdGhlIHVzZXIgaXMgYWN0aW5nIG1hbGljaW91c2x5LCB0aGV5DQogICBNVVNUIHJlamVjdCB0 aGUgcmVzdW1wdGlvbi4gIEl0J3MgdXAgdG8gZWFjaCBpbXBsZW1lbnRhdGlvbiBhbmQgLyBvcg0K ICAgZGVwbG95bWVudG1lbnQgb2YgRUFQLVRMUyB0byBkZXRlcm1pbmUgd2hpY2ggaW5mb3JtYXRp b24gdG8gZXhhbWluZSwNCiAgIGFuZCB3aGljaCBwb2xpY2llcyB0byBhcHBseS4NCg0K From nobody Mon Mar 11 10:16:17 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B82B0131163 for ; Mon, 11 Mar 2019 10:16:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zcpDTf8aBGVJ for ; Mon, 11 Mar 2019 10:16:12 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 1C1BD1311CA for ; Mon, 11 Mar 2019 10:16:12 -0700 (PDT) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id C26BC2F6; Mon, 11 Mar 2019 17:16:10 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Alan DeKok In-Reply-To: Date: Mon, 11 Mar 2019 13:16:09 -0400 Cc: "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <163B9F13-DA30-46C1-A984-96352CD45A76@deployingradius.com> References: To: John Mattsson X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Emu] Notes on session resumption with TLS-based EAP methods X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 17:16:16 -0000 On Mar 11, 2019, at 12:52 PM, John Mattsson = wrote: > There seems to be agreement on the list to add security considerations = on authorization and resumption. With the text from Alan as a basis = (thanks again Alan!), I have added the sections below to = draft-ietf-emu-eap-tls13. >=20 > Some high level changes from Alas text: > - Some considerations also cover the EAP peer > - Description of encapsulation protocols moved from resumption to = authorization > - Added that revocation status and authorization may change before = resumption Sounds good. > Discussing with me co-author, we agreed that cross-method resumption = may be best to discuss in Alans document that talks about various = TLS-based EAP methods. That document is expected to go into the various = methods in more detail. It may be worth mentioning it here, and saying that the = implementations should be aware of it, and take steps to address it. > 2.2. Identity Verification >=20 > The identity provided in the EAP-Response/Identity is not > authenticated by EAP-TLS. Unauthenticated information SHALL NOT be > used for accounting purposes or to give authorization. The > authenticator and the EAP server MAY examine the identity presented > in EAP-Response/Identity for purposes such as routing and EAP method > selection. They MAY reject conversations if the identity does not > match their policy. Note that this also applies to resumption, see > Sections 2.1.2, 5.6, and 5.7. That looks good. > 5.6. Authorization >=20 > EAP-TLS may be encapsulated in other protocols, such as PPP > [RFC1661], RADIUS [RFC2865], Diameter [RFC6733], or PANA [RFC5191]. > Systems implementing those protocols interact with EAP-TLS and can > make policy decisions and enforce authorization based on information > from the EAP-TLS exchange. The encapsulating protocols can also > provide additional, non-EAP information to the EAP server. This > information can include, but is not limited to, information about = the > authenticator, information about the EAP peer, or information about > the protocol layers below EAP (MAC addresses, IP addresses, port > numbers, WiFi SSID, etc.). >=20 > As noted in Section 2.2, the identity presented in EAP-Response/ > Identity is not authenticated by EAP-TLS and therefore trivial for = an nit: "therefore is trivial", or "is therefore trivial" > attacker to forge, modify, or replay. Authorization and accounting > MUST be based on authenticated information such as information in = the > certificate or the PSK identity and cached data provisioned for > resumption as described in Section 5.7. Note that the requirements > for Network Access Identifiers (NAIs) specified in Section 4 of > [RFC7542] still apply and MUST be followed. >=20 > Policy decisions are often based on a mixture of information from > TLS, EAP, and encapsulating protocols. EAP servers MAY reject > conversations based on unauthenticated information such as an = unknown nit: I'd say "based on examining unauthenticated information" Otherwise it could be seen as rejecting the session if unauthenticated = information *exists*. > MAC address or an identity provided in in EAP-Response/Identity that > do not match a certain policy. >=20 > 5.7. Resumption >=20 > There are a number of security issues related to resumption that are > not described in [RFC5216]. The problems, guidelines, and > requirements in this section therefore applies to all version of = TLS. >=20 > When resumption occurs, it is based on cached information at the TLS > layer. As described in Section 2.2, the identity provided in the > EAP-Response/Identity is not authenticated by EAP-TLS. >=20 > To perform resumption in a secure way, the EAP peer and EAP server > need to be able to securely retrieve information such as certificate > chains, revocation status, and other authorization information from > the initial full handshake. We use the term "cached data" to > describe such information. Any authorization applied during > resumption MUST be done using this cached data. It might be worth mentioning the unauthenticated data here, too. > There are two ways to retrieve the needed information. The first > method is that the TLS server and client caches the information > locally, identified by an identifier and secured by the other party > showing proof-of-position of a key obtained from the initial full > handshake. For TLS versions before 1.3, the identifier can be the > session ID, for TLS 1.3, the identifier is the PSK identity. The > second method is via [RFC5077], where the TLS server encapsulates = the > information into a ticket and forwards it to the client. The client > can subsequently do resumption using the obtained ticket. Note that > the client still need to cache the information locally. The nit: "needs" > following requirements apply to both methods. >=20 > If the EAP server or EAP client do not apply any authorization > policies, they MAY allow resumption where no cached data is > available. In all other cases, they MUST cache data during the > initial full authentication to enable resumption. The cached data > MUST be sufficient to make authorization decisions during = resumption. > If cached data cannot be retrieved in a secure way, resumption MUST > NOT be done. >=20 > The above requirements also apply if the EAP server expects some > system to perform accounting for the session. Since accounting must > be tied to an authenticated identity, and resumption does not supply > such an identity, accounting is impossible without access to cached > data. >=20 > Some information such as IP addresses and the identity provided in > EAP-Response/Identity may change between the initial full handshake > and resumption. This change creates a "Time of check, time of use" > (TOCTOU) security vulnerability. A malicious or compromised user > could supply one set of data during the initial authentication, and = a > different set of data during resumption, potentially leading to them > obtaining access that they should not have. >=20 > If any authorization, accounting, or policy decisions were made with > information that have changed since the initial full handshake and > resumption, and if change may lead to a different decision, such > decisions MUST be reevaluated. It is RECOMMENDED that = authorization, > accounting, and policy decisions are reevaluated based on the > information given in the resumption. EAP servers MAY reject > resumption where the information supplied during resumption does not > match the information supplied during the original authentication. > Where a good decision is unclear, EAP servers SHOULD err on the side > of caution, and therefore reject the resumption. >=20 > Any security policies for authorization and revocation MUST be > followed also for resumption. The EAP client and server MAY need to > recheck the authorization and revocation status of the other party. > The certificates may have been revoked since the initial full > handshake and the authorizations of the other party may have been > reduced. Very good points, and something I had missed. > It is difficult to state the above requirements more precisely. If > the EAP server determine that the user is acting maliciously, they > MUST reject the resumption. It's up to each implementation and / or > deploymentment of EAP-TLS to determine which information to examine, > and which policies to apply. >=20 > _______________________________________________ > Emu mailing list > Emu@ietf.org > https://www.ietf.org/mailman/listinfo/emu From nobody Mon Mar 11 14:06:22 2019 Return-Path: X-Original-To: emu@ietf.org Delivered-To: emu@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3EF1E13116B; Mon, 11 Mar 2019 14:06:21 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: emu@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.93.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: emu@ietf.org Message-ID: <155233838123.23074.17569403927511490053@ietfa.amsl.com> Date: Mon, 11 Mar 2019 14:06:21 -0700 Archived-At: Subject: [Emu] I-D Action: draft-ietf-emu-eap-tls13-04.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 21:06:21 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the EAP Method Update WG of the IETF. Title : Using EAP-TLS with TLS 1.3 Authors : John Mattsson Mohit Sethi Filename : draft-ietf-emu-eap-tls13-04.txt Pages : 28 Date : 2019-03-11 Abstract: This document specifies the use of EAP-TLS with TLS 1.3 while remaining backwards compatible with existing implementations of EAP- TLS. TLS 1.3 provides significantly improved security, privacy, and reduced latency when compared to earlier versions of TLS. EAP-TLS with TLS 1.3 further improves security and privacy by mandating use of privacy and revocation checking. This document updates RFC 5216. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-emu-eap-tls13/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-emu-eap-tls13-04 https://datatracker.ietf.org/doc/html/draft-ietf-emu-eap-tls13-04 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-emu-eap-tls13-04 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Mar 12 01:38:56 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF70C130EE7 for ; Tue, 12 Mar 2019 01:38:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bzih28_Kzyrc for ; Tue, 12 Mar 2019 01:38:52 -0700 (PDT) Received: from smtp-out-02.aalto.fi (smtp-out-02.aalto.fi [130.233.228.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94B5D130EC2 for ; Tue, 12 Mar 2019 01:38:51 -0700 (PDT) Received: from smtp-out-02.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 4E07E27127B_C876EECB for ; Tue, 12 Mar 2019 08:33:48 +0000 (GMT) Received: from exng4.org.aalto.fi (exng4.org.aalto.fi [130.233.223.23]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng4.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-02.aalto.fi (Sophos Email Appliance) with ESMTPS id DC6C427121C_C876EEBF for ; Tue, 12 Mar 2019 08:33:47 +0000 (GMT) Received: from exng5.org.aalto.fi (130.233.223.24) by exng4.org.aalto.fi (130.233.223.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1591.10; Tue, 12 Mar 2019 10:38:49 +0200 Received: from exng8.org.aalto.fi (130.233.223.27) by exng5.org.aalto.fi (130.233.223.24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Tue, 12 Mar 2019 10:38:48 +0200 Received: from exng8.org.aalto.fi ([fe80::edd7:7397:1f7f:cd7]) by exng8.org.aalto.fi ([fe80::edd7:7397:1f7f:cd7%17]) with mapi id 15.01.1591.008; Tue, 12 Mar 2019 10:38:48 +0200 From: Aura Tuomas To: "emu@ietf.org" Thread-Topic: New Version Notification for draft-aura-eap-noob-05.txt Thread-Index: AQHU2DZ9RLLLTlu3bkiQ6OXg+h45RKYHrGNA Date: Tue, 12 Mar 2019 08:38:48 +0000 Message-ID: References: <155232816096.23050.1126203499822075369.idtracker@ietfa.amsl.com> In-Reply-To: <155232816096.23050.1126203499822075369.idtracker@ietfa.amsl.com> Accept-Language: fi-FI, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.233.0.5] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-SASI-RCODE: 200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=from:to:subject:date:message-id:references:in-reply-to:content-type:content-transfer-encoding:mime-version; s=its18; bh=5DoXvFxjdn302twY9aJywRtjlWsvWjZxJc22syX9lOM=; b=T/pZkO0VDQazyLQjXX6ag1TXpg7lTrwgh+0T0QzOwWYEzccfcGUU3T8kKtpQa4F8JRBiiM38EdxYdTSiZ7DnY5SBW9W2zqYzPu0C5T0O+/aWp8Kra30izCXdJ/VlDSz4oy6p4jZ/jXvxfMY5QZPHBgwXqaSEzX9i1EDZGhl0HkdlTWcF3VFeJyOcWCog8sXjTVtLrpqiiCcmbaLGYEdaLxVwsYIhU2p3qNfOdYV87Aa99NmNCV2ZkSbwVacs0eAR2DLYoWKSRsQpcvUmFuBniiuffktKEh4pzD6EK+cWfvs4Mf8T7Yy+etu0opyQRqLmDOV5dNOJqk13WzaMLUhFoA== Archived-At: Subject: [Emu] FW: New Version Notification for draft-aura-eap-noob-05.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 08:38:54 -0000 SGkgYWxsIQ0KDQpXZSBoYXZlIHVwZGF0ZWQgdGhlIEVBUC1OT09CIGRyYWZ0LiBUaGUgc2VjdXJp dHkgY29uc2lkZXJhdGlvbnMgc2VjdGlvbiBoYXMgYmVlbiBpbXByb3ZlZCBiYXNlZCBvbiBjb21t ZW50cyBmcm9tIEVyaWMgUmVzY29ybGEgYXQgc2VjZGlzcGF0Y2ggYW5kIG91ciBvbmdvaW5nIG1v ZGVsaW5nIHdvcmsuIFdlIGhhdmUgYWxzbyBtYWRlIHNvbWUgY2hhbmdlcyB0byB0aGUgUmVjb25u ZWN0IEV4Y2hhbmdlIGJhc2VkIG9uIGltcGxlbWVudGF0aW9uIGV4cGVyaWVuY2VzIHRvIG1ha2Ug aXQgZWFzaWVyIHRvIGltcGxlbWVudC4gDQoNClJlZ2FyZHMsDQpUdW9tYXMNCg0KDQotLS0tLU9y aWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogaW50ZXJuZXQtZHJhZnRzQGlldGYub3JnIDxpbnRl cm5ldC1kcmFmdHNAaWV0Zi5vcmc+IA0KU2VudDogTW9uZGF5LCAxMSBNYXJjaCwgMjAxOSAyMDox Ng0KVG86IE1vaGl0IFNldGhpIDxtb2hpdEBwaXVoYS5uZXQ+OyBBdXJhIFR1b21hcyA8dHVvbWFz LmF1cmFAYWFsdG8uZmk+DQpTdWJqZWN0OiBOZXcgVmVyc2lvbiBOb3RpZmljYXRpb24gZm9yIGRy YWZ0LWF1cmEtZWFwLW5vb2ItMDUudHh0DQoNCg0KQSBuZXcgdmVyc2lvbiBvZiBJLUQsIGRyYWZ0 LWF1cmEtZWFwLW5vb2ItMDUudHh0IGhhcyBiZWVuIHN1Y2Nlc3NmdWxseSBzdWJtaXR0ZWQgYnkg VHVvbWFzIEF1cmEgYW5kIHBvc3RlZCB0byB0aGUgSUVURiByZXBvc2l0b3J5Lg0KDQpOYW1lOgkJ ZHJhZnQtYXVyYS1lYXAtbm9vYg0KUmV2aXNpb246CTA1DQpUaXRsZToJCU5pbWJsZSBvdXQtb2Yt YmFuZCBhdXRoZW50aWNhdGlvbiBmb3IgRUFQIChFQVAtTk9PQikNCkRvY3VtZW50IGRhdGU6CTIw MTktMDMtMTENCkdyb3VwOgkJSW5kaXZpZHVhbCBTdWJtaXNzaW9uDQpQYWdlczoJCTYwDQpVUkw6 ICAgICAgICAgICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvaW50ZXJuZXQtZHJhZnRzL2RyYWZ0LWF1 cmEtZWFwLW5vb2ItMDUudHh0DQpTdGF0dXM6ICAgICAgICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5p ZXRmLm9yZy9kb2MvZHJhZnQtYXVyYS1lYXAtbm9vYi8NCkh0bWxpemVkOiAgICAgICBodHRwczov L3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtYXVyYS1lYXAtbm9vYi0wNQ0KSHRtbGl6ZWQ6ICAg ICAgIGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2h0bWwvZHJhZnQtYXVyYS1lYXAt bm9vYg0KRGlmZjogICAgICAgICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL3JmY2RpZmY/dXJsMj1k cmFmdC1hdXJhLWVhcC1ub29iLTA1DQoNCkFic3RyYWN0Og0KICAgRXh0ZW5zaWJsZSBBdXRoZW50 aWNhdGlvbiBQcm90b2NvbCAoRUFQKSBwcm92aWRlcyBzdXBwb3J0IGZvcg0KICAgbXVsdGlwbGUg YXV0aGVudGljYXRpb24gbWV0aG9kcy4gIFRoaXMgZG9jdW1lbnQgZGVmaW5lcyB0aGUgRUFQLU5P T0INCiAgIGF1dGhlbnRpY2F0aW9uIG1ldGhvZCBmb3IgbmltYmxlIG91dC1vZi1iYW5kIChPT0Ip IGF1dGhlbnRpY2F0aW9uIGFuZA0KICAga2V5IGRlcml2YXRpb24uICBUaGlzIEVBUCBtZXRob2Qg aXMgaW50ZW5kZWQgZm9yIGJvb3RzdHJhcHBpbmcgYWxsDQogICBraW5kcyBvZiBJbnRlcm5ldC1v Zi1UaGluZ3MgKElvVCkgZGV2aWNlcyB0aGF0IGhhdmUgYSBtaW5pbWFsIHVzZXINCiAgIGludGVy ZmFjZSBhbmQgbm8gcHJlLWNvbmZpZ3VyZWQgYXV0aGVudGljYXRpb24gY3JlZGVudGlhbHMuICBU aGUNCiAgIG1ldGhvZCBtYWtlcyB1c2Ugb2YgYSB1c2VyLWFzc2lzdGVkIG9uZS1kaXJlY3Rpb25h bCBPT0IgY2hhbm5lbA0KICAgYmV0d2VlbiB0aGUgcGVlciBkZXZpY2UgYW5kIGF1dGhlbnRpY2F0 aW9uIHNlcnZlci4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA0KDQoNClBsZWFzZSBub3Rl IHRoYXQgaXQgbWF5IHRha2UgYSBjb3VwbGUgb2YgbWludXRlcyBmcm9tIHRoZSB0aW1lIG9mIHN1 Ym1pc3Npb24gdW50aWwgdGhlIGh0bWxpemVkIHZlcnNpb24gYW5kIGRpZmYgYXJlIGF2YWlsYWJs ZSBhdCB0b29scy5pZXRmLm9yZy4NCg0KVGhlIElFVEYgU2VjcmV0YXJpYXQNCg0K From nobody Tue Mar 12 01:46:45 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDA06130F04 for ; Tue, 12 Mar 2019 01:46:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yDF8Dk1Ru7_P for ; Tue, 12 Mar 2019 01:46:41 -0700 (PDT) Received: from smtp-out-01.aalto.fi (smtp-out-01.aalto.fi [130.233.228.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C09D130F03 for ; Tue, 12 Mar 2019 01:46:41 -0700 (PDT) Received: from smtp-out-01.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 2A5891156F2_C8770BFB; Tue, 12 Mar 2019 08:41:35 +0000 (GMT) Received: from exng2.org.aalto.fi (exng2.org.aalto.fi [130.233.223.21]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng2.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-01.aalto.fi (Sophos Email Appliance) with ESMTPS id E5E611156B7_C8770BEF; Tue, 12 Mar 2019 08:41:34 +0000 (GMT) Received: from exng8.org.aalto.fi (130.233.223.27) by exng2.org.aalto.fi (130.233.223.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Tue, 12 Mar 2019 10:46:36 +0200 Received: from exng8.org.aalto.fi ([fe80::edd7:7397:1f7f:cd7]) by exng8.org.aalto.fi ([fe80::edd7:7397:1f7f:cd7%17]) with mapi id 15.01.1591.008; Tue, 12 Mar 2019 10:46:35 +0200 From: Aura Tuomas To: Eliot Lear , Alan DeKok CC: "emu@ietf.org" Thread-Topic: [Emu] Questions about EAP-NOOB Thread-Index: AQHUtv4YZAoDasa4BUyOI5o1puTbU6X+uYww///rxICAAAzWAIAJPkSA Date: Tue, 12 Mar 2019 08:46:35 +0000 Message-ID: <361cafd91e8b4a85b8f6eee745561bfc@aalto.fi> References: <26418_1548675555_5C4EE9E1_26418_441_1_e069870a-1233-fb27-5f07-13da2df1e138@odins.es> <42f019ff036243f1afd9cb67f4517eb4@aalto.fi> <1A69D852-25F4-40B7-8A8D-434CECB586D6@deployingradius.com> <8E1E0840-C82B-4AE7-A6F2-106FC9834A1A@cisco.com> In-Reply-To: <8E1E0840-C82B-4AE7-A6F2-106FC9834A1A@cisco.com> Accept-Language: fi-FI, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.233.0.5] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-SASI-RCODE: 200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=from:to:cc:subject:date:message-id:references:in-reply-to:content-type:content-transfer-encoding:mime-version; s=its18; bh=s69nI2GHnfGc3vEAOZiWf2mIfAOivplTK2jFb85FmQI=; b=gfE5JSjT0AOMjj5bh80Bd2NIckdOClv9eYSfeN5zJV2LIK+QJ/jRyA2FaTZXzIHIIAYm2T/hNxSOKcY3qql1eDSvujkdMVk8Cxlu4OZolJR8/EYZWQSB+CODW3/VOM2qaORBhXnjvH/eT63WkhKbDmVUA7y6B7NkCr6sMXOR4mPVabL085a8QLqgtCtK5DxOVDRoie188w1xG3RbRqr5SH2HBauYN+ssI+VbYQIujVLG60YI3244MKXAvojsyKWauzNb/2DvhmQhusdXz5DSfhHqWeV3KJ+qqV5vSzhxrDlAYKmWc9LQuWOmhW+reHTLetCclHx0v8cfJA9y3YoDXQ== Archived-At: Subject: Re: [Emu] Questions about EAP-NOOB X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 08:46:44 -0000 V2UgaGFkIGludGVuZGVkIHRvIHRyYW5zZmVyICJlYXAtbm9vYi5uZXQiIHRvIElBTkEsIGJ1dCBy ZXBsYWNpbmcgdGhpcyBkb21haW4gd2l0aCAuYXJwYSBpcyBlcXVhbGx5IG9rLiANCg0KVGhlIGRv bWFpbiBuYW1lIHJlc2VydmF0aW9uIGNvbnNpZGVyYXRpb25zIGluIHNlY3Rpb24gNC40LiBvZiBo dHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtYXVyYS1lYXAtbm9vYi0wNSNzZWN0aW9u LTQuNCB3aWxsIHN0aWxsIGJlIHJlbGV2YW50LiAgDQoNClR1b21hcw0KDQoNCi0tLS0tT3JpZ2lu YWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBFbGlvdCBMZWFyIDxsZWFyQGNpc2NvLmNvbT4gDQpTZW50 OiBXZWRuZXNkYXksIDYgTWFyY2gsIDIwMTkgMTU6MzENClRvOiBBbGFuIERlS29rIDxhbGFuZEBk ZXBsb3lpbmdyYWRpdXMuY29tPg0KQ2M6IEF1cmEgVHVvbWFzIDx0dW9tYXMuYXVyYUBhYWx0by5m aT47IGVtdUBpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtFbXVdIFF1ZXN0aW9ucyBhYm91dCBFQVAt Tk9PQg0KSW1wb3J0YW5jZTogSGlnaA0KDQpBbmQgaW5kZWVkIGl0IHdhcyBBbGFuIHdobyBJIHdh cyByZWZlcnJpbmcgdG8gaW4gbXkgbWVzc2FnZS4gIEkgZ2VuZXJhbGx5IGFncmVlIHdpdGggQWxh buKAmXMgdGhpbmtpbmcgYmVsb3cuDQoNCkVsaW90DQoNCj4gT24gNiBNYXIgMjAxOSwgYXQgMTM6 NDUsIEFsYW4gRGVLb2sgPGFsYW5kQGRlcGxveWluZ3JhZGl1cy5jb20+IHdyb3RlOg0KPiANCj4g T24gTWFyIDYsIDIwMTksIGF0IDc6MjMgQU0sIEF1cmEgVHVvbWFzIDx0dW9tYXMuYXVyYUBhYWx0 by5maT4gd3JvdGU6DQo+PiBUaGUgcmVhbG0gdXNlZCBieSB0aGUgcGVlciBpcyBpbml0aWFsbHkg 4oCcZWFwLW5vb2IubmV04oCdLiBUaGUgc2VydmVyIGNhbiBhc3NpZ24gYW5vdGhlciByZWFsbSBp biBJbml0aWFsIEV4Y2hhbmdlLiBUaGUgbWFpbiBwdXJwb3NlIGZvciBhc3NpZ25pbmcgYW5vdGhl ciByZWFsbSBpcyB0aGF0IHRoZSBwZWVyIGNhbiBsYXRlciB1c2UgaXQgZm9yIHJvYW1pbmcgaW4g YWNjZXNzIG5ldHdvcmtzIHRoYXQgaGF2ZSBBQUEgcm91dGluZyBzZXQgdXAgZm9yIHRoZSBhc3Np Z25lZCByZWFsbS4NCj4gDQo+ICBUaGlzIGlzIGZpbmUgZm9yIGFuIGluaXRpYWwgZHJhZnQuICBJ J2QgYXZvaWQgaW1wbGVtZW50aW5nIGFueXRoaW5nIHRoYXQgdXNlcyAiZWFwLW5vb2IubmV0Iiwg dGhvdWdoLg0KPiANCj4gIFRoZSBjb3JyZWN0IGRvbWFpbiB0byB1c2UgaXMgLmFycGE6DQo+IA0K PiAgIGh0dHBzOi8vd3d3LmlhbmEub3JnL2RvbWFpbnMvYXJwYQ0KPiANCj4gIFRoZSBjb250cm9s bGluZyBkb2N1bWVudCBoZXJlIGlzIFJGQyAzMTcyLg0KPiANCj4gIEl0IGxvb2tzIGxpa2UgRUFQ LVRFQVAtQlJTS0kgcmVxdWlyZXMgYSBzaW1pbGFyIE5BSSBmb3IgcHJvdmlzaW9uaW5nLiAgU28g aXQgd291bGQgYmVzdCBiZXN0IHRvIGNvb3JkaW5hdGUgYm90aCB0aGUgbmFtZSwgYW5kIHRoZSB1 c2Ugb2YgaXQuICBQZXJoYXBzICJwcm92aXNpb25pbmcuYXJwYSIgY291bGQgYmUgdXNlZCBhcyBh IGdlbmVyaWMgbmFtZSwgYW5kIHRoZW4gc3ViZG9tYWlucyB3aXRoaW4gdGhhdCBjb3VsZCBiZSB1 c2VkIGZvciBwYXJ0aWN1bGFyIHB1cnBvc2VzLg0KPiANCj4gIEFsYW4gRGVLb2suDQo+IA0KPiBf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiBFbXUgbWFp bGluZyBsaXN0DQo+IEVtdUBpZXRmLm9yZw0KPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL2VtdQ0KDQo= From nobody Tue Mar 12 03:33:53 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C548612F19D for ; Tue, 12 Mar 2019 03:33:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.302 X-Spam-Level: X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=JXGR83OV; dkim=pass (1024-bit key) header.d=ericsson.com header.b=UPt4nUWb Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VVDBXA1o-W7H for ; Tue, 12 Mar 2019 03:33:50 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9B5812E036 for ; Tue, 12 Mar 2019 03:33:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1552386826; x=1554978826; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=xhE5ZqVa7DYjTQjKc7bvSu9nQXx/DZ5zw++WyamJTBk=; b=JXGR83OVunK0VAD3T9ocfmqgmmRKWibZW3eaRunx5oA3xFvZSzWfzKZEh24SnE7c V9vuINjvZHiJw2hJooiJ8iIWbi4VRAEMzI+1GsRWh0yPZtXrZzjTlvdqmAUFDdbG po8Ikg3+DVuoHLnxElreLPicYkEY+FJK2DNksvckHOs=; X-AuditID: c1b4fb30-41b3a9e00000355c-46-5c878b0a4130 Received: from ESESSMB501.ericsson.se (Unknown_Domain [153.88.183.119]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id 1C.0E.13660.A0B878C5; Tue, 12 Mar 2019 11:33:46 +0100 (CET) Received: from ESESBMB505.ericsson.se (153.88.183.172) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Tue, 12 Mar 2019 11:33:42 +0100 Received: from EUR03-VE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB505.ericsson.se (153.88.183.172) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Tue, 12 Mar 2019 11:33:42 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xhE5ZqVa7DYjTQjKc7bvSu9nQXx/DZ5zw++WyamJTBk=; b=UPt4nUWbI93f/HtPYJo0XQ8DmEAxmRzas5zgkcnq3kfScXjT554YUaZEmwH2YyU+wYtbBTPgQOujWNYrgSf8ajKhoVAJPw0EzmYEpON1AIipsFPMfkusMmydMiuxz2vEtecBYjQNGmEoFC87mvjZaN6OEeksVT4oHL9FBUIBPZE= Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com (10.168.98.146) by HE1PR0701MB2585.eurprd07.prod.outlook.com (10.168.184.9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.6; Tue, 12 Mar 2019 10:33:41 +0000 Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::6877:aa58:3e6:6a4b]) by HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::6877:aa58:3e6:6a4b%5]) with mapi id 15.20.1709.011; Tue, 12 Mar 2019 10:33:41 +0000 From: Mohit Sethi M To: "emu@ietf.org" , "emu-chairs@ietf.org" Thread-Topic: Agenda Items for IETF 104 Thread-Index: AQHU2L8PbdqfyXxmRESFMLF7uB6pdA== Date: Tue, 12 Mar 2019 10:33:41 +0000 Message-ID: <2ce13f03-e5bc-b17e-673d-fa1540b2528d@ericsson.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 x-originating-ip: [89.166.49.243] x-clientproxiedby: HE1PR0701CA0068.eurprd07.prod.outlook.com (2603:10a6:3:64::12) To HE1PR0701MB2905.eurprd07.prod.outlook.com (2603:10a6:3:57::18) authentication-results: spf=none (sender IP is ) smtp.mailfrom=mohit.m.sethi@ericsson.com; x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 18328521-4918-4703-2ea5-08d6a6d631cc x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:HE1PR0701MB2585; x-ms-traffictypediagnostic: HE1PR0701MB2585: x-microsoft-antispam-prvs: x-forefront-prvs: 09749A275C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(39860400002)(366004)(136003)(396003)(346002)(189003)(199004)(186003)(2616005)(6116002)(3846002)(476003)(6436002)(6512007)(486006)(6486002)(68736007)(65826007)(53936002)(14454004)(25786009)(413944005)(2906002)(478600001)(316002)(450100002)(2501003)(110136005)(102836004)(71200400001)(71190400001)(386003)(6506007)(106356001)(105586002)(5660300002)(4744005)(26005)(31686004)(8936002)(7736002)(256004)(58126008)(31696002)(305945005)(81166006)(81156014)(36756003)(65806001)(64126003)(65956001)(66066001)(99286004)(86362001)(14444005)(97736004)(8676002)(52116002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2585; H:HE1PR0701MB2905.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: pAl9EaqSfYTifxYKjE4VnUL7u0MqIpQ/lJvwJ00KpdD+ONOobogpEE4MaN8W+9GUs1am7jtOhD1XCvktq9lNtvVNwokFWTpq4QumN174RngxJMdCcVUFC5ZszZOy+wzDphfuYJI6GU+JgjE1Wb1NSQ7gOSmNd8/9Wjd22BZuO8SIgT7NAnrmeD3jONe0wegjKA4rpmkTlavu3Ar8Ay33aGrBfYaJ7ieki05EMdmqebyJcMPkOlrCRC4ThC4GoJDwGcUUY6tzSa0SoSQ4Eiwgk5rZRXP91Rmv5qw3WZRpo5qYBxUk2MvfLdpFcx4kXyRbMiJzKo91YY6xnDLmFO/oBwvA5dPY5d7AfTYdpckxUZXZx1/BfDAiN5enRXhB0ww8VdSA/Gl3yP379ksF3P6UogNCL5OUlbHDEI1qrAuBnlo= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 18328521-4918-4703-2ea5-08d6a6d631cc X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Mar 2019 10:33:41.1753 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2585 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFuplleLIzCtJLcpLzFFi42KZGbG9XJeruz3G4PpXa4uprbuZLY6tX8vi wOSxZMlPpgDGKC6blNSczLLUIn27BK6MtrunGAv2sVY8bWxjb2Bcw9rFyMEhIWAi8eVefBcj F4eQwBFGiZtHbzNDON8YJWbdecEI4SxhkljS2cYE4rAITGCWeH9sHitEZiqTxLn57UwQzhNG iWUbngD1cHKwCRhITJ6ygh3EFhHwk/jcuwAsLiygJDHl/U4miLi6RP/HFawQtp7El/nTwGwW AVWJdec3MoPYvAL2EmtO3WYDsRkFxCS+n1oD1sssIC5x68l8MFtCQEBiyZ7zzBC2qMTLx//A 5ogKREhcWb+fHSKuKHH23UOwQyUEpjNKHD5xnh1iaKzEh//9UIN0JM5eh3hAQkBW4tL8bijb V2LNgzZGiObbjBJPLmxlhGn48P0V1OZ8icvbf7NB2DISp/ftZINo+MoqcaajG+wkIYFUieVr W6Ga5SRW9T5kmcCoOwvJR7OA0cIsoCmxfpc+RNhD4uG/jawQtqLElO6H7LPAASMocXLmE5YF jKyrGEWLU4uTctONjPRSizKTi4vz8/TyUks2MQITycEtvw12ML587niIUYCDUYmHV7+qPUaI NbGsuDL3EKMEB7OSCK9FDlCINyWxsiq1KD++qDQntfgQozQHi5I47x8hwRghgfTEktTs1NSC 1CKYLBMHp1QDY6DDrGWbJSwi3QX3XngueHTrEz+hI++aQvbUd81f57RBeclLtQ0mjP+bf8ix rWUt/RF/XOS5Rw/fzOP8CysWehT05k06MXtHS5mPU5fRgkfOc3sMPRf6NJ0X1nk205hJyOjb 7FKt7Ustnqs3+cs434hruc1jv+CPJe/9DwL3fDlL94Qfeti0WImlOCPRUIu5qDgRAIyv90wg AwAA Archived-At: Subject: [Emu] Agenda Items for IETF 104 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 10:33:52 -0000 RGVhciBhbGwsDQoNClNvbWUgb2YgeW91IGhhdmUgYWxyZWFkeSBzZW50IGluIGEgcmVxdWVzdCBm b3IgcHJlc2VudGF0aW9uIHRpbWUgZHVyaW5nIA0KdGhlIEVNVSBzZXNzaW9uIEAgSUVURiAxMDQu IFRoYW5rIHlvdSENCg0KRm9yIHRob3NlIHdobyBoYXZlbid0LCBwbGVhc2Ugc2VuZCBKb2UgYW5k IEkgcmVxdWVzdHMgZm9yIHByZXNlbnRhdGlvbiANCnNsb3RzLsKgIFdlIGhhdmUgYSAyIGhvdXIg c2Vzc2lvbiBvbiBNb25kYXksIE1hcmNoIDI1LCBiZXR3ZWVuIA0KMDk6MDAtMTE6MDAgaW4gcm9v bSBCZXJsaW4vQnJ1c3NlbHMuDQoNCkRvbid0IGZvcmdldCB0byBpbmNsdWRlIHRoZSB0aXRsZSBv ZiB5b3VyIHByZXNlbnRhdGlvbiwgcmVsYXRlZCBkcmFmdHMsIA0KYW5kIHRoZSBhcHByb3hpbWF0 ZSBhbW91bnQgb2YgdGltZSB0aGF0IHlvdSBuZWVkLg0KDQpQbGVhc2UgYWxzbyBsZXQgdXMga25v dyBpZiB5b3UgcGxhbiB0byBwcmVzZW50IHJlbW90ZWx5Lg0KDQpKb2UgYW5kIE1vaGl0DQoNCg== From nobody Wed Mar 13 00:40:56 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 204E2130ECE for ; Wed, 13 Mar 2019 00:40:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=YPHZw2sQ; dkim=pass (1024-bit key) header.d=ericsson.com header.b=AEdvG1lM Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XWZfsGbnczoM for ; Wed, 13 Mar 2019 00:40:51 -0700 (PDT) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54E9C130EA3 for ; Wed, 13 Mar 2019 00:40:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1552462849; x=1555054849; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=VdW13coKofkS3n9NxF9Q0RrH7HB+Qm2LMuxHKlkvEUw=; b=YPHZw2sQzKInp1UXzt2kM8N7S/yVyCkL509S3jNp629lCIYMKxbDfb/2jQZhOfI+ RuUs2myJBMn3aTgtaljiBvDFXRlF95pOP6z1+2MX7T6aUdslM1SMjw6jrI4JaGH/ POYTf+hLZT+ccDswrdKsfZjxh77Jo4EJ7s58BLe0DRc=; X-AuditID: c1b4fb2d-2198b9e00000062f-02-5c88b401a521 Received: from ESESSMB501.ericsson.se (Unknown_Domain [153.88.183.119]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id F4.52.01583.104B88C5; Wed, 13 Mar 2019 08:40:49 +0100 (CET) Received: from ESESBMB502.ericsson.se (153.88.183.169) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Wed, 13 Mar 2019 08:40:42 +0100 Received: from EUR02-VE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB502.ericsson.se (153.88.183.169) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Wed, 13 Mar 2019 08:40:41 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VdW13coKofkS3n9NxF9Q0RrH7HB+Qm2LMuxHKlkvEUw=; b=AEdvG1lMeZS3uA5vrZZilmQ2MM1GPV6blV+BE+gEexyIaAjJ58pOWH/kn4XhcOTzHfNvnzfQFjFD71gcUuljK/FOnc8vtM2b/F6+gymkdKm6Fbp3HT2xR6T95tmeByQFVFNC/7x+uT7yRUQktNLakOymAn/DyeozizNjkQofa4c= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3419.eurprd07.prod.outlook.com (10.170.247.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.10; Wed, 13 Mar 2019 07:40:40 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8%3]) with mapi id 15.20.1709.011; Wed, 13 Mar 2019 07:40:40 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: New Version Notification for draft-ms-emu-eaptlscert-02.txt Thread-Index: AQHU1FgZDlnXEC2T60u5Pmx3auByTKYJSC6A Date: Wed, 13 Mar 2019 07:40:40 +0000 Message-ID: <0B0EBB47-5252-4794-9F8D-0E37C8F00D9C@ericsson.com> References: <155190279009.14063.13269789804046884420.idtracker@ietfa.amsl.com> In-Reply-To: <155190279009.14063.13269789804046884420.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 84b1c9da-3d7b-4793-2b20-08d6a787310f x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3419; x-ms-traffictypediagnostic: HE1PR07MB3419: x-ms-exchange-purlcount: 5 x-microsoft-antispam-prvs: x-forefront-prvs: 09752BC779 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(39860400002)(346002)(136003)(366004)(376002)(13464003)(199004)(189003)(2616005)(82746002)(229853002)(106356001)(99286004)(105586002)(2501003)(97736004)(66574012)(25786009)(256004)(14444005)(83716004)(6486002)(71190400001)(44832011)(486006)(15650500001)(3846002)(6116002)(446003)(71200400001)(476003)(53936002)(76176011)(11346002)(6306002)(6436002)(5640700003)(2473003)(6512007)(7736002)(26005)(102836004)(68736007)(8936002)(478600001)(66066001)(5660300002)(58126008)(86362001)(33656002)(316002)(8676002)(2906002)(1730700003)(81156014)(186003)(81166006)(14454004)(2351001)(6916009)(305945005)(6506007)(36756003)(966005)(53546011); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3419; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: pBzGDvy4q2haKFh0ZGYV66vJ/pAsZWI6u2L78NzbCOv/82XIQhpEtKKHJUqQU8QM15xirYKtbBEG9fkY4plRL/o/Gva1D/79yjmyuDeuTK2hUFyd5urXAtxy383aLeoJwN+m43TNAWeHNO1zlT1C6tyVmhbgK6AhWxM8J8WCDmCyDWDkN3IzCPOr3elL/yHGb/7GtWb5lxAvcOrI5NmiWt6f9qbizcJwjvOXZ6r4UzeT6vbzqKhY4EQOxY/J9ta1YoO8rKEhwSFL0s+5savx+UXPKurvjZiM3lhJqCtxlLQWoWaVY71rYBR5RtE90sDs4kuymJ7/ZcWdQy4wS9sBIwxbwRrJfILcMSFkW2H9jGURSNObctWZNDKOmn4kgxwGvH3sHz1KNt7O4uB+o09JFf8nN0Fn3vs6spQaSrcrOlE= Content-Type: text/plain; charset="utf-8" Content-ID: <15DDCDBFC1D3404CA15456E302DCA8B5@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 84b1c9da-3d7b-4793-2b20-08d6a787310f X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Mar 2019 07:40:40.3654 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3419 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpmleLIzCtJLcpLzFFi42KZGbG9XJdxS0eMQeMyKYtj69eyODB6LFny kymAMYrLJiU1J7MstUjfLoEr4+OLRraCEyIVZ+7OZWtgbBHpYuTkkBAwkeg/0cjcxcjFISRw hFHi9PZjLCAJIYFvjBIP5xlAJJYwSezdeYMdxGERmMAs8fn8NGaIqilMEn87fCGqHjBKHOrd zg6SYBMwkJi7p4ENxBYRUJT4cakNrEFYwEPi4OZdTBBxT4lpHTcYuxg5gGwjiduvtEHCLAKq EnOuLWUBCfMK2Et0vuKEWOUnsXzKDmaQMKeAv8Tx654gYUYBMYnvp9aADWQWEJe49WQ+E8Rj AhJL9pxnhrBFJV4+/scKYosK6Ets6XvAAtEbK9HaOp0VokZR4vS+FVD1shKX5nczQti+EtsP PgN7XULgJqPE7ubb7BAJLYkr9z9DFUlJ7N88D8rOlnh9aRkLhC0jcXVBNxNE83Y2iTVf/kJD N1Vi+dpWxgmMerOQHD4L6DdmAU2J9bv0IcIeEn3fvzFD2IoSU7ofsoPYvAKCEidnPmFZwMi6 ilG0OLW4ODfdyFgvtSgzubg4P08vL7VkEyMwaRzc8lt3B+Pq146HGAU4GJV4eC+s64gRYk0s K67MPcQowcGsJMK73h0oxJuSWFmVWpQfX1Sak1p8iFGag0VJnPePkGCMkEB6YklqdmpqQWoR TJaJg1OqgTF0zXQ71kZ5BfG3syRyF89aEdyurnD+R67ylQn1Sq99ZB31eZM7C0/JSj+w2Kr9 tP/j++9R2bIKvDWRi37MClgZF2769NTVI6leE6JCzhhJGp6TmcW1dWr/IilenZmh0tlpV2SU t8ofCjx3IPZz7Lz6Hfctp6b1ljZG9edNquM2vOoufNGMQYmlOCPRUIu5qDgRADSVZRAWAwAA Archived-At: Subject: [Emu] FW: New Version Notification for draft-ms-emu-eaptlscert-02.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 07:40:54 -0000 Q2hhbmdlcyBpbiB2ZXJzaW9uIC0wMiBhcmU6DQoNCi0gU2hvcnRlciBhbmQgbW9yZSBjb25jaXNl IGFic3RyYWN0DQotIEV4cGFuZGVkIGludHJvDQotIEFkZGVkIHRleHQgb24gZ3VpZGVsaW5lcyBm b3IgY2VydGlmaWNhdGVzIHByb3ZpZGVkIGJ5IFNlYW4NCi0gU29tZSByZWZvcm11bGF0aW9ucyBh bmQgY2xhcmlmaWNhdGlvbnMNCg0KQ2hlZXJzLA0KSm9obg0KDQrvu78tLS0tLU9yaWdpbmFsIE1l c3NhZ2UtLS0tLQ0KRnJvbTogImludGVybmV0LWRyYWZ0c0BpZXRmLm9yZyIgPGludGVybmV0LWRy YWZ0c0BpZXRmLm9yZz4NCkRhdGU6IFdlZG5lc2RheSwgNiBNYXJjaCAyMDE5IGF0IDIxOjA2DQpU bzogTW9oaXQgU2V0aGkgPG1vaGl0QHBpdWhhLm5ldD4sIEpvaG4gTWF0dHNzb24gPGpvaG4ubWF0 dHNzb25AZXJpY3Nzb24uY29tPiwgU2VhbiBUdXJuZXIgPHNlYW5Ac24zcmQuY29tPg0KU3ViamVj dDogTmV3IFZlcnNpb24gTm90aWZpY2F0aW9uIGZvciBkcmFmdC1tcy1lbXUtZWFwdGxzY2VydC0w Mi50eHQNCg0KDQpBIG5ldyB2ZXJzaW9uIG9mIEktRCwgZHJhZnQtbXMtZW11LWVhcHRsc2NlcnQt MDIudHh0DQpoYXMgYmVlbiBzdWNjZXNzZnVsbHkgc3VibWl0dGVkIGJ5IEpvaG4gTWF0dHNzb24g YW5kIHBvc3RlZCB0byB0aGUNCklFVEYgcmVwb3NpdG9yeS4NCg0KTmFtZToJCWRyYWZ0LW1zLWVt dS1lYXB0bHNjZXJ0DQpSZXZpc2lvbjoJMDINClRpdGxlOgkJSGFuZGxpbmcgTGFyZ2UgQ2VydGlm aWNhdGVzIGFuZCBMb25nIENlcnRpZmljYXRlIENoYWlucyBpbiBUTFMtYmFzZWQgRUFQIE1ldGhv ZHMNCkRvY3VtZW50IGRhdGU6CTIwMTktMDMtMDYNCkdyb3VwOgkJSW5kaXZpZHVhbCBTdWJtaXNz aW9uDQpQYWdlczoJCTkNClVSTDogICAgICAgICAgICBodHRwczovL3d3dy5pZXRmLm9yZy9pbnRl cm5ldC1kcmFmdHMvZHJhZnQtbXMtZW11LWVhcHRsc2NlcnQtMDIudHh0DQpTdGF0dXM6ICAgICAg ICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtbXMtZW11LWVhcHRsc2Nl cnQvDQpIdG1saXplZDogICAgICAgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LW1z LWVtdS1lYXB0bHNjZXJ0LTAyDQpIdG1saXplZDogICAgICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5p ZXRmLm9yZy9kb2MvaHRtbC9kcmFmdC1tcy1lbXUtZWFwdGxzY2VydA0KRGlmZjogICAgICAgICAg IGh0dHBzOi8vd3d3LmlldGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1tcy1lbXUtZWFwdGxzY2Vy dC0wMg0KDQpBYnN0cmFjdDoNCiAgIEVBUC1UTFMgYW5kIG90aGVyIFRMUy1iYXNlZCBFQVAgbWV0 aG9kcyBhcmUgd2lkZWx5IGRlcGxveWVkIGFuZCB1c2VkDQogICBmb3IgbmV0d29yayBhY2Nlc3Mg YXV0aGVudGljYXRpb24uICBMYXJnZSBjZXJ0aWZpY2F0ZXMgYW5kIGxvbmcNCiAgIGNlcnRpZmlj YXRlIGNoYWlucyBjb21iaW5lZCB3aXRoIGF1dGhlbnRpY2F0b3JzIHRoYXQgZHJvcCBhbiBFQVAN CiAgIHNlc3Npb24gYWZ0ZXIgb25seSA0MCAtIDUwIHBhY2tldHMgaXMgYSBtYWpvciBkZXBsb3lt ZW50IHByb2JsZW0uDQogICBUaGlzIG1lbW8gbG9va3MgYXQgdGhlIHRoaXMgcHJvYmxlbSBpbiBk ZXRhaWwgYW5kIGRlc2NyaWJlcyB0aGUNCiAgIHBvdGVudGlhbCBzb2x1dGlvbnMgYXZhaWxhYmxl Lg0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgDQoNCg0KUGxlYXNlIG5vdGUgdGhhdCBpdCBt YXkgdGFrZSBhIGNvdXBsZSBvZiBtaW51dGVzIGZyb20gdGhlIHRpbWUgb2Ygc3VibWlzc2lvbg0K dW50aWwgdGhlIGh0bWxpemVkIHZlcnNpb24gYW5kIGRpZmYgYXJlIGF2YWlsYWJsZSBhdCB0b29s cy5pZXRmLm9yZy4NCg0KVGhlIElFVEYgU2VjcmV0YXJpYXQNCg0KDQo= From nobody Wed Mar 13 00:44:46 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B375D130ECE for ; Wed, 13 Mar 2019 00:44:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=H/5U3TY3; dkim=pass (1024-bit key) header.d=ericsson.com header.b=ft2jpeEQ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bcj9oBu1xw7W for ; Wed, 13 Mar 2019 00:44:41 -0700 (PDT) Received: from sesbmg23.ericsson.net (sesbmg23.ericsson.net [193.180.251.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BACD6130EC7 for ; Wed, 13 Mar 2019 00:44:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1552463078; x=1555055078; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=qL0q/t93Esb0akz8KTGeMsq7ztVk6uYbsUVfA9fNrHs=; b=H/5U3TY3Ge+taIm9rxIL33RpeKY/nZUWEOPP7Vpe91csIQGaqoGu2ior+X92/XrW JMRriOGsbc8x98HxQWT3EZP9IJjnQb8L1rNQ0lycaHDtLG9J1vWJT/IxsRrazfSw GFBu6Ba5GMCa5OtioiXgS16R/Bd1cVqJyPsDLaDFx2c=; X-AuditID: c1b4fb25-209009e000005ff7-b8-5c88b4e611cc Received: from ESESBMB504.ericsson.se (Unknown_Domain [153.88.183.117]) by sesbmg23.ericsson.net (Symantec Mail Security) with SMTP id 61.9C.24567.6E4B88C5; Wed, 13 Mar 2019 08:44:38 +0100 (CET) Received: from ESESBMB503.ericsson.se (153.88.183.170) by ESESBMB504.ericsson.se (153.88.183.171) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Wed, 13 Mar 2019 08:44:33 +0100 Received: from EUR04-DB3-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB503.ericsson.se (153.88.183.170) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Wed, 13 Mar 2019 08:44:33 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qL0q/t93Esb0akz8KTGeMsq7ztVk6uYbsUVfA9fNrHs=; b=ft2jpeEQVHfLEnQ6G6bkRJJqU9bjBgYTppXhyw2sG8WIYI4XCIj1lbaLVMaS76fgKhYKi3eijpfWtdDyu0ZqsT9IwNZDxn5Z+ik7zmpLrj9oiNKrwpl31QOaqHA8ugtVg/CxSDAknnNZsGX4JvaI0JAI90SKxt+wCGH6NhAZQdA= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB4155.eurprd07.prod.outlook.com (20.176.166.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.8; Wed, 13 Mar 2019 07:44:26 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8%3]) with mapi id 15.20.1709.011; Wed, 13 Mar 2019 07:44:26 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: New Version Notification for draft-ietf-emu-eap-tls13-04.txt Thread-Index: AQHU2E5UAXyemMK4e0yrFcc9qZQHw6YJQU+A Date: Wed, 13 Mar 2019 07:44:26 +0000 Message-ID: <036B50CB-0D65-4545-ACC7-13C35A5F0A16@ericsson.com> References: <155233838134.23074.12874732238078025038.idtracker@ietfa.amsl.com> In-Reply-To: <155233838134.23074.12874732238078025038.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 8c9ed7ee-59fc-46a6-6e1b-08d6a787b7b9 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB4155; x-ms-traffictypediagnostic: HE1PR07MB4155: x-ms-exchange-purlcount: 5 x-microsoft-antispam-prvs: x-forefront-prvs: 09752BC779 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(346002)(366004)(39860400002)(136003)(396003)(13464003)(199004)(189003)(25786009)(6436002)(6506007)(36756003)(229853002)(76176011)(14444005)(97736004)(82746002)(53546011)(5660300002)(15650500001)(83716004)(3846002)(66574012)(58126008)(2906002)(6116002)(66066001)(71190400001)(71200400001)(86362001)(316002)(33656002)(966005)(6512007)(2473003)(478600001)(6306002)(68736007)(6486002)(8676002)(106356001)(2351001)(186003)(26005)(305945005)(102836004)(81156014)(7736002)(81166006)(256004)(105586002)(1730700003)(44832011)(14454004)(486006)(2616005)(11346002)(446003)(99286004)(476003)(8936002)(53936002)(6916009)(5640700003)(2501003); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB4155; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: OlKu2HZKvLhuspJkua6HhhZD0jvI5pwYLpqdYhSym3c3tG7bXiFe+B3HxsGBE1LthH3a5gJuQE0nuVKXDcOw5fHm/D05dxmCbk8+7OXYpnCo6yfciVHp68YNvGCx9ewkul9MT6yhphJRuzWYNbohouVBGhCADoc5vvZzLFgBTVTkkW/o/T08Vzedt+y0dNAVUbd0dvW0ilZT59fNe65S97tRVNwqzFMYMWQdMlldISzqENOWFNi/t4D3tzlcGAEXO1QZIAkljcuZ3MwCcDViX0ZvhzzAoQbycW3FgPc+Os2P+2ITdPLjJaCMTk8SE+W0ntOD5zkBVWgqR2gtTKae46KybsypJQwW7zVQAeDvK8OL9pBrZpDyZjx/ba/M8/rI0PgMAXR1p15K9hnG9wvxVX2lGTNmyzY4I/bWC0M0ZjA= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 8c9ed7ee-59fc-46a6-6e1b-08d6a787b7b9 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Mar 2019 07:44:26.2829 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB4155 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmphleLIzCtJLcpLzFFi42KZGbG9VPfZlo4Yg+ZjBhbH1q9lcWD0WLLk J1MAYxSXTUpqTmZZapG+XQJXxq5zr1kKzslWLD3zlrmB8Y1MFyMnh4SAicT8793MXYxcHEIC Rxgl+h8dZIRwvjFKbNnwjwnCWcIksWbqPnYQh0VgArPEzmWHmUD6hQQmMUms3ZYPUfWAUeLg 43fsIAk2AQOJuXsa2EBsEQFFiR+X2phBbGEBT4m2tcfYIeJeEhtX/4eyjSRuvjkHNpRFQFXi 0JZdjCA2r4C9xLtzW1kglvlJHPp4mRXE5hTwl7jWvwCshlFATOL7qTVgvcwC4hK3nsxngnhO QGLJnvPMELaoxMvH/8B6RQX0Jbb0PWCB6I2VaG2dzgpRoyhxet8KqHpZiUvzuxkhbF+Jl91v 2SDsm4wSN5/XdzFyANlaEpPnpECEpST2b54HVZ4tceXDZ3YIW0bi6oJucChKCGxnk+h5/4sN 4pdUieVrWxknMOrNQnL2LKCxzAKaEut36UOYHhJHP6pCVChKTOl+yD4LHCiCEidnPmFZwMi6 ilG0OLU4KTfdyFgvtSgzubg4P08vL7VkEyMwbRzc8lt1B+PlN46HGAU4GJV4eHvXdcQIsSaW FVfmHmKU4GBWEuFd7w4U4k1JrKxKLcqPLyrNSS0+xCjNwaIkzvtHSDBGSCA9sSQ1OzW1ILUI JsvEwSnVwDixnCFSvcmbJ0k0XeVkjkuz5cocdZuSKfulD1r0bl9/xW5FUeGq6uivt5/0V7h8 W85jfIPxBa/HavV3om7lLZu9ZoT+MJZtaasyf/lJolpiVnv31ZsZXqvn2LhKPfZvMfGSXv/m n+X7jM5vx1L+Wxis37jj5ILI+C3aBl9uHa1Z/CI/WjWZTYmlOCPRUIu5qDgRAPp7s/4XAwAA Archived-At: Subject: [Emu] FW: New Version Notification for draft-ietf-emu-eap-tls13-04.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 07:44:44 -0000 Q2hhbmdlcyBpbiB2ZXJzaW9uIC0wNCBhcmU6DQoNCi0gQm9ycm93IHRoZSB0ZXJtIHByaXZhY3kt ZnJpZW5kbHkgaWRlbnRpdGllcyBmcm9tIFJGQzU0NDhiaXMuIFVwZGF0ZWQgdGhlIGZpZ3VyZXMg dG8gdXNlIHRoaXMgdGVybSBhcyB3ZWxsLg0KLSBBZGRlZCBmaWd1cmUgZGVzY3JpYmluZyB0aGUg Y2FzZSBvZiBFQVAtVExTIHdpdGhvdXQgcGVlciBhdXRoZW50aWNhdGlvbiAobGlrZSBlLmcuIGVt ZXJnZW5jeSBzZXJ2aWNlcykNCi0gQWRkZWQgdGhlIHRleHQgIlVuZnJhZ21lbnRlZCBtZXNzYWdl cyBNQVkgaGF2ZSB0aGUgTCBiaXQgc2V0Li4uIiBmcm9tIEVBUC1UVExTIGFzIHN1Z2dlc3RlZCBi eSBPbGVnDQotIEFkZGVkIHRoYXQgIlVuYXV0aGVudGljYXRlZCBpbmZvcm1hdGlvbiBTSEFMTCBO T1QgYmUgdXNlZCBmb3IgYWNjb3VudGluZyBwdXJwb3NlcyBvciB0byBnaXZlIGF1dGhvcml6YXRp b24uIg0KLSBBZGRlZCBUeXBlLUNvZGUgdG8ga2V5IGRlcml2YXRpb24gYXMgc3VnZ2VzdGVkIGJ5 IEFsYW4NCi0gRGVzY3JpYmVkIGhvdyB0byBkZXJpdmUgTVNLLCBFTVNLIGV0Yy4gKG5vIGNoYW5n ZSBmcm9tIDUyMTYpIGFzIHN1Z2dlc3RlZCBieSBBbGFuDQotIEFkZGVkIG5vdGVzIG9uIGxlbmd0 aCBwYXJhbWV0ZXIgYW5kIG90aGVyIFRMUyBiYXNlZCBFQVAgbWV0aG9kcyBhcyBzdWdnZXN0ZWQg YnkgQWxhbg0KLSBSZW1vdmVkIDUyMTYgcmVxdWlyZW1lbnQgdGhhdCBuZWdvdGlhdGVkIGNpcGhl ciBzdWl0ZSBjYW5ub3QgYmUgdXNlZCB0byBwcm90ZWN0IGRhdGENCi0gT0NTUCBzdGFwbGluZyBN VVNUIGJlIHN1cHBvcnRlZCBhbmQgTVVTVCBiZSB1c2VkLg0KLSBBZGRlZCBBdXRob3JpemF0aW9u IGFuZCBSZXZvY2F0aW9uIGNvbnNpZGVyYXRpb24gYXMgc3VnZ2VzdGVkIGJ5IEFsYW4uIEJhc2Vk IG9uIHRleHQgZnJvbSBBbGFuLg0KLSBFeHBhbmRlZCBwcml2YWN5IGNvbnNpZGVyYXRpb25zLg0K LSBBZGRlZCBzaG9ydCBzZWN0aW9uIG9uIGRpc2NvdmVyZWQgdnVsbmVyYWJpbGl0aWVzIGluIG9s ZCB2ZXJzaW9ucyBvZiBUTFMNCi0gU29tZSByZWZvcm11bGF0aW9ucyBhbmQgY2xhcmlmaWNhdGlv bnMNCg0KQ2hlZXJzLA0KSm9obg0KDQrvu78tLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJv bTogImludGVybmV0LWRyYWZ0c0BpZXRmLm9yZyIgPGludGVybmV0LWRyYWZ0c0BpZXRmLm9yZz4N CkRhdGU6IE1vbmRheSwgMTEgTWFyY2ggMjAxOSBhdCAyMjowNg0KVG86IE1vaGl0IFNldGhpIDxt b2hpdEBwaXVoYS5uZXQ+LCBKb2huIE1hdHRzc29uIDxqb2huLm1hdHRzc29uQGVyaWNzc29uLmNv bT4NClN1YmplY3Q6IE5ldyBWZXJzaW9uIE5vdGlmaWNhdGlvbiBmb3IgZHJhZnQtaWV0Zi1lbXUt ZWFwLXRsczEzLTA0LnR4dA0KDQoNCkEgbmV3IHZlcnNpb24gb2YgSS1ELCBkcmFmdC1pZXRmLWVt dS1lYXAtdGxzMTMtMDQudHh0DQpoYXMgYmVlbiBzdWNjZXNzZnVsbHkgc3VibWl0dGVkIGJ5IEpv aG4gTWF0dHNzb24gYW5kIHBvc3RlZCB0byB0aGUNCklFVEYgcmVwb3NpdG9yeS4NCg0KTmFtZToJ CWRyYWZ0LWlldGYtZW11LWVhcC10bHMxMw0KUmV2aXNpb246CTA0DQpUaXRsZToJCVVzaW5nIEVB UC1UTFMgd2l0aCBUTFMgMS4zDQpEb2N1bWVudCBkYXRlOgkyMDE5LTAzLTExDQpHcm91cDoJCWVt dQ0KUGFnZXM6CQkyOA0KVVJMOiAgICAgICAgICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL2ludGVy bmV0LWRyYWZ0cy9kcmFmdC1pZXRmLWVtdS1lYXAtdGxzMTMtMDQudHh0DQpTdGF0dXM6ICAgICAg ICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1lbXUtZWFwLXRs czEzLw0KSHRtbGl6ZWQ6ICAgICAgIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1p ZXRmLWVtdS1lYXAtdGxzMTMtMDQNCkh0bWxpemVkOiAgICAgICBodHRwczovL2RhdGF0cmFja2Vy LmlldGYub3JnL2RvYy9odG1sL2RyYWZ0LWlldGYtZW11LWVhcC10bHMxMw0KRGlmZjogICAgICAg ICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1pZXRmLWVtdS1lYXAt dGxzMTMtMDQNCg0KQWJzdHJhY3Q6DQogICBUaGlzIGRvY3VtZW50IHNwZWNpZmllcyB0aGUgdXNl IG9mIEVBUC1UTFMgd2l0aCBUTFMgMS4zIHdoaWxlDQogICByZW1haW5pbmcgYmFja3dhcmRzIGNv bXBhdGlibGUgd2l0aCBleGlzdGluZyBpbXBsZW1lbnRhdGlvbnMgb2YgRUFQLQ0KICAgVExTLiAg VExTIDEuMyBwcm92aWRlcyBzaWduaWZpY2FudGx5IGltcHJvdmVkIHNlY3VyaXR5LCBwcml2YWN5 LCBhbmQNCiAgIHJlZHVjZWQgbGF0ZW5jeSB3aGVuIGNvbXBhcmVkIHRvIGVhcmxpZXIgdmVyc2lv bnMgb2YgVExTLiAgRUFQLVRMUw0KICAgd2l0aCBUTFMgMS4zIGZ1cnRoZXIgaW1wcm92ZXMgc2Vj dXJpdHkgYW5kIHByaXZhY3kgYnkgbWFuZGF0aW5nIHVzZQ0KICAgb2YgcHJpdmFjeSBhbmQgcmV2 b2NhdGlvbiBjaGVja2luZy4gIFRoaXMgZG9jdW1lbnQgdXBkYXRlcyBSRkMgNTIxNi4NCg0KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIA0KDQoNClBsZWFzZSBub3RlIHRoYXQgaXQgbWF5IHRha2Ug YSBjb3VwbGUgb2YgbWludXRlcyBmcm9tIHRoZSB0aW1lIG9mIHN1Ym1pc3Npb24NCnVudGlsIHRo ZSBodG1saXplZCB2ZXJzaW9uIGFuZCBkaWZmIGFyZSBhdmFpbGFibGUgYXQgdG9vbHMuaWV0Zi5v cmcuDQoNClRoZSBJRVRGIFNlY3JldGFyaWF0DQoNCg0K From thiennguyen.ietf@gmail.com Wed Mar 13 07:09:46 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 59FBF12D7EA for ; Wed, 13 Mar 2019 07:09:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.098 X-Spam-Level: X-Spam-Status: No, score=-0.098 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K7sqE6bbRm88 for ; Wed, 13 Mar 2019 07:09:44 -0700 (PDT) Received: from mail-it1-x144.google.com (mail-it1-x144.google.com [IPv6:2607:f8b0:4864:20::144]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8EDAD126C15 for ; Wed, 13 Mar 2019 07:09:44 -0700 (PDT) Received: by mail-it1-x144.google.com with SMTP id l139so3052580ita.5 for ; Wed, 13 Mar 2019 07:09:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=9VNx1PVySqBuFEPebMfcVbW01nFmTqXjacAsjW5y6ZA=; b=RXLykQeP/VrUDjWH9VcCw1F1pv3PiFD/KA0dHsvU/jXXUs4CH5oCF/hNaJNMUAThcr C+7EeBB7vh11QVejztpyxLeip4Oi+d/MTgEbD7aC7MSBv1/OX3sCjL2cjh6SYbDjhNiQ pLLtjagyCDvp/Z332uPujWUBNh2I+NAlCdzed3sF8E4zfkqb4bLsHTZKzocEoGo4u7nH xEUydMH3uDxQDTN/uF54KBWrmkxcue8vo2j4x+abIqsJX2a4GI38eV5KHSV0f+xkU5QW ucSOHaSj67odqDFD3SprL5j+Iygo4qfNrnJy53TQiYEq95cm/PoFWQtt9rfUwdinG+PI 2lfw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=9VNx1PVySqBuFEPebMfcVbW01nFmTqXjacAsjW5y6ZA=; b=hUCr7fZfyExrQu74dxJNE+F/DWSSERh/uNr8djy40744ujzbNtR2NzOiLsjrS1rx+8 PRuSv/vaMImdQrILwJNhLebIEu57KtAHfdTWFMuttZmHdqsYVQ472OfgeLT6vppiEXWr vczklaP9mgjYGrPRMocZvL1Jr+8xq2UEFqPgYEIMv5RekoGpJex1hzZMHpFIA3wfFyFt fPtv56NWmh4Oy56QyOriGbJjXypv6dpIv84tvMpw7ECMVa9c8ft/nVDQEpX8jQGUkka+ sU/1mWdamAr4agH5xwCNVkzIAR3rhm/86VyXQIbgXy7vPQmbZC8ygjRS0+fOp+mf50aR we1w== X-Gm-Message-State: APjAAAUV7LOPuAbJB7Il2CB6d/BLhLLqqF36xAXkEWq5DwyiCh4aH0M6 qHq9BKmEyMPx6qwRVvI4ZFE5fZQL+dcYu6L9ehdrGWzb5HU= X-Google-Smtp-Source: APXvYqyyIZC/WjlpH1KbJOZw/FAX48VP1y1p2QkdzE370iiUcnDm5c125+IXxJu898dnNExgYw1n/DsH/BGhNYRAp5g= X-Received: by 2002:a24:6581:: with SMTP id u123mr2003526itb.42.1552486183597; Wed, 13 Mar 2019 07:09:43 -0700 (PDT) MIME-Version: 1.0 From: Thien Nguyen Date: Wed, 13 Mar 2019 15:09:32 +0100 Message-ID: To: emu@ietf.org, tuomas.aura@aalto.fi, mohit@piuha.net, aleksi.peltonen@aalto.fi Content-Type: multipart/alternative; boundary="0000000000007dfeb10583fa5be3" Archived-At: Subject: [Emu] Run EAP-NOOB implementation X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 14:19:24 -0000 --0000000000007dfeb10583fa5be3 Content-Type: text/plain; charset="UTF-8" Hello all, I'm considering enrolling in the Hackathon with EAP-NOOB so I've been trying to run the implementation that you have posted at https://github.com/tuomaura/eap-noob but I have not succeeded. I have followed the steps indicated in the README and the EAP communication always ends in Failure. The identity noob@eap-noob.net is sent and the EAP-Request message is returned with the empty Identity field. Is there any additional information or any configuration that I need to know in order to execute the scenario? Or could you provide sample information that needs to be added to the configuration files for execution? I would also like more information on how the client is simulated. Does the wpa_auto_run.py script do it? Should I run some other program to complete the authentication process or how can I get the OOB code? I apologize if this is not the right place to send this email. Thank you very much for your attention. Greetings, Thien Nguyen. --0000000000007dfeb10583fa5be3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello all,

I'm considering enrolling in th= e Hackathon with EAP-NOOB so I've been trying to run the implementation= that you have posted at h= ttps://github.com/tuomaura/eap-noob but I have not succeeded.

I = have followed the steps indicated in the README and the EAP communication a= lways ends in Failure. The identity no= ob@eap-noob.net is sent and the EAP-Request message is returned with th= e empty Identity field.

Is there any additional information or any c= onfiguration that I need to know in order to execute the scenario? Or could= you provide sample information that needs to be added to the configuration= files for execution?

I would also like more information on how the = client is simulated. Does the wpa_auto_run.py script do it? Should I run so= me other program to complete the authentication process or how can I get th= e OOB code?

I apologize if this is not the right place to send this = email.

Thank you very much for your attention.
Greetings,
Thien Ngu= yen.
--0000000000007dfeb10583fa5be3-- From nobody Thu Mar 14 00:08:29 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 89CCC1277DB for ; Thu, 14 Mar 2019 00:08:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=E8d1V0R0; dkim=pass (1024-bit key) header.d=ericsson.com header.b=NNAMWlhV Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fOxoPygFiH32 for ; Thu, 14 Mar 2019 00:08:25 -0700 (PDT) Received: from sesbmg23.ericsson.net (sesbmg23.ericsson.net [193.180.251.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E773E1200D7 for ; Thu, 14 Mar 2019 00:08:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1552547302; x=1555139302; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=w4T3VPy/EsM0DQkFVclA9wgB9g9LGfAblm8RTJ/lQNk=; b=E8d1V0R09xFiO7NzdbRFYU6HAjYvNcLTdTEwwSeW3G2+cw/VMFO8WffxHr0TW9L8 vnMTOWs16IzfSLu3ud5Q/B+PgY6eKO23wj/vDJtojV/kNUfu+u5muc7iqL/pyxM1 aeD/KxWvQg4gpDEB1Uzmcg6woCjtvnkMA8gpEcBM0Xw=; X-AuditID: c1b4fb25-209009e000005ff7-b1-5c89fde695de Received: from ESESBMB504.ericsson.se (Unknown_Domain [153.88.183.117]) by sesbmg23.ericsson.net (Symantec Mail Security) with SMTP id CA.C9.24567.6EDF98C5; Thu, 14 Mar 2019 08:08:22 +0100 (CET) Received: from ESESSMB503.ericsson.se (153.88.183.164) by ESESBMB504.ericsson.se (153.88.183.171) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Thu, 14 Mar 2019 08:08:21 +0100 Received: from EUR02-VE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB503.ericsson.se (153.88.183.164) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Thu, 14 Mar 2019 08:08:21 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=w4T3VPy/EsM0DQkFVclA9wgB9g9LGfAblm8RTJ/lQNk=; b=NNAMWlhVujy3ZFDRSrip3/8FIwc/xRVQxS7lZoSud6aj5rpeA2NfL1G2OrK7IO6boQ918ws39uwgKrerfiGsdFmtX0+SDWiKlnjby9w6kkq4i1dnb+9JOrjxLhouRoHDoAuRqHurGm9k4XxZuVgLtXVTr88+dg2nGk8iHcStbVg= Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com (10.168.98.146) by HE1PR0701MB2154.eurprd07.prod.outlook.com (10.168.34.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1730.4; Thu, 14 Mar 2019 07:08:20 +0000 Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::6877:aa58:3e6:6a4b]) by HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::6877:aa58:3e6:6a4b%5]) with mapi id 15.20.1709.011; Thu, 14 Mar 2019 07:08:20 +0000 From: Mohit Sethi M To: "emu@ietf.org" Thread-Topic: [Emu] WGLC for RFC5448bis Thread-Index: AQHU2jSyjtr7R6Hm60q7rbQD8qvvFg== Date: Thu, 14 Mar 2019 07:08:20 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 x-originating-ip: [89.166.49.243] x-clientproxiedby: HE1PR05CA0238.eurprd05.prod.outlook.com (2603:10a6:3:fb::14) To HE1PR0701MB2905.eurprd07.prod.outlook.com (2603:10a6:3:57::18) authentication-results: spf=none (sender IP is ) smtp.mailfrom=mohit.m.sethi@ericsson.com; x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: cbac687f-2e32-4828-1922-08d6a84bd706 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:HE1PR0701MB2154; x-ms-traffictypediagnostic: HE1PR0701MB2154: x-ms-exchange-purlcount: 4 x-microsoft-antispam-prvs: x-forefront-prvs: 09760A0505 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(396003)(39860400002)(376002)(366004)(346002)(189003)(199004)(31686004)(58126008)(65806001)(14454004)(65956001)(316002)(66066001)(64126003)(1730700003)(68736007)(81156014)(81166006)(8676002)(8936002)(2906002)(229853002)(2351001)(6436002)(65826007)(6486002)(6916009)(606006)(486006)(5660300002)(106356001)(105586002)(7736002)(4744005)(2501003)(36756003)(11346002)(2616005)(6306002)(31696002)(54896002)(6512007)(6246003)(53936002)(476003)(236005)(256004)(14444005)(5640700003)(3846002)(6116002)(6506007)(478600001)(386003)(71190400001)(71200400001)(53546011)(102836004)(97736004)(52116002)(966005)(76176011)(99286004)(186003)(25786009)(86362001)(446003)(26005); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2154; H:HE1PR0701MB2905.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: aL+Y7pDfo2Dv/7nH8n2HBK9ODkf22wYEeR6ATYI9gosRt37rpXr/lY5hZzgonMUrMRkjwQgYHvpITTwZCnH5ST1LgW/fsER6ALkPR0uEgC8RFIbgCzW7MoGQ04QYHaztq12eYRFrLBqJKlfElu7cQQkq/YKs0wR/Y8bx6g6XNnPSZAOh7wZPy5oKgBMWi2qJsrG1qwDi8nYv/K0uyosRT2VoHl4lruFsuLr3tqH3d4ZF2LUzZIQ2nGhcts50eqxQZuAmoL7bWSTaE9dSSO9V3h4X51mgLfjaZPOHkMml4P3sXSuz38TFPZtDsQ3/5Se6cqNmXZ6jLNqQIjLNF96F2EMTJtrzKz2sv/vjbYJXI6Ly0u15xXEHwQkbrA39STmbRkl+nKLtnPeYssjnJzod1LN4VOTOLSYMLVoMv3VRgmE= Content-Type: multipart/alternative; boundary="_000_e0ac87cbd074a25cf1c3cbffc4659072ericssoncom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: cbac687f-2e32-4828-1922-08d6a84bd706 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Mar 2019 07:08:20.7302 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2154 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA02Sa0iTURzGOe/eba+j1XF5+WMX2gtWRk5LP1hEF4qSIFDLENNq6YtKc45t WlYfFmExDbwmOas1nWWhDtOwlhaJZSqz0si8zPCSMRDtIl7SMrczwW+/5znPeTgPHIYnecT3 Y1KUWk6tlCtYgYguiWlIDxz7q48LNnXsDntrqab3o3CzeY6KQLGiPYmcIiWDUwftPStKtn9W qBrZixOmaaEO1UmzkQcDOBQaivWCbCRiJLgFgWOwBxExjWDM/psmwkyBbWSB7xQ0zuPB7K8e 951iClo7KykiRhG80LchZ7MAB0NhUaXQyV5YCrNd13lOXos3w1xJhYD4W8DwrZYiLANj/rjL p7E//Ol7w3eyGO+DydoHrh4JjoAyw5Qr44EjIb/pp8tH2Adm2qtcPTzsC32jRoqsw2BufM8j 7A2OkX+uTm8cA58sr4TEl4JtYsg1APAtBNZSCyKl8fBjMdddtB1sPaOI8AboMua4+RjU3/go INy/tF4XtpxvLWhx+34w8aWGJpwG2TcNfMLr4erQPV4ekhlWvJtwApQXPuQbXPs9oa1klDYg ZskPAIs1iESkUJQzJCS8FbLu3BWSSDg02dUrI/cR8xh5azjNudSknSEyTp2SoNGkKWVKTvsE LX2g1/Xz/s9Q9/iBZoQZxK4Stzv0cRK+PEOTmdqMgOGxXuJo2ZIlTpRnXuLUaWfU6QpO04zW MTTrK16QeMZJcJJcy53nOBWnXj6lGA8/HfKgZno3TpUeinxXFqS/JohUDRTsml2NsxIW03Pi lY6nDp+DrJwxB7y03bbYtf2L/XYTaxz4fkXn1x4yXI2rLnfMK0/lqo60XsgLnNd6nlTJen0U 1daAxvLjVq/oxKM13V8NI6GqWkxFTX7QbToRqzJFHa4wD3fWFa05/XxQxNKaZPmObTy1Rv4f 5pMBNzwDAAA= Archived-At: Subject: Re: [Emu] WGLC for RFC5448bis X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 07:08:28 -0000 --_000_e0ac87cbd074a25cf1c3cbffc4659072ericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgSmFyaSBhbmQgY28tYXV0aG9ycywNCg0KVGhlIFdHTEMgZm9yIHRoaXMgZG9jdW1lbnQgaXMg bm93IGNvbXBsZXRlLiBDYW4geW91IHBsZWFzZSBhZGRyZXNzIHRoZSBtaW5vciBjb21tZW50cyBw cm92aWRlZCBieSBKb2huIGFuZCB1cGxvYWQgYSBuZXcgdmVyc2lvbi4NCg0KVGhlIGZvbGxvd2lu ZyAyIHBhcGVycyBvbiB0aGUgQUtBIHByb3RvY29sIHdlcmUgYWxzbyBicm91Z2h0IHRvIG91ciBh dHRlbnRpb246DQoxLiBodHRwczovL2VwcmludC5pYWNyLm9yZy8yMDE4LzExNzUucGRmDQoyLiBo dHRwOi8vaG9tZXBhZ2UuZGl2bXMudWlvd2EuZWR1L35jb21hcmhhaWRlci9wdWJsaWNhdGlvbnMv TFRFLXRvcnBlZG8tTkRTUzE5LnBkZg0KDQpJdCBtaWdodCBtYWtlIHNlbnNlIHRvIG1lbnRpb24g dGhlbSBpbiB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgc2VjdGlvbiB3aXRoIHRleHQgZXhw bGFpbmluZyBob3cgdGhleSBhZmZlY3QgQUtBLCBhbmQgd2hldGhlciBhbnkgdXBkYXRlcyB0byBh ZGRyZXNzIHRoZW0gd291bGQgYWxzbyByZXF1aXJlIGNoYW5nZXMgdG8gRUFQLUFLQSc/DQoNCkpv ZSBhbmQgTW9oaXQNCg0KT24gMi8xNC8xOSAzOjU4IEFNLCBKb3NlcGggU2Fsb3dleSB3cm90ZToN ClRoaXMgaXMgdGhlIHdvcmtpbmcgZ3JvdXAgbGFzdCBjYWxsIGZvciBkcmFmdC1pZXRmLWVtdS1y ZmM1NDQ4YmlzLTA0PGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLWVtdS1y ZmM1NDQ4YmlzLTA0Pi4gIFBsZWFzZSBzZW5kIHlvdXIgY29tbWVudHMgdG8gdGhlIGxpc3QgYnkg My8xLzIwMTkuDQoNClRoYW5rcywNCg0KSm9lIGFuZCBNb2hpdA0KDQoNCg0KX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCkVtdSBtYWlsaW5nIGxpc3QNCkVt dUBpZXRmLm9yZzxtYWlsdG86RW11QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby9lbXUNCg0K --_000_e0ac87cbd074a25cf1c3cbffc4659072ericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <7E4916FAF2CFA14F8E47F7801D1AA28F@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IHRleHQ9IiMwMDAwMDAi IGJnY29sb3I9IiNGRkZGRkYiPg0KPHA+SGkgSmFyaSBhbmQgY28tYXV0aG9ycyw8YnI+DQo8YnI+ DQpUaGUgV0dMQyBmb3IgdGhpcyBkb2N1bWVudCBpcyBub3cgY29tcGxldGUuIENhbiB5b3UgcGxl YXNlIGFkZHJlc3MgdGhlIG1pbm9yIGNvbW1lbnRzIHByb3ZpZGVkIGJ5IEpvaG4gYW5kIHVwbG9h ZCBhIG5ldyB2ZXJzaW9uLjxicj4NCjxicj4NClRoZSBmb2xsb3dpbmcgMiBwYXBlcnMgb24gdGhl IEFLQSBwcm90b2NvbCB3ZXJlIGFsc28gYnJvdWdodCB0byBvdXIgYXR0ZW50aW9uOjxicj4NCjEu IDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgaHJlZj0iaHR0cHM6Ly9lcHJpbnQuaWFjci5vcmcv MjAxOC8xMTc1LnBkZiI+aHR0cHM6Ly9lcHJpbnQuaWFjci5vcmcvMjAxOC8xMTc1LnBkZjwvYT48 YnI+DQoyLiA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiIGhyZWY9Imh0dHA6Ly9ob21lcGFnZS5k aXZtcy51aW93YS5lZHUvfmNvbWFyaGFpZGVyL3B1YmxpY2F0aW9ucy9MVEUtdG9ycGVkby1ORFNT MTkucGRmIj4NCmh0dHA6Ly9ob21lcGFnZS5kaXZtcy51aW93YS5lZHUvfmNvbWFyaGFpZGVyL3B1 YmxpY2F0aW9ucy9MVEUtdG9ycGVkby1ORFNTMTkucGRmPC9hPjxicj4NCjxicj4NCkl0IG1pZ2h0 IG1ha2Ugc2Vuc2UgdG8gbWVudGlvbiB0aGVtIGluIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9u cyBzZWN0aW9uIHdpdGggdGV4dCBleHBsYWluaW5nIGhvdyB0aGV5IGFmZmVjdCBBS0EsIGFuZCB3 aGV0aGVyIGFueSB1cGRhdGVzIHRvIGFkZHJlc3MgdGhlbSB3b3VsZCBhbHNvIHJlcXVpcmUgY2hh bmdlcyB0byBFQVAtQUtBJz88YnI+DQo8YnI+DQpKb2UgYW5kIE1vaGl0PGJyPg0KPC9wPg0KPGRp diBjbGFzcz0ibW96LWNpdGUtcHJlZml4Ij5PbiAyLzE0LzE5IDM6NTggQU0sIEpvc2VwaCBTYWxv d2V5IHdyb3RlOjxicj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlk OkNBT2dQR29DUU5qT3RSNlFrVjFFY2JBeEhTY0ZkMWp1Y3RvekxxeTl2eE43YldaWUpXZ0BtYWls LmdtYWlsLmNvbSI+DQo8ZGl2IGRpcj0ibHRyIj4NCjxkaXY+VGhpcyBpcyB0aGUgd29ya2luZyBn cm91cCBsYXN0IGNhbGwgZm9yJm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9o dG1sL2RyYWZ0LWlldGYtZW11LXJmYzU0NDhiaXMtMDQiIHRhcmdldD0iX2JsYW5rIiBtb3otZG8t bm90LXNlbmQ9InRydWUiPmRyYWZ0LWlldGYtZW11LXJmYzU0NDhiaXMtMDQ8L2E+LiZuYnNwOyZu YnNwO1BsZWFzZSBzZW5kIHlvdXIgY29tbWVudHMgdG8gdGhlIGxpc3QgYnkgMy8xLzIwMTkuJm5i c3A7PC9kaXY+DQo8ZGl2Pjxicj4NCjwvZGl2Pg0KPGRpdj5UaGFua3MsPC9kaXY+DQo8ZGl2Pjxi cj4NCjwvZGl2Pg0KPGRpdj5Kb2UgYW5kIE1vaGl0PC9kaXY+DQo8L2Rpdj4NCjxicj4NCjxmaWVs ZHNldCBjbGFzcz0ibWltZUF0dGFjaG1lbnRIZWFkZXIiPjwvZmllbGRzZXQ+DQo8cHJlIGNsYXNz PSJtb3otcXVvdGUtcHJlIiB3cmFwPSIiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fDQpFbXUgbWFpbGluZyBsaXN0DQo8YSBjbGFzcz0ibW96LXR4dC1saW5r LWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86RW11QGlldGYub3JnIj5FbXVAaWV0Zi5vcmc8L2E+ DQo8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJodHRwczovL3d3dy5pZXRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL2VtdSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby9lbXU8L2E+DQo8L3ByZT4NCjwvYmxvY2txdW90ZT4NCjwvYm9keT4NCjwvaHRtbD4N Cg== --_000_e0ac87cbd074a25cf1c3cbffc4659072ericssoncom_-- From nobody Thu Mar 14 06:46:08 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C56B130E2B for ; Thu, 14 Mar 2019 06:46:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OT6DJhg2-KLu for ; Thu, 14 Mar 2019 06:46:03 -0700 (PDT) Received: from smtp-out-01.aalto.fi (smtp-out-01.aalto.fi [130.233.228.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EAA7912F19D for ; Thu, 14 Mar 2019 06:46:02 -0700 (PDT) Received: from smtp-out-01.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 7178011542B_C8A59E7B; Thu, 14 Mar 2019 13:40:55 +0000 (GMT) Received: from exng4.org.aalto.fi (exng4.org.aalto.fi [130.233.223.23]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng4.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-01.aalto.fi (Sophos Email Appliance) with ESMTPS id 233531153DA_C8A59E7F; Thu, 14 Mar 2019 13:40:55 +0000 (GMT) Received: from [130.233.193.86] (130.233.0.5) by exng4.org.aalto.fi (130.233.223.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Thu, 14 Mar 2019 15:45:57 +0200 To: Thien Nguyen , , References: CC: , From: Aleksi Peltonen Message-ID: <879edf73-8fab-7212-e533-254b5749a4a7@aalto.fi> Date: Thu, 14 Mar 2019 15:45:52 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------111FAD3D72214EDE5E855C85" Content-Language: en-US X-Originating-IP: [130.233.0.5] X-ClientProxiedBy: exng7.org.aalto.fi (130.233.223.26) To exng4.org.aalto.fi (130.233.223.23) X-SASI-RCODE: 200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=subject:to:references:cc:from:message-id:date:mime-version:in-reply-to:content-type; s=its18; bh=7BQ6F9ZGCcX1WrmqL08jBDJ5870AzL5Eer3q7VvDTME=; b=DK8TQlFJCSId2wt2CwODeXYl4WdRCjWuyulad+EbQ59WRaFV7tRY35Ps2R/0yooG1d2JEE7w5WzIAqPO8sVbp5l0d1hyFVk8ZeJkr0ehTfH6MuJ4ylk56YzzDM6lfVvlhf8H7w2zktFYkRzT3dM1S1YDcoYSLSq/RsIfduo+TgAxO1RxeJ73ALx4FAvbJxx/z/Jkn8ygMAWSJ5zuutVhG4QQqfpOZoXe6fMyFL51kuOtpXx7XTt03feOMNeOfceDJ1dQDJE8gTqZ4rOD7j1gXWM/H2J0wqTlIS5PDSw+Eu+km5WdHrbB7PrNjGLOWz25rBjLgpNvDy0BgKHB5v9EmA== Archived-At: Subject: Re: [Emu] Run EAP-NOOB implementation X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 13:46:07 -0000 --------------111FAD3D72214EDE5E855C85 Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 7bit Hi Thien Nguyen, Thank you for your interest in hacking with our group during the hackathon, I look forward to working with you! I'm happy to help you debug this issue, but let's take this separately off-the-mailing list. If we find some issues in the spec that need to be addressed, we can bring it back to the EMU mailing list. Best regards, Aleksi On 13/03/2019 16:09, Thien Nguyen wrote: > Hello all, > > I'm considering enrolling in the Hackathon with EAP-NOOB so I've been > trying to run the implementation that you have posted at > https://github.com/tuomaura/eap-noob but I have not succeeded. > > I have followed the steps indicated in the README and the EAP > communication always ends in Failure. The identity noob@eap-noob.net > is sent and the EAP-Request message is > returned with the empty Identity field. > > Is there any additional information or any configuration that I need > to know in order to execute the scenario? Or could you provide sample > information that needs to be added to the configuration files for > execution? > > I would also like more information on how the client is simulated. > Does the wpa_auto_run.py script do it? Should I run some other program > to complete the authentication process or how can I get the OOB code? > > I apologize if this is not the right place to send this email. > > Thank you very much for your attention. > Greetings, > Thien Nguyen. --------------111FAD3D72214EDE5E855C85 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: 7bit Hi Thien Nguyen,

Thank you for your interest in hacking with our group during the hackathon, I look forward to working with you!

I'm happy to help you debug this issue, but let's take this separately off-the-mailing list. If we find some issues in the spec that need to be addressed, we can bring it back to the EMU mailing list.

Best regards,
Aleksi

On 13/03/2019 16:09, Thien Nguyen wrote:

Hello all,

I'm considering enrolling in the Hackathon with EAP-NOOB so I've been trying to run the implementation that you have posted at https://github.com/tuomaura/eap-noob but I have not succeeded.

I have followed the steps indicated in the README and the EAP communication always ends in Failure. The identity noob@eap-noob.net is sent and the EAP-Request message is returned with the empty Identity field.

Is there any additional information or any configuration that I need to know in order to execute the scenario? Or could you provide sample information that needs to be added to the configuration files for execution?

I would also like more information on how the client is simulated. Does the wpa_auto_run.py script do it? Should I run some other program to complete the authentication process or how can I get the OOB code?

I apologize if this is not the right place to send this email.

Thank you very much for your attention.
Greetings,
Thien Nguyen.
--------------111FAD3D72214EDE5E855C85-- From nobody Thu Mar 14 08:12:16 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA73F12F18C for ; Thu, 14 Mar 2019 08:12:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GRULF91La2cF for ; Thu, 14 Mar 2019 08:12:11 -0700 (PDT) Received: from mail-ua1-x931.google.com (mail-ua1-x931.google.com [IPv6:2607:f8b0:4864:20::931]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 901FE1277CC for ; Thu, 14 Mar 2019 08:12:06 -0700 (PDT) Received: by mail-ua1-x931.google.com with SMTP id a42so2043760uad.1 for ; Thu, 14 Mar 2019 08:12:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=8JaLBNMrF5at0FwMmq9Fbdaj9j4q4m/fKLc6UUkjr44=; b=V4OTOOm/FHmtDD/g+BdqkqsuUHNtEKgMbIVxlgyNuF/Sz6LS8fbrfCmJsbvkoYtKSR pLFaYGhK1Og4MZFrw80hqzN9WyzpknjudE09rHdwCb704GUgtgtOetMdQoQyMDhVIEas bOIgz2FhJya4T8AtTximGmLrxCtUWcl3j/yQvDt+q8t/y7kwRPzOmU1XklmA68O5nD51 QtMKJ3iCgNyd3gqQcz0e8YWOVZGDzJJyI4j8ObGjW2m9butYvqALahgL4R0D44KLW8Mp M5q0gblA40C3LSyr7DKbi0epn1egmxgwvyTDbgGW85c68gJOW18dFQX2YSBFxjtN5A7D i8Eg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=8JaLBNMrF5at0FwMmq9Fbdaj9j4q4m/fKLc6UUkjr44=; b=dN7r3U02HgD6vl55ZhFk9g3hppnufP/u5+edxo2QEmW7F9Pa/r6kGesxxSXlCImuD8 KfqKrwgVLmarbfyMYEEvKGZY5macJaZCbsUzwF0iE/bpIIlUrHG/rGoug4pf7rBkAIqF zZuZI4Dbn9u/G6VHPLapRV+KQkdtD+4/dCt3aFHq0qL8/Wb8lvEgKqGjdzBzNoVDqp/v RPQ7md0EDf4i/9LajVA3zGt2zuSAjT3Fk9HxPI137y2TaSkHt+0BtzVh/Lm0xZvh+XSH UhXV+0C6O7PVw30ksu2cfLsgsRiPTLqaDfs5TNfbynDSmnJhJykbFQ69RYjdr3Ui0Is1 a+iA== X-Gm-Message-State: APjAAAX4aGyS6j5EfutDQZo3nEpe73UymzUAfAvol8MCj3T5opVz7Zlp 2iXAK0mhasw0ypVGoDSSnxnyunmVY4WR3M06oJk= X-Google-Smtp-Source: APXvYqzi8SpFwl3yXXMD/TX9MeclY2uT/aHMWcyfrbK8h9r5zndJF1AJwW3m9MgSRzIzOiIJgcHVGeeDazzoRHafE7s= X-Received: by 2002:a9f:2163:: with SMTP id 90mr8190857uab.119.1552576325366; Thu, 14 Mar 2019 08:12:05 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: slon v sobstvennom palto Date: Thu, 14 Mar 2019 17:11:54 +0200 Message-ID: To: John Mattsson Cc: Mohit Sethi M , "Dr. Pala" , Alan DeKok , "emu@ietf.org" Content-Type: multipart/alternative; boundary="0000000000005c4ded05840f589e" Archived-At: Subject: Re: [Emu] EAP and Fragmentation X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 15:12:14 -0000 --0000000000005c4ded05840f589e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi John, >Should draft-ietf-emu-eap-tls13-04 just copy the sentence from RFC 5281 or do the group want something different? I remember that some EAP-TLS/PEAP clients rejected not fragmented messages without L bit set, probably due to their wrong interpretation of EAP-TLS RFC. Would it worth to say something like "Implementation SHOULD accept unfragmented messages with and without L bit set" in addition to copying the sentence above from RFC 5281? Cheers, Oleg On Sun, Mar 10, 2019 at 2:39 PM John Mattsson wrote: > Welcome and thanks for your comments Oleg! > > slon v sobstvennom palto ; wrote: > > >Per my experience the existing fragmentation method described in EAP-TLS > >RFC 5216 serves good for all fragmentation needs. The method is reused b= y > >PEAP, EAP-FAST, TEAP and EAP-TTLS. There's an ambiguity in EAP-TLS RFC > that > >doesn't specify whether a not-fragmented message should have the L bit a= nd > >the 4 octets length field so different peers treat it differently. > However, > >for example, EAP-TTLS RFC closed it tightly saying that even a > >single-fragment message should have it nevertheless on its redundancy. > > I cannot find anything in EAP-TTLS (RFC 5281) saying that the L bit shoul= d > be set. As you have noticed, EAP-TLS (RFC 5216) does not say anything abo= ut > the L bit in unfragmented messages and my understanding is that the > ambiguity is if unfragmented messages can (not should) have the L bit set= . > As far as I can see, EAP-TTLS (RFC 5281) states that unfragmented message= s > MAY set the L bit. > > RFC 5281 Section 9.2.2: > > =E2=80=9CUnfragmented messages MAY have the L bit set and include the > length of the message (though this information is redundant).=E2=80= =9D > > I looked through the other TLS-based EAP methods (both RFCs and drafts) > and none of them seems to say anything new about the L bit. > draft-ietf-emu-eap-tls13 should clarify any ambiguity. > > Should draft-ietf-emu-eap-tls13-04 just copy the sentence from RFC 5281 o= r > do the group want something different? > > Cheers, > John > > --0000000000005c4ded05840f589e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi John,

>Should draft-ietf-em= u-eap-tls13-04 just copy the sentence from RFC 5281 or do the group want so= mething different?

I remember that some EAP-TLS/PEAP cli= ents rejected not fragmented messages without L bit set, probably due to th= eir wrong interpretation of EAP-TLS RFC. Would it worth to say something li= ke "Implementation SHOULD accept unfragmented=C2=A0messages with and w= ithout L bit set" in addition to copying the sentence above from RFC 5= 281?

Cheers,
Oleg


On= Sun, Mar 10, 2019 at 2:39 PM John Mattsson <john.mattsson@ericsson.com> wrote:
Welcome and thanks for your co= mments Oleg!

slon v sobstvennom palto <slonvpalto@gmail.com>; wrote:

>Per my experience the existing fragmentation method described in EAP-TL= S
>RFC 5216 serves good for all fragmentation needs. The method is reused = by
>PEAP, EAP-FAST, TEAP and EAP-TTLS. There's an ambiguity in EAP-TLS = RFC that
>doesn't specify whether a not-fragmented message should have the L = bit and
>the 4 octets length field so different peers treat it differently. Howe= ver,
>for example, EAP-TTLS RFC closed it tightly saying that even a
>single-fragment message should have it nevertheless on its redundancy.<= br>
I cannot find anything in EAP-TTLS (RFC 5281) saying that the L bit should = be set. As you have noticed, EAP-TLS (RFC 5216) does not say anything about= the L bit in unfragmented messages and my understanding is that the ambigu= ity is if unfragmented messages can (not should) have the L bit set. As far= as I can see, EAP-TTLS (RFC 5281) states that unfragmented messages MAY se= t the L bit.

RFC 5281 Section 9.2.2:

=C2=A0 =C2=A0=E2=80=9CUnfragmented messages MAY have the L bit set and incl= ude the
=C2=A0 =C2=A0 length of the message (though this information is redundant).= =E2=80=9D

I looked through the other TLS-based EAP methods (both RFCs and drafts) and= none of them seems to say anything new about the L bit. draft-ietf-emu-eap= -tls13 should clarify any ambiguity.

Should draft-ietf-emu-eap-tls13-04 just copy the sentence from RFC 5281 or = do the group want something different?

Cheers,
John

--0000000000005c4ded05840f589e-- From nobody Fri Mar 15 03:13:48 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50AFA12762F for ; Fri, 15 Mar 2019 03:13:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.302 X-Spam-Level: X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=B76RVxyM; dkim=pass (1024-bit key) header.d=ericsson.com header.b=ic0lCgRh Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WnM68Yd1hNRw for ; Fri, 15 Mar 2019 03:13:45 -0700 (PDT) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 698BF1200D7 for ; Fri, 15 Mar 2019 03:13:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1552644823; x=1555236823; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Q5IO6nhUHJEcloWOp86GDV5CIjnLLVK/q2vokVWImus=; b=B76RVxyM7rw3pxxHWxRLAZvq7ZogyZhfCEEihMOcnMyI9BbqgetU3CVa2+N8X99V A2ZRyUvzzm+E4ZZrHb2d/YUuKYmrMTaytgFhlK+SCKSrt/37QfGsUByfHt+LgFAL U/UC5gzfdgtRwMCCRAprbQnCLk+xA3IABr386vQscTE=; X-AuditID: c1b4fb3a-5c9c29e00000672c-51-5c8b7ad7fd9c Received: from ESESSMB505.ericsson.se (Unknown_Domain [153.88.183.123]) by sessmg22.ericsson.net (Symantec Mail Security) with SMTP id 5C.87.26412.7DA7B8C5; Fri, 15 Mar 2019 11:13:43 +0100 (CET) Received: from ESESSMB504.ericsson.se (153.88.183.165) by ESESSMB505.ericsson.se (153.88.183.166) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Fri, 15 Mar 2019 11:13:32 +0100 Received: from EUR03-DB5-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB504.ericsson.se (153.88.183.165) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Fri, 15 Mar 2019 11:13:32 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Q5IO6nhUHJEcloWOp86GDV5CIjnLLVK/q2vokVWImus=; b=ic0lCgRhNP/H8yRrNQrCgHFDtQWGRDAC77sGxY8ASL7O2w4Qy8kxpz9d2kLyb92iZzx/7vnXxEGu1aUAjsCCxOT0FLE82fDl0mDhu6eGeiRzAKV2u1K74IpCl5ufwS5XcyiUK9nEJzXqH9ZTNStxC2qk34D/AUQEM4vE1blpqT4= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB4188.eurprd07.prod.outlook.com (20.176.166.29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.11; Fri, 15 Mar 2019 10:13:31 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8%3]) with mapi id 15.20.1709.011; Fri, 15 Mar 2019 10:13:31 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: [Emu] EAP and Fragmentation Thread-Index: AQHU2xe9kv748aj0fk+DhC3TncuuMw== Date: Fri, 15 Mar 2019 10:13:31 +0000 Message-ID: <2F9F6888-CB17-44E3-BE6D-9378430D6738@ericsson.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 0d278e70-798d-4439-d86a-08d6a92ee02d x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB4188; x-ms-traffictypediagnostic: HE1PR07MB4188: x-microsoft-antispam-prvs: x-forefront-prvs: 09778E995A x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(979002)(136003)(376002)(39860400002)(346002)(396003)(366004)(189003)(199004)(1730700003)(33656002)(82746002)(14444005)(476003)(6916009)(14454004)(36756003)(229853002)(8936002)(2616005)(486006)(7736002)(81166006)(81156014)(8676002)(305945005)(2906002)(66066001)(97736004)(3846002)(6116002)(316002)(256004)(186003)(58126008)(25786009)(2351001)(6246003)(6486002)(26005)(86362001)(6512007)(5640700003)(68736007)(5660300002)(106356001)(6506007)(2501003)(102836004)(105586002)(99286004)(6436002)(83716004)(71200400001)(71190400001)(53936002)(478600001)(44832011)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB4188; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: qI35gbuNKjhs6YoWqM5+PNSSiZJaE3tH8Gi5EgN/mj+y8soyUT9cUKJ+oE788Mw+NKyGPZIP546Yx/La+MHrjiIS5vhkuK17xx20u5EJfCnRhyLNMOj6jHT1LgEHQXYvBTTV5Iudbt6THR4S218aNIaPSlaSQC7Ya5ra4tm9oaNsVE4EEqgTGv/QZ+LAtzZlvFpg38WudVg9iFnnfpwB0AeNcvFswvePzV+yAC56i3/gnanoLeXGU+ELvaeD1K/cBaDyiZZfEzYot8sv+FNzv/b379P0OycHX1kllTOxWYoIyHeESgRDyq0rY4seWn2rjE/9+8EpQy8WxGVpBsjn7YKIZCOc0aed5q8I/46jpCdg2RhLCHqcVDdfmsqiVE+hiXkxruIhvDbT+ofG9r1+tMZ6ZZHfHqTPrYv0t1K+RqY= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 0d278e70-798d-4439-d86a-08d6a92ee02d X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Mar 2019 10:13:31.2503 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB4188 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpjleLIzCtJLcpLzFFi42KZGbG9Wvd6VXeMQcdheYtj69eyODB6LFny kymAMYrLJiU1J7MstUjfLoErY9/l22wFZ/gqNm1+wdLAOIevi5GTQ0LAROLAp3bWLkYuDiGB I4wSR86vYIJwvjFKbGz6ywLhLGGSOHZ2A1iGRWACs8Tro1PYIDKTmSQOT/4D5TxglPh39zYr yGQ2AQOJuXsa2EBsEQFFiR+X2phBbGEBDYm5045CxTUlzh7Zygxh60lc2nKBsYuRA2iFqkTL URmQMK+AvcSNYy9ZQGxGATGJ76fWMIHYzALiEreezGeCeEJAYsme88wQtqjEy8f/wE4QFdCX 2NL3AKo3VqK1dTorRI2ixOl9K6DqZSUuze9mhLB9Je6+2sgI8ouEwE1GiQ0Ld7FBJLQkfl3Z wA5hZ0sc+HsJqllG4uGWBmaIholsEkfuvgFLCAmkSixf2wo1VU5iVe9DFgj7PLPE8dYSkCeZ gZ5fv0t/AqP2LCT/zELIQIQ9JD6ums0EYStKTOl+yD4LHCyCEidnPmFZwMi6ilG0OLW4ODfd yEgvtSgzubg4P08vL7VkEyMwdRzc8ttqB+PB546HGAU4GJV4eMMzu2OEWBPLiitzDzFKcDAr ifA+1gcK8aYkVlalFuXHF5XmpBYfYpTmYFES5/0jJBgjJJCeWJKanZpakFoEk2Xi4JRqYDTz 6irRtUnZdXbd9hvBv+4tXV44xbXYbpIJM9f0E8smT1WafXffafFMxSv/FpteeSM1bd2VBIWr SWf+vba1X5TPKtbxT3/HtLmWzwvzHp/Kz/WtWeUeOfHhiUMrn1bfOuXtXzX9p7bS3X8fOX5G L+mz8e15+cU1qaW5e/7Ro39cL0Zs5yl/q9KsxFKckWioxVxUnAgAulwVDRkDAAA= Archived-At: Subject: Re: [Emu] EAP and Fragmentation X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 10:13:47 -0000 IEhpIE9sZWcsDQoNCj5JIHJlbWVtYmVyIHRoYXQgc29tZSBFQVAtVExTL1BFQVAgY2xpZW50cyBy ZWplY3RlZCBub3QgZnJhZ21lbnRlZCBtZXNzYWdlcw0KPndpdGhvdXQgTCBiaXQgc2V0LCBwcm9i YWJseSBkdWUgdG8gdGhlaXIgd3JvbmcgaW50ZXJwcmV0YXRpb24gb2YgRUFQLVRMUw0KPlJGQy4g V291bGQgaXQgd29ydGggdG8gc2F5IHNvbWV0aGluZyBsaWtlICJJbXBsZW1lbnRhdGlvbiBTSE9V TEQgYWNjZXB0DQo+dW5mcmFnbWVudGVkIG1lc3NhZ2VzIHdpdGggYW5kIHdpdGhvdXQgTCBiaXQg c2V0IiBpbiBhZGRpdGlvbiB0byBjb3B5aW5nDQo+dGhlIHNlbnRlbmNlIGFib3ZlIGZyb20gUkZD IDUyODE/DQoNCkkgYWRkZWQgdGhlIGZvbGxvd2luZyB0ZXh0IHRvIGRyYWZ0LWlldGYtZW11LWVh cC10bHMxMy0wNDoNCg0KIkVBUC1UTFMgZnJhZ21lbnRhdGlvbiBzdXBwb3J0IGlzIHByb3ZpZGVk IHRocm91Z2ggYWRkaXRpb24gb2YgYSBmbGFncyBvY3RldCB3aXRoaW4gdGhlIEVBUC1SZXNwb25z ZSBhbmQgRUFQLVJlcXVlc3QgcGFja2V0cywgYXMgd2VsbCBhcyBhIFRMUyBNZXNzYWdlIExlbmd0 aCBmaWVsZCBvZiBmb3VyIG9jdGV0cy4gIFVuZnJhZ21lbnRlZCBtZXNzYWdlcyBNQVkgaGF2ZSB0 aGUgTCBiaXQgc2V0IGFuZCBpbmNsdWRlIHRoZSBsZW5ndGggb2YgdGhlIG1lc3NhZ2UgKHRob3Vn aCB0aGlzIGluZm9ybWF0aW9uIGlzIHJlZHVuZGFudCkuIg0KDQpJIGRvbid0IGtub3cgaWYgYW55 dGhpbmcgbW9yZSBpZiBuZWVkZWQsIGJ1dCBpZiB3ZSBhZGQgc29tZXRoaW5nIEkgdGhpbmsgaXQg c2hvdWxkIGJlICJNVVNUIGFjY2VwdCIgcmF0aGVyIHRoYW4gIlNIT1VMRCBhY2NlcHQiLg0KDQpU aGUgb3RoZXIgYWx0ZXJuYXRpdmUgd291bGQgYmUgdG8gaW5zdGVhZCB3cml0ZSAiVW5mcmFnbWVu dGVkIG1lc3NhZ2VzIE1VU1QgTk9UIGhhdmUgdGhlIEwgYml0IHNldCBhbmQgaW5jbHVkZSB0aGUg bGVuZ3RoIG9mIHRoZSBtZXNzYWdlICh0aG91Z2ggdGhpcyBpbmZvcm1hdGlvbiBpcyByZWR1bmRh bnQpLiINCg0KSSB0aGluayB3ZSBuZWVkIHRvIGNob29zZSBvbmUgYW5kIGVuc3VyZSB0aGF0IGlt cGxlbWVudGF0aW9ucyBmb2xsb3dpbmcgZHJhZnQtaWV0Zi1lbXUtZWFwLXRsczEzIGNhbiB0YWxr IHRvIGVhY2ggb3RoZXIuIERvIGFueWJvZHkgaGF2ZSBhbnkgZGF0YSBvbiBob3cgbWFueSBpbXBs ZW1lbnRhdGlvbnMgb3V0IHRoZXJlIHNldCB0aGUgTCBiaXQgZm9yIHVuZnJhZ21lbnRlZCBtZXNz YWdlcyBhbmQgaG93IG1hbnkgaW1wbGVtZW50YXRpb25zIGRvIG5vdCBhY2NlcHQgdW5mcmFnbWVu dGVkIG1lc3NhZ2VzIHdpdGggdGhlIEwgYml0IHNldD8NCg0KQ2hlZXJzLA0KSm9obg0KDQo= From nobody Fri Mar 15 06:09:48 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF441131230 for ; Fri, 15 Mar 2019 06:09:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jcvGj3jM1YyO for ; Fri, 15 Mar 2019 06:09:45 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 017DD12EB11 for ; Fri, 15 Mar 2019 06:09:45 -0700 (PDT) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id F3F23713; Fri, 15 Mar 2019 13:09:43 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Alan DeKok In-Reply-To: <2F9F6888-CB17-44E3-BE6D-9378430D6738@ericsson.com> Date: Fri, 15 Mar 2019 09:09:42 -0400 Cc: "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <9B5E0A4C-7854-4A8A-AE82-8724DDA0A10F@deployingradius.com> References: <2F9F6888-CB17-44E3-BE6D-9378430D6738@ericsson.com> To: John Mattsson X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Emu] EAP and Fragmentation X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 13:09:47 -0000 On Mar 15, 2019, at 6:13 AM, John Mattsson = wrote: > I think we need to choose one and ensure that implementations = following draft-ietf-emu-eap-tls13 can talk to each other. Do anybody = have any data on how many implementations out there set the L bit for = unfragmented messages and how many implementations do not accept = unfragmented messages with the L bit set? I've done a quick check. On reception, FreeRADIUS accepts the L bit = for any type of message. It doesn't care about fragments, just that the = length is correct. For sending packets, FreeRADIUS sets the L bit only if it is sending = fragments. Alan DeKok. From nobody Fri Mar 15 09:44:22 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A493A130E79 for ; Fri, 15 Mar 2019 09:44:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.302 X-Spam-Level: X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=Eaw7tRZn; dkim=pass (1024-bit key) header.d=ericsson.com header.b=RPwY4qCj Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UiAg4SmHZz2V for ; Fri, 15 Mar 2019 09:44:19 -0700 (PDT) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B668F12705F for ; Fri, 15 Mar 2019 09:44:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1552668256; x=1555260256; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=gAfwUFEJLuklcsZNqQx1CaLwkdsgmpob07WBjW64f9s=; b=Eaw7tRZnBvluwkOqDW2Tf83ZV2Asgw6c8wH6zjM+hKxBn8xkvRGED7wBTal3bnXt fJIRRxYOEADoYlrDhxk2UDmsYIzpHnnc651LMbxpc1NZcbIK/gqfkSi8Hq6IehWZ P+jigxaeUgnWct7LyDN4FaNKzlPUaaAEBcnm76UUGJY=; X-AuditID: c1b4fb2d-db5ff7000000062f-79-5c8bd66000bf Received: from ESESBMB505.ericsson.se (Unknown_Domain [153.88.183.118]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id 01.5B.01583.066DB8C5; Fri, 15 Mar 2019 17:44:16 +0100 (CET) Received: from ESESSMR503.ericsson.se (153.88.183.112) by ESESBMB505.ericsson.se (153.88.183.172) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Fri, 15 Mar 2019 17:44:16 +0100 Received: from ESESSMB505.ericsson.se (153.88.183.166) by ESESSMR503.ericsson.se (153.88.183.112) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Fri, 15 Mar 2019 17:44:16 +0100 Received: from EUR02-VE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB505.ericsson.se (153.88.183.166) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Fri, 15 Mar 2019 17:44:15 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gAfwUFEJLuklcsZNqQx1CaLwkdsgmpob07WBjW64f9s=; b=RPwY4qCjxyT3PilTfKjoEWlWHEnDduUFge5nO7OkpEJQTpAfMv0qZ7Vj0Nh6XVFwIiGA+o1K1JM3sTEsTLbjhUNzkghr9lxlJ3OKAtSVR6KbGQHnOAhLnuFZrWhtoL8+1Ijkjm+k7O2zB71Ydts9voWBqW1pxdsN7lrDN3tLZR4= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3419.eurprd07.prod.outlook.com (10.170.247.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.10; Fri, 15 Mar 2019 16:44:14 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8%3]) with mapi id 15.20.1709.011; Fri, 15 Mar 2019 16:44:14 +0000 From: John Mattsson To: "emu@ietf.org" Thread-Topic: [Emu] EAP and Fragmentation Thread-Index: AQHU205SupeoTco1ikeiZtzIG3X8XA== Date: Fri, 15 Mar 2019 16:44:14 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 1a3c62a4-e095-4b74-7d5d-08d6a965758f x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3419; x-ms-traffictypediagnostic: HE1PR07MB3419: x-microsoft-antispam-prvs: x-forefront-prvs: 09778E995A x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(136003)(366004)(39860400002)(396003)(346002)(199004)(189003)(106356001)(99286004)(102836004)(105586002)(6916009)(6436002)(6486002)(14454004)(8936002)(6512007)(4744005)(5640700003)(6506007)(66066001)(25786009)(36756003)(186003)(26005)(86362001)(5660300002)(2501003)(256004)(83716004)(71190400001)(71200400001)(6246003)(82746002)(97736004)(33656002)(53936002)(7736002)(2351001)(3846002)(316002)(68736007)(6116002)(2906002)(8676002)(305945005)(478600001)(486006)(229853002)(44832011)(476003)(2616005)(81166006)(81156014)(1730700003)(58126008); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3419; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: XNhTR6MADEZsWo49Tp1BncwJZ8MC2mRZteqglXW1Rvv04z9qOPCP5ROsPIA3L3w1deXJ1/0qBNpAsbGZE26l5UxQnjW/MqWQVflH6Z05wTm79r//Eq9Mnn3+BeReTVjfgMnUTr2glckP4wunsZioGss/KqrXd3JasweCejJDYm0Aj06fTiLsYPJvBblaHYyDhHP3eIhrVRL7GWdyUqCBHXN4XNpxvu6Kj5r6unvcugPIqctCiylZ+F9jyS7eVEBFk4JUN6FVr9w9Hgqfo24Inquz5htc/SF6lct+KIPeQWjriI2DOn6gEbDb8fHHADI9Q/yk2JWsyxgetdXzTvfh0GcsJ289KJgTTjgOAfzwMZPRhiISbaiRcnQD7FJNI2h1mmxxGs+ECPW257Zs1LovDMbioT1q6DLG2lJXt/VZXRU= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 1a3c62a4-e095-4b74-7d5d-08d6a965758f X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Mar 2019 16:44:14.7382 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3419 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpnleLIzCtJLcpLzFFi42KZGbG9TDfhWneMwcptqhbH1q9lcWD0WLLk J1MAYxSXTUpqTmZZapG+XQJXxqFrD9gLNrFWLD/8hLmBcQFrFyMHh4SAicSpF3xdjFwcQgJH GCU+rF3O3MXICeR8Y5SY+s0YIgFkL+i4wQzhLGGSuL3vBAuIwyIwgVni6KH9bBCZKUwSn2/8 Z4dwHjBK/F78H2wYm4CBxNw9DWwgtoiAosSPS21gcWEBDYm5045CxTUlzh7ZygxylIiAnsSW azkgYRYBVYnz2zrASngF7CXOnv7DCGIzCohJfD+1hgnEZhYQl7j1ZD6YLSEgILFkz3lmCFtU 4uXjf6wgtqiAvsSWvgcsEL2xEq2t01khahQlTu9bAVUvK3FpfjcjhO0rMfPuM7AvJQRuMkrs br7NDpHQkrhy/zNUUbbEge9PoRbLSDzc0sAM0XCPVeJw41s2SEimSixf2wrVICexqvch1NTz zBKT/h9imsCoMwvJF7OAAcAMDIz1u/Qhwh4Ss/+sZoKwFSWmdD9knwUODEGJkzOfsCxgZF3F KFqcWlycm25krJdalJlcXJyfp5eXWrKJEZg8Dm75rbuDcfVrx0OMAhyMSjy8H3Z1xwixJpYV V+YeYpTgYFYS4X2sDxTiTUmsrEotyo8vKs1JLT7EKM3BoiTO+0dIMEZIID2xJDU7NbUgtQgm y8TBKdXA6FZlunrdhkpZrqmmqzq5PLouFjfb2t0XfdKfPbXloqihu1b+ZyYe89WKGw08Qmu+ +iifuHYoedmfbfcOHfg9Xdvh7LPkSVtO9P5clxSrIe8ZER5naLLj8NQUqySuGSmpjw0UFuvb LTvIfOLf77ol2dIaQdaqodNVdS+X/P55bH2GyeGFQe89lViKMxINtZiLihMBNgSgRxoDAAA= Archived-At: Subject: Re: [Emu] EAP and Fragmentation X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 16:44:21 -0000 QWxhbiB3cm90ZToNCg0KPkkndmUgZG9uZSBhIHF1aWNrIGNoZWNrLiAgT24gcmVjZXB0aW9uLCBG cmVlUkFESVVTIGFjY2VwdHMgdGhlIEwgYml0IGZvciBhbnkgdHlwZSBvZiBtZXNzYWdlLiAgSXQg ZG9lc24ndCBjYXJlID5hYm91dCBmcmFnbWVudHMsIGp1c3QgdGhhdCB0aGUgbGVuZ3RoIGlzIGNv cnJlY3QuDQo+DQogPkZvciBzZW5kaW5nIHBhY2tldHMsIEZyZWVSQURJVVMgc2V0cyB0aGUgTCBi aXQgb25seSBpZiBpdCBpcyBzZW5kaW5nIGZyYWdtZW50cy4NCg0KVGhhdCBpcyBwcm9iYWJseSB0 aGUgY29ycmVjdCBiZWhhdmlvciB0byBzdGFuZGFyZGl6ZSwgaS5lLiwgc29tZXRoaW5nIGxpa2UN Cg0KIkltcGxlbWVudGF0aW9ucyBNVVNUIE5PVCBzZXQgdGhlIEwgYml0IGluIHVuZnJhZ21lbnRl ZCBtZXNzYWdlcywgYnV0IE1VU1QgYWNjZXB0IHVuZnJhZ21lbnRlZCBtZXNzYWdlcyB3aXRoIGFu ZCB3aXRob3V0IHRoZSBMIGJpdCBzZXQuIg0KDQpDaGVlcnMsDQpKb2huDQoNCg== From nobody Fri Mar 15 09:51:51 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E6B5129284 for ; Fri, 15 Mar 2019 09:51:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Yfx8EaYqXnA1 for ; Fri, 15 Mar 2019 09:51:47 -0700 (PDT) Received: from mail-vs1-xe2e.google.com (mail-vs1-xe2e.google.com [IPv6:2607:f8b0:4864:20::e2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1464712705F for ; Fri, 15 Mar 2019 09:51:47 -0700 (PDT) Received: by mail-vs1-xe2e.google.com with SMTP id w26so3307523vsk.13 for ; Fri, 15 Mar 2019 09:51:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9b4ijC+cAYfToIrj9eHoqP212D75Zb1o0TkRsY0LXvQ=; b=c/bIGrb1kCUFv8wOV0VppAPhEtpU5pn1bTUfsw5fwwv++gaRS1Z775nPQWWsvEgFBK QAz9lGwQUBmyUjO5/J7GgdaGfBDpEL9+sJ92qV7zuBszkx1Qcd1G/jXU4qPcTO4o0HDb paKDkJvvDB5d3uHWAmKjpbpvyo7Exf81lm3sb61GILNs4OnLYe8lN2fhx8ixXszmqzYi wLoA1NxzcU7P3DnFu6odiM4Iffdg1hW0CXMvP9MSH0uwwsv+K8wzIHx+yDnqwo8Aj9WC Mews59lZFgHFqCDotkAtWtixDvZdxSxiBJaTc33gMwvMm5RkTkQX8OHtwDfuXVbfMm7J 6TWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9b4ijC+cAYfToIrj9eHoqP212D75Zb1o0TkRsY0LXvQ=; b=EyqQ7SGLNMeq96I9gwCQDeIkSgtvk+/AFMmWPMWa/CZFIucfu8Jvq4HaUf3SmlFKP0 aw3e0xU9YGSM1sQ42XzdtZdzM2HgeAkq61D1KO7bhp/EaADaecDP8JV0yVElplC3sV/9 5IafOk/39TP5iaNWFiNl4T7FeejlgFScMWzEt5+DqseE+5IUSzQqRWfKRBnqvN4yqHCN PNJ5dvGsNDqSeSVg6lWleuRJCIC7Hp+OjzngpqvAqY9tOPkY5gbCbRZzzd7z9J+khrD4 6FAsl+WxJCkxs+Fmd5HOZjd5SnDXENudwIMLeoW0RviHMM0CHPbc9yAfQOu4GDTgc4kC /FSw== X-Gm-Message-State: APjAAAVcGzH7G3FRSrrryRFhg8LzfmJH+Ouy3PdIZEKvjUimnobjCel+ 3LFlvLYSa1ySRbkf/75gbeCvfaPK1jGT3Us8KXIU8FyOOyg= X-Google-Smtp-Source: APXvYqwUpjbs9JfmaqRcDh6UGrCePm7obJ7n7uO7fNNS2f7QkXy3YxEGp7AqZ/qB5z9yE4F4suCnbYgAxtClneQp1lw= X-Received: by 2002:a67:6983:: with SMTP id e125mr2384762vsc.222.1552668705874; Fri, 15 Mar 2019 09:51:45 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: slon v sobstvennom palto Date: Fri, 15 Mar 2019 18:51:34 +0200 Message-ID: To: John Mattsson Cc: "emu@ietf.org" Content-Type: multipart/alternative; boundary="000000000000aae7ad058424daa1" Archived-At: Subject: Re: [Emu] EAP and Fragmentation X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 16:51:50 -0000 --000000000000aae7ad058424daa1 Content-Type: text/plain; charset="UTF-8" John wrote: >That is probably the correct behavior to standardize, i.e., something like >"Implementations MUST NOT set the L bit in unfragmented messages, but MUST accept unfragmented messages with and without the L bit set." I'm for the strict approach. Anyway some implementations don't adhere it. The sentence above narrows the behaviour to a non-ambiguous while requires to support all kinds of existing behaviours thus it looks like the most exact form of the requirement. Cheers, Oleg On Fri, Mar 15, 2019 at 6:44 PM John Mattsson wrote: > Alan wrote: > > >I've done a quick check. On reception, FreeRADIUS accepts the L bit for > any type of message. It doesn't care >about fragments, just that the > length is correct. > > > >For sending packets, FreeRADIUS sets the L bit only if it is sending > fragments. > > That is probably the correct behavior to standardize, i.e., something like > > "Implementations MUST NOT set the L bit in unfragmented messages, but MUST > accept unfragmented messages with and without the L bit set." > > Cheers, > John > > _______________________________________________ > Emu mailing list > Emu@ietf.org > https://www.ietf.org/mailman/listinfo/emu > --000000000000aae7ad058424daa1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
John wrote:

>That is probably = the correct behavior to standardize, i.e., something like
>"Impl= ementations MUST NOT set the L bit in unfragmented messages, but MUST accep= t unfragmented messages with and without the L bit set."

<= /div>
I'm for the strict approach. Anyway some implementations don&= #39;t adhere it. The sentence above narrows the behaviour to a non-ambiguou= s while requires to support all kinds of existing behaviours thus it looks = like the most exact form of the requirement.=C2=A0

Cheers,
Oleg

On Fri, Mar 15, 2019 at 6:44 PM John Mattsson= <john.mattsson@ericsson.c= om> wrote:
Emu@ietf.org
https://www.ietf.org/mailman/listinfo/emu
--000000000000aae7ad058424daa1-- From nobody Fri Mar 15 09:54:01 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CABBB12705F for ; Fri, 15 Mar 2019 09:53:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Od2EXdrxQuLN for ; Fri, 15 Mar 2019 09:53:56 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 5BA6712D4EC for ; Fri, 15 Mar 2019 09:53:55 -0700 (PDT) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 0A955713; Fri, 15 Mar 2019 16:53:53 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Alan DeKok In-Reply-To: Date: Fri, 15 Mar 2019 12:53:52 -0400 Cc: John Mattsson , "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <43A7BC88-F475-43CF-AC7F-419CE6048FC4@deployingradius.com> References: To: slon v sobstvennom palto X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Emu] EAP and Fragmentation X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 16:53:59 -0000 On Mar 15, 2019, at 12:51 PM, slon v sobstvennom palto = wrote: >=20 > >That is probably the correct behavior to standardize, i.e., something = like > >"Implementations MUST NOT set the L bit in unfragmented messages, but = MUST accept unfragmented messages with and without the L bit set." >=20 > I'm for the strict approach. Anyway some implementations don't adhere = it. The sentence above narrows the behaviour to a non-ambiguous while = requires to support all kinds of existing behaviours thus it looks like = the most exact form of the requirement.=20 I agree. Alan DeKok. From nobody Mon Mar 18 07:37:10 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4A1C13110E for ; Mon, 18 Mar 2019 07:37:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.302 X-Spam-Level: X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=Hg7JkEMT; dkim=pass (1024-bit key) header.d=ericsson.com header.b=GDuHDSP7 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c9JpLbKsoSeA for ; Mon, 18 Mar 2019 07:37:07 -0700 (PDT) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 150BD13114C for ; Mon, 18 Mar 2019 07:36:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1552919808; x=1555511808; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=f9fsLCw31WbXfUEEhIwRSqrbh40w6nh2xF3ObTCIHho=; b=Hg7JkEMTpr7hfx9szo+DxRrGS5QaozoZ1KZooO/Z08QZOmgH7rdjKeRzPAOqaxs7 zCshpODFEYHFE//v3bk5mCs9jUAgLMgHNlbyznd6NcA6t5wQcO7v5mmQFOCAGd86 yxfCvEJPpp6BcrOGkutbdTq8zYrM1N7vdwct9kkVsBI=; X-AuditID: c1b4fb2d-db5ff7000000062f-ec-5c8fad008d34 Received: from ESESSMB501.ericsson.se (Unknown_Domain [153.88.183.119]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id CC.46.01583.00DAF8C5; Mon, 18 Mar 2019 15:36:48 +0100 (CET) Received: from ESESBMB501.ericsson.se (153.88.183.168) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Mon, 18 Mar 2019 15:36:48 +0100 Received: from EUR03-AM5-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB501.ericsson.se (153.88.183.168) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5 via Frontend Transport; Mon, 18 Mar 2019 15:36:48 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=f9fsLCw31WbXfUEEhIwRSqrbh40w6nh2xF3ObTCIHho=; b=GDuHDSP7xbyasYqd82ASx6OLMtD4enrD04tiKiZ99vDKcbL8A39UIOPFBHTqNNFEwj+mP0oAiwy2Qo8OHtfWSEt2M1Ybn+JeosURt8OtqHIMtXYFwRsxWTS10XPKEqAEFuv/HLZNy8XxfN81YPVww4DpwQbPLHAKf68fPZNNLYM= Received: from HE1PR0701MB2203.eurprd07.prod.outlook.com (10.168.33.136) by HE1PR0701MB2873.eurprd07.prod.outlook.com (10.168.98.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1730.7; Mon, 18 Mar 2019 14:36:47 +0000 Received: from HE1PR0701MB2203.eurprd07.prod.outlook.com ([fe80::2882:3a22:503c:2c24]) by HE1PR0701MB2203.eurprd07.prod.outlook.com ([fe80::2882:3a22:503c:2c24%2]) with mapi id 15.20.1709.015; Mon, 18 Mar 2019 14:36:47 +0000 From: Shiva Prasad Thagadur Prakash To: "emu@ietf.org" , "tuomas.aura@aalto.fi" , "dgarcia@odins.es" Thread-Topic: [Emu] Questions about EAP-NOOB Thread-Index: AQHUtv4YZAoDasa4BUyOI5o1puTbU6X+uYwwgBMIfgA= Date: Mon, 18 Mar 2019 14:36:46 +0000 Message-ID: <1552919806.27662.12.camel@ericsson.com> References: <26418_1548675555_5C4EE9E1_26418_441_1_e069870a-1233-fb27-5f07-13da2df1e138@odins.es> <42f019ff036243f1afd9cb67f4517eb4@aalto.fi> In-Reply-To: <42f019ff036243f1afd9cb67f4517eb4@aalto.fi> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [89.166.49.243] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: dbe05113-f16e-4588-7fdb-08d6abaf2658 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:HE1PR0701MB2873; x-ms-traffictypediagnostic: HE1PR0701MB2873: x-ms-exchange-purlcount: 4 x-microsoft-antispam-prvs: x-forefront-prvs: 098076C36C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(136003)(346002)(366004)(396003)(376002)(504964003)(189003)(199004)(305945005)(6486002)(110136005)(478600001)(186003)(53936002)(26005)(966005)(106356001)(7736002)(81166006)(14444005)(8676002)(81156014)(76176011)(8936002)(6346003)(6246003)(68736007)(99286004)(105586002)(15974865002)(97736004)(102836004)(6506007)(66066001)(2201001)(486006)(2501003)(36756003)(103116003)(11346002)(66574012)(5660300002)(446003)(25786009)(229853002)(476003)(6306002)(6512007)(14454004)(6116002)(2616005)(3846002)(6436002)(2906002)(71190400001)(71200400001)(53546011)(316002)(256004)(86362001); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2873; H:HE1PR0701MB2203.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=shiva.prasad.thagadur.prakash@ericsson.com; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: iCKbnoUkRxf4iEKSteqwAxnZGLDj4+VO5julTRLoNC4iH2Cuk3BSo3GRFGe5EHJfbFRSVGxo7/cGgaITo1dhVpUBG7cXNWdvT2b0HdohGyg174pcv3iaVzWYwiFuPsB463DPVMwjm5Lou8/ILtyH15QnrasWYsB0HzXlrBFiUb9CHqX6U9V+BCfmTYGDY13qwkZv8G6hk5q6OCFmN0e5VZxd77rfQ96gg1xQn58mYfS8KtRvvldj07iH1hrQPWkDX7wE8y5aWjQ92O+2bG14jOufT/Kp0xofytaW74REQQ9MJvp4mwLJEFcAdxqGFIFQhmRT8VdoTzuJvVEECnSASavqXqdyTIoAY1/41Fx7ajv0n1fyGmjvWqHWVFkkhuLtRhENVVcWp82m7XtpmE7qH8k7T34ZLBYpq+mpHa8Ooqg= Content-Type: text/plain; charset="utf-8" Content-ID: <949CC0A48361994F9A843C09956D8BFE@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: dbe05113-f16e-4588-7fdb-08d6abaf2658 X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Mar 2019 14:36:46.8552 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2873 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA02SfUhTURjGO7t323W0OC7NFyvJUUblR6WghH2ipJERQSG20JE3leaUXVvN vywa1VScJsOPspWTcKVOLRM10SWmiZYaKA6j6VguTUJIl4q17S7ov9/zPuc8POflUISomhtI ZcnzaIVcKhPzBGRl8pubYZsaSiQHJ8uiYzQ/nvFj+psayJiF0mb+CSLh/XwtN8Fg+M1JeKg2 cc8TKYLYdFqWpaQVEcfSBJlNv0b4uRvxt0xGB1mAKuI0iKIAR8HoUqwGCSgR7kPQaivmsGIZ wbf+Oh4rDBxYaHQSbkFiLQE60zTBOjoOjOutfFbYERjr1S7hQ/HwBajTt5Fu9sMqGLGvIDdv xQfAuf4AsfNQ6K6o5LqL+OEjsGRTusck3gMzC6ueGKGr31rbMMnmaxE0lz7yGD44Blo0Jp6b Ed4GKx9ectxM4ACYsj3xMGAMhq6PBMv+4Jjd4LIcDMOLVu+ZnTD2pBCxnATmzxbPmwFbENSs 3+WxRihY7B3eoEBYnGwkWc6BO+Wt3tAdMD7wlMNevs+DL46fnkMiTMPzBjVim2ZDeafdGxQE xmIrqUVhVf8Vr3Itg8D7oKkjgh0nQJd+jstyMJQXWvlVnsX4wmCljdQjrhH5MzTDZGccjgyn FVlXGSZHHi6n81qQ68v0vloLa0cv5k+aEaaQeLMQ1ZZIRFypklFlmxFQhNhPeDzRNRKmS1X5 tCInVXFDRjNmtJ0ixQHCdZGvRIQzpHn0dZrOpRX/XA7lE1iATiXHmY6+ng7hReimzpoulqQ5 vwdI8iemLrc77q3env0kt+7tjJfZ3z2eKAq4trv7dOqqdmhsNiQxejhJ3aJXK2sa869Yypz+ f+rCtVtS6mt04QVR9ZFF1l1VPTNfJ9TzfbqkM722+bk51XJNj7GxLuiS4Vz3W031qGRIsDY4 kCkmmUzpof2EgpH+BRLIRYouAwAA Archived-At: Subject: Re: [Emu] Questions about EAP-NOOB X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 14:37:10 -0000 SGkgVHVvbWFzLA0KDQpTZWUgaW4gbGluZS4NCg0KT24ga2UsIDIwMTktMDMtMDYgYXQgMTI6MjMg KzAwMDAsIEF1cmEgVHVvbWFzIHdyb3RlOg0KPiBIaSBEYW4gYW5kIFJhZmEsDQo+IMKgDQo+IFRo YW5rIHlvdSBmb3IgdGhlIHF1ZXN0aW9ucyENCj4gwqANCj4gWWVzLCB0aGUgSW5pdGlhbCBFeGNo YW5nZSBpbiBFQVAtTk9PQiBhbHdheXMgZW5kcyBpbiBFQVAtRmFpbHVyZS7CoA0KPiBUaGVuLCB3 ZSBnaXZlIHNvbWUgdGltZSBmb3IgdGhlIHVzZXIgdG8gdHJhbnNmZXIgdGhlIE9PQiBtZXNzYWdl Lg0KPiBBZnRlciB0aGUgT09CIHN0ZXAsIHRoZSBwZWVyIHRyaWVzIGFnYWluIGFuZCB0aGUgQ29t cGxldGlvbiBFeGNoYW5nZQ0KPiBlbmRzIGluIEVBUC1TdWNjZXNzLg0KPiDCoA0KPiBZZXMsIHRo ZSBvdXQtb2YtYmFuZCAoT09CKSBtZXNzYWdlIGlzIGNyeXB0b2dyYXBoaWNhbGx5IGJvdW5kIHRv IHRoZQ0KPiBFQ0hEIHJlc3VsdC4gVGhhdCwgaXMgdGhlIG1lc3NhZ2UgYXV0aGVudGljYXRpb24g Y29kZSAoSG9vYikgaW4gdGhlDQo+IE9PQiBtZXNzYWdlIHRha2VzIHRoZSBFQ0RIIG91dHB1dCBh cyBvbmUgb2YgaXRzIGlucHV0cy4NCg0KVGhpcyBzdGF0ZW1lbnQgaXMgbm90IGNvbXBsZXRlbHkg dHJ1ZS4gSWYgeW91IGxvb2sgYXQgdGhlIEhvb2INCmNhbGN1bGF0aW9uIHNwZWNpZmllZCBpbiB0 aGUgZHJhZnTCoGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1hdQ0KcmEtZWFwLW5v b2ItMDUjc2VjdGlvbi0zLjMuMjoNCg0KSG9vYiA9IEgoRGlyLFZlcnMsVmVycCxQZWVySWQsQ3J5 cHRvc3VpdGVzLERpcnMsU2VydmVySW5mbyxDcnlwdG9zDQrCoMKgwqDCoMKgwqB1aXRlcCxEaXJw LFtSZWFsbV0sUGVlckluZm8sMCxQS3MsTnMsUEtwLE5wLE5vb2IpLg0KDQpBcyB5b3UgY2FuIHNl ZSwgdGhlIEhvb2Igb25seSBjb25maXJtcyB0aGUgcHVibGljIGtleXMgaW52b2x2ZWQgaW4gdGhl DQpFQ0RIRSBleGNoYW5nZSBidXQgbm90IGFjdHVhbGx5IHVzZSB0aGUgc2hhcmVkIHNlY3JldCBk ZXJpdmVkLiBUaHVzLCBpdA0KZG9lcyBub3QgdXNlIHRoZSBFQ0RIRSBvdXRwdXQuwqANCg0KSG93 ZXZlciwgZnJvbSBteSBpbXBsZW1lbnRhdGlvbiBleHBlcmllbmNlLCBJIHRoaW5rIHRoaXMgaXMg dGhlIGNvcnJlY3QNCndheSB0byBjYWxjdWxhdGUgSG9vYiBzaW5jZSBpdCBhbGxvd3MgYXBwbGlj YXRpb25zIHRvIGV4dGVybmFsaXplIHRoZQ0KZ2VuZXJhdGlvbiBvZiByYW5kb20gbm9uY2UgTm9v YiBhbmQgdGhlIGNvcnJlc3BvbmRpbmcgSG9vYi4gVGhpcyB3b3VsZA0KYWxsb3cgZGVwbG95bWVu dHMgdG8gY2hvb3NlIGhvdyBvZnRlbiB0aGVzZSB2YWx1ZXMgYXJlIGNyZWF0ZWQuIEZvcg0KZXhh bXBsZSwgc29tZSBkaXNwbGF5IGRldmljZXMgbWlnaHQgcmVmZXJzaCB0aGUgUVIgY29kZSBjb250 YWluaW5nIE5vb2INCmFuZCBIb29iIGV2ZXJ5IGZldyBtaW51dGVzLsKgDQoNClJlZ2FyZHMsDQpT aGl2YQ0KDQo+IMKgDQo+IMKgDQo+IE91ciBjdXJyZW50IGltcGxlbWVudGF0aW9uIG9wcG9ydHVu aXN0aWNhbGx5IHRyaWVzIGFsbCB0aGUgVy1GaQ0KPiBuZXR3b3JrIHRoYXQgc3VwcG9ydCBXUEEy LUVudGVycHJpc2UuIEl0IGRlZmluaXRlbHkgd291bGQgYmUgYmV0dGVyDQo+IHRvIGFkdmVydGlz ZSB0aGUgY2FwYWJpbGl0eSBmb3IgRUFQLU5PT0IgaW4gSUVFRSA4MDIuMTF1LCBvciBldmVuDQo+ IGFkdmVydGlzZSB0aGUgZG9tYWluIG9mIHRoZSBFQVAtTk9PQiBzZXJ2ZXIuIEkgdGhpbmsgaXQg d2lsbCB0YWtlDQo+IHNvbWUgdGltZSBiZWZvcmUgdGhlIDgwMi4xMSBBUHMgc3RhcnQgdG8gc3Vw cG9ydCBFQVAtTk9PQiBpbiB0aGF0DQo+IHdheSwgdGhvdWdoLCBhbmQgd2Ugd2FudCB0aGUgcHJv dG9jb2wgdG8gd29yayB3aXRoIGV4aXN0aW5nIFdpLUZpDQo+IG5ldHdvcmtzLg0KPiDCoA0KPiBU aGUgcmVhbG0gdXNlZCBieSB0aGUgcGVlciBpcyBpbml0aWFsbHkg4oCcZWFwLW5vb2IubmV04oCd LiBUaGUgc2VydmVyDQo+IGNhbiBhc3NpZ24gYW5vdGhlciByZWFsbSBpbiBJbml0aWFsIEV4Y2hh bmdlLiBUaGUgbWFpbiBwdXJwb3NlIGZvcg0KPiBhc3NpZ25pbmcgYW5vdGhlciByZWFsbSBpcyB0 aGF0IHRoZSBwZWVyIGNhbiBsYXRlciB1c2UgaXQgZm9yIHJvYW1pbmcNCj4gaW4gYWNjZXNzIG5l dHdvcmtzIHRoYXQgaGF2ZSBBQUEgcm91dGluZyBzZXQgdXAgZm9yIHRoZSBhc3NpZ25lZA0KPiBy ZWFsbS4NCj4gwqANCj4gV2UgaGF2ZSBvbmx5IHRlc3RlZCBFQVAtTk9PQiBvbiBXaS1GaTogaHR0 cHM6Ly9naXRodWIuY29tL3R1b21hdXJhL2VhDQo+IHAtbm9vYi4gSXQgY2FuIGJlIHVzZWQgb24g YW55IG5ldHdvcmtzIHRoYXQgc3VwcG9ydCBFQVAgYW5kIHdoZXJlIHRoZQ0KPiB1c2VyLWFzc2lz dGVkIE9PQiBhdXRoZW50aWNhdGlvbiBtZXRob2RzIG1ha2VzIHNlbnNlIGZyb20gdGhlIHVzZXIN Cj4gZXhwZXJpZW5jZSBwZXJzcGVjdGl2ZS4NCj4gwqANCj4gUmVnYXJkcywNCj4gVHVvbWFzDQo+ IMKgDQo+IMKgDQo+IEZyb206IEVtdSA8ZW11LWJvdW5jZXNAaWV0Zi5vcmc+IE9uIEJlaGFsZiBP ZiBEYW4gR2FyY2lhDQo+IFNlbnQ6IE1vbmRheSwgMjggSmFudWFyeSwgMjAxOSAxMzozOQ0KPiBU bzogZW11QGlldGYub3JnDQo+IFN1YmplY3Q6IFtFbXVdIFF1ZXN0aW9ucyBhYm91dCBFQVAtTk9P Qg0KPiBJbXBvcnRhbmNlOiBIaWdoDQo+IMKgDQo+IERlYXIgVG91bWFzLCBNb2hpdCwNCj4gwqAN Cj4gV2UgaGF2ZSBiZWVuIGRpc2N1c3NpbmcgRUFQIE5PT0IgZHJhZnQgd2Ugd291bGQgbGlrZSB0 byBhc2sgc29tZQ0KPiBxdWVzdGlvbnMgYWJvdXQgaXQuIEl0IGlzIGEgdmVyeSBpbnRlcmVzdGlu ZyBhcHByb2FjaCByZWxhdGVkIHRvDQo+IElvVC7CoMKgDQo+IA0KPiANCj4gSW4gRUFQLU5PT0Ig YXMgZmlyc3Qgc3RlcCB0aGUgRUFQIGF1dGhlbnRpY2F0b3Igc3RhcnRzIHRoZQ0KPiBhdXRoZW5j dGlvbiAoZS5nLiB0aGUgQVApLCBlYXAtbm9vYiBoYXBwZW5zIGJ1dCBpdCBzZWVtcyB0aGVyZSB3 aWxsDQo+IGJlIGEgRUFQIGZhaWx1cmUgLCBpcyB0aGlzIGNvcnJlY3Q/DQo+IEFzc3VtaW5nIGl0 IGlzLCBpZiB5b3Ugc2VuZCBhbiBFQVAgZmFpbHVyZSwgd2lsbCB0aGUgRUFQIG1ldGhvZCBzdGls bA0KPiBjb250aW51ZT8gSG93IHdvdWxkIHRoaXMgd29yaz8gU2luY2Ugd2UgYXJlIHdhaXRpbmcs IHdlIGFzc3VtZSwgZnJvbQ0KPiBhbiBFQVAgc3VjY2Vzcywgb3IgYW4gYWx0ZXJuYXRpdmUgd2F5 IG9mIGNvbmZpcm1hdGlvbiB0aGF0IHRoZQ0KPiBhdXRoZW50aWNhdGlvbiBoYXMgYmVlbiBjb21w bGV0ZWQuDQo+IMKgDQo+IEl0IHNlZW1zIHRoYXQgdGhlIHVzZXIgZ2V0cyBzb21ldGhpbmcgZnJv bSB0aGUgSW9UIGRldmljZSB0aGlzDQo+IHNvbWV0aGluZyBpcyBkdWUgdG8gdGhlIEVDREgsIHJp Z2h0Pw0KPiDCoA0KPiBSZWdhcmRpbmcgdGhlIGRpc2NvdmVyeSBvZiB0aGUgRUFQIGF1dGhlbnRp Y2F0b3IuIFRoZSBBUCBzaG91bGQNCj4gYW5ub3VuY2Ugd2hhdCBhcmUgdGhlIGF2YWlsYWJsZSBk b21haW5zIHRvIHdoZXJlIGl0IGlzIGNvbm5lY3RlZCAoIGENCj4gc29sdXRpb24gYmFzZWQgb24g dGhlIEFBQSBpbmZyYWVzdHJ1Y3R1cmUgPykgQ291bGQgdGhpcyBpbmZvcm1hdGlvbg0KPiBiZSBw cm92aWRlZCB0byB0aGUgQVAgdXNpbmcgSUVFRSA4MDIuMTF1Pw0KPiDCoA0KPiBSZWxhdGVkIHRv IHRoaXMsIHdoYXQgd291bGQgYmUgdGhlIHJlYWxtIHByb3ZpZGVkIGJ5IHRoZSBFQVAgcGVlciB0 bw0KPiB0aGUgYXV0aGVudGljYXRvcj8NCj4gwqANCj4gQW5vdGhlciBxdWVzdGlvbiB3b3VsZCBi ZSB3aGljaCBhcmUgdGhlIG1haW4gcmFkaW8gdGVjaG5vbG9naWVzIHdoZXJlDQo+IEVBUCBOT09C IGlzIGV4cGVjdGVkIHRvIGJlIHVzZWQuIEFyZSB5b3UgcGxhbm5pbmcgdG8gc3VwcG9ydA0KPiA4 MDIuMTUuNCwgV0lGSSwgZXRjPyBJbiB0aGlzIGxpbmUsIGRvIHlvdSBoYXZlIGFueSBFQVAtTk9P Qg0KPiBpbXBsZW1lbnRhdGlvbiBpbiBDb250aWtpPw0KPiDCoA0KPiDCoA0KPiDCoA0KPiBUaGFu ayB5b3UgaW4gYWR2YW5jZS7CoA0KPiBCZXN0IFJlZ2FyZHMuDQo+IERhbiBhbmQgUmFmYS4NCj4g DQo+IA0KPiAtLcKgDQo+ID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09DQo+IMKgRGFuIEdhcmNpYSBDYXJyaWxsbywgUGguRC7C oA0KPiBEb2N0b3JhZG8gSW5kdXN0cmlhbCAoTUlORUNPKcKgDQo+IEUtbWFpbDogZGdhcmNpYUBv ZGlucy5lc8KgwqANCj4gT2RpbiBTb2x1dGlvbnMsIFMuTC7CoA0KPiBQb2zDrWdvbm8gSW5kdXN0 cmlhbCBPZXN0ZcKgDQo+IEMvIFBlcsO6LCA1LCAzwrosIE9maWNpbmEgMTLCoA0KPiAzMDgyMCAt IEFsY2FudGFyaWxsYSAoTXVyY2lhKSAtIFNwYWluwqANCj4gVGxmLjogKzM0IDkwMiA1NzAgMTIx wqANCj4gV2ViOiB3d3cub2RpbnMuZXPCoA0KPiA9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQ0KPiANCj4gQVZJU08gTEVHQUw6 IExhIGluZm9ybWFjacOzbiBjb250ZW5pZGEgZW4gZXN0ZSBjb3JyZW8gZWxlY3Ryw7NuaWNvLCB5 DQo+IGVuIHN1IGNhc28gZW4gbG9zIGRvY3VtZW50b3MgYWRqdW50b3MsIGVzIGluZm9ybWFjacOz biBwcml2aWxlZ2lhZGENCj4gcGFyYSB1c28gZXhjbHVzaXZvIGRlIGxhIHBlcnNvbmEgeS9vIHBl cnNvbmFzIGEgbGFzIHF1ZSB2YSBkaXJpZ2lkby4NCj4gTm8gZXN0w6EgcGVybWl0aWRvIGVsIGFj Y2VzbyBhIGVzdGUgbWVuc2FqZSBhIGN1YWxxdWllciBvdHJhIHBlcnNvbmENCj4gZGlzdGludGEg YSBsb3MgaW5kaWNhZG9zLiBTaSB1c3RlZCBubyBlcyB1bm8gZGUgbG9zIGRlc3RpbmF0YXJpb3Ms DQo+IGN1YWxxdWllciBkdXBsaWNhY2nDs24sIHJlcHJvZHVjY2nDs24sIGRpc3RyaWJ1Y2nDs24s IGFzw60gY29tbyBjdWFscXVpZXINCj4gdXNvIGRlIGxhIGluZm9ybWFjacOzbiBjb250ZW5pZGEg ZW4gw6lsIG8gY3VhbHF1aWVyYSBvdHJhIGFjY2nDs24gdQ0KPiBvbWlzacOzbiB0b21hZGEgZW4g cmVsYWNpw7NuIGNvbiBlbCBtaXNtbywgZXN0w6EgcHJvaGliaWRhIHkgcHVlZGUgc2VyDQo+IGls ZWdhbC4gRW4gZGljaG8gY2FzbywgcG9yIGZhdm9yIG5vdGlmw61xdWVsbyBhbCByZW1pdGVudGUg eSBwcm9jZWRhIGENCj4gbGEgZWxpbWluYWNpw7NuIGRlIGVzdGUgY29ycmVvIGVsZWN0csOzbmlj bywgYXPDrSBjb21vIGRlIHN1cyBhZGp1bnRvcw0KPiBzaSBsb3MgaHViaWVyZS4NCj4gQXNpbWlz bW8sIHkgZW4gY3VtcGxpbWllbnRvIGRlIExleSBPcmfDoW5pY2EgMy8yMDE4IGRlIHByb3RlY2Np w7NuIGRlDQo+IGRhdG9zIGRlIGNhcsOhY3RlciBwZXJzb25hbCB5IGdhcmFudMOtYSBkZSBsb3Mg ZGVyZWNob3MgZGlnaXRhbGVzIHkgZGVsDQo+IFJlZ2xhbWVudG8gRXVyb3BlbyBSR1BEIDY3OS8y MDE2IGxlIGluZm9ybWFtb3MgcXVlIHN1cyBkYXRvcyBlc3TDoW4NCj4gc2llbmRvIG9iamV0byBk ZSB0cmF0YW1pZW50byBwb3IgcGFydGUgZGUgT0RJTiBTT0xVVElPTlMsIFMuTC4gY29uDQo+IE4u SS5GLiBCLTczLjg0NS44OTMsIGNvbiBsYSBmaW5hbGlkYWQgZGVsIG1hbnRlbmltaWVudG8geSBn ZXN0acOzbiBkZQ0KPiByZWxhY2lvbmVzIGNvbWVyY2lhbGVzIHkgYWRtaW5pc3RyYXRpdmFzLiBM YSBiYXNlIGp1csOtZGljYSBkZWwNCj4gdHJhdGFtaWVudG8gZXMgZWwgY3VtcGxpbWllbnRvIGRl IGxhIGxlZ2lzbGFjacOzbiBmaXNjYWwsIG1lcmNhbnRpbCB5DQo+IGNvbnRhYmxlLiBObyBzZSBw cmV2w6luIGNlc2lvbmVzIHkvbyB0cmFuc2ZlcmVuY2lhcyBpbnRlcm5hY2lvbmFsZXMgZGUNCj4g ZGF0b3MuIFBhcmEgZWplcmNpdGFyIHN1cyBkZXJlY2hvcyBwdWVkZSBkaXJpZ2lyc2UgYSBPRElO IFNPTFVUSU9OUywNCj4gUy5MLiwgZG9taWNpbGlhZGEgZW4gQy8gUGVyw7osIDUsIDPCuiwgT2Zp Y2luYSAxMiwgUG9sLiBJbmQuIE9lc3RlLA0KPiAzMDgyMCBBbGNhbnRhcmlsbGEgKE11cmNpYSks IG8gYmllbiBwb3IgRS1tYWlsIGEgcHJvdGVjY2lvbmRlZGF0b3NAb2QNCj4gaW5zLmVzLCBjb24g ZWwgZmluIGRlIGVqZXJjZXIgc3VzIGRlcmVjaG9zIGRlIGFjY2VzbywgcmVjdGlmaWNhY2nDs24s DQo+IHN1cHJlc2nDs24gKGRlcmVjaG8gYWwgb2x2aWRvKSwgbGltaXRhY2nDs24gZGUgdHJhdGFt aWVudG8sDQo+IHBvcnRhYmlsaWRhZCBkZSBsb3MgZGF0b3MsIG9wb3NpY2nDs24sIHkgYSBubyBz ZXIgb2JqZXRvIGRlIGRlY2lzaW9uZXMNCj4gYXV0b21hdGl6YWRhcywgaW5kaWNhbmRvIGNvbW8g QXN1bnRvOiDCt0RlcmVjaG9zIExleSBQcm90ZWNjacOzbiBkZQ0KPiBEYXRvc8K3LCB5IGFkanVu dGFuZG8gZm90b2NvcGlhIGRlIHN1IEQuTi5JLg0KPiBfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXw0KPiBFbXUgbWFpbGluZyBsaXN0DQo+IEVtdUBpZXRmLm9y Zw0KPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2VtdQ== From nobody Wed Mar 20 03:03:54 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C823E13108F; Wed, 20 Mar 2019 03:03:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AJT-GAaWOtG9; Wed, 20 Mar 2019 03:03:49 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D17D130F84; Wed, 20 Mar 2019 03:03:46 -0700 (PDT) Received: from Jude (62.168.35.125) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 20 Mar 2019 03:03:39 -0700 From: Jim Schaad To: CC: 'EMU WG' Date: Wed, 20 Mar 2019 11:03:36 +0100 Message-ID: <011501d4df04$3147cf80$93d76e80$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdTe9V6YsKNpVE3EQ1ynW7YKwTo35g== Content-Language: en-us X-Originating-IP: [62.168.35.125] Archived-At: Subject: [Emu] Review of draft-ietf-emu-eap-tls13-04 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 10:03:52 -0000 General Comment: I have a strong tendency to like positive rather than negative statements in documents, thus the use of MUST rather than MUST NOT. Additionally, I have a general tendency to like to know what should happen if a statement is violated. Thus consider the following from section 2.1.1: TLS 1.3 introduces early application data; early application data SHALL NOT be used with EAP-TLS. I would prefer to see this as TLS 1.3 introduced early application data; if a server receives a client hello with early application data it MUST abort the handshake with an EAP-Failure. The server MAY generate a TLS-Alert as well. Section 2.1.2 - The following sentence: If the EAP peer did not supply a "key_share" extension when offering resumption, the EAP server needs to reject the ClientHello and the EAP peer needs to restart a full handshake. Appears to state that the key share MUST be provided even though the previous sentence said that it was only a SHOULD. Which is it? Section 2.1.3 - I am having a problem understanding why you have Figure 8 in the system. First, a new session ticket would only be returned if the client asked for one to be returned. Thus the client will never receive one that is unexpected. Secondly, the authentication has finished and you are in a situation where if you had not asked for the ticket everything would be fine. The only possible reason for doing this would be if the client suddenly decided that it no longer wanted the ticket and was going to tell the server that it did not need to cache the information associated with it. However, since this is not a normal flow in TLS that would never happen. If the client decides that it does not want to save the ticket that it received, say because it is too big, then it can just not save it but still have EAP run to success. Section 2.1.4 - an EAP-TLS server MUST treat an empty certificate_list as a terminal condition when client authentication is required. Current text implies it is always true. Section 5.7 para 3 - The term "other authentication information" is confusing to me. You should only be capturing the information from the TLS handshake and nothing else. As an example, I would not expect that the client would do any additional revocation checking when offering to use a session ticket. If the revocation information is not sufficiently current, then the client should not do resumption. But this does not require reevaluation of revocation information or the server certificate chain. A client quite likely to be unable to access a network to check for revocation until after the EAP process has finished and thus would be unable in EAP to do these checks. Section 5.7 para 7 - Current sentence appears to say that the IP address is part of the EAP-Response/Identity. I generally find this entire section confusing and think that a large amount should probably be in the main text and not here. Jim From nobody Thu Mar 21 00:55:42 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A25BB130F3E for ; Thu, 21 Mar 2019 00:55:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=g9K0jawI; dkim=pass (1024-bit key) header.d=ericsson.com header.b=iLj5BDUR Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mh28bFPDJOMA for ; Thu, 21 Mar 2019 00:55:38 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C820130F32 for ; Thu, 21 Mar 2019 00:55:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1553154935; x=1555746935; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=PHWFL6USXpAZg7vrAhsLjRdtR727ABQONwxYR136sU0=; b=g9K0jawIOjkXAxtBxwwKCjB1uzqmNjj91yGAM0f7OUey097uMhV/G49K0/5JAthL l8XTefmCDGbMGdKUlE7mUN7jJQoMBtU276XV+UP40vuuOIYM3BRMsFgG9EaJ4+Kv FNrEUUoeNNViMaM5JnVc+5zQpmPiHjJcB/9UpAy6TYE=; X-AuditID: c1b4fb30-fabff7000000355c-c2-5c934377fe34 Received: from ESESBMB505.ericsson.se (Unknown_Domain [153.88.183.118]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id 6D.0B.13660.773439C5; Thu, 21 Mar 2019 08:55:35 +0100 (CET) Received: from ESESBMR506.ericsson.se (153.88.183.202) by ESESBMB505.ericsson.se (153.88.183.172) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Thu, 21 Mar 2019 08:55:35 +0100 Received: from ESESBMB502.ericsson.se (153.88.183.169) by ESESBMR506.ericsson.se (153.88.183.202) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Thu, 21 Mar 2019 08:55:34 +0100 Received: from EUR02-AM5-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB502.ericsson.se (153.88.183.169) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5 via Frontend Transport; Thu, 21 Mar 2019 08:55:34 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PHWFL6USXpAZg7vrAhsLjRdtR727ABQONwxYR136sU0=; b=iLj5BDURyj+NJS+QTyeHqwB4GtdI175iVA8Jjb8/VZA1y7pjsM08VP2xuRBMPRfHCYjox2l24uaw43iz5P6KEH2QqbDRRLxtEumMu0Z/oHkgXAlo/ZKxPmaNUNT+wLpqtICjeYLUdLDYIgawk2UtN+yBlC7aLp0Fa6LxLTrplAE= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB4427.eurprd07.prod.outlook.com (20.176.167.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1730.13; Thu, 21 Mar 2019 07:55:33 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8%3]) with mapi id 15.20.1730.013; Thu, 21 Mar 2019 07:55:33 +0000 From: John Mattsson To: Jim Schaad , "draft-ietf-emu-eap-tls13@ietf.org" CC: 'EMU WG' Thread-Topic: Review of draft-ietf-emu-eap-tls13-04 Thread-Index: AdTe9V6YsKNpVE3EQ1ynW7YKwTo35gAznhwA Date: Thu, 21 Mar 2019 07:55:32 +0000 Message-ID: <3AED5AFD-8AFD-4A51-A3B7-3029B791E53B@ericsson.com> References: <011501d4df04$3147cf80$93d76e80$@augustcellars.com> In-Reply-To: <011501d4df04$3147cf80$93d76e80$@augustcellars.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 240c2b3e-c9b8-465b-134c-08d6add29873 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB4427; x-ms-traffictypediagnostic: HE1PR07MB4427: authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-microsoft-antispam-prvs: x-forefront-prvs: 0983EAD6B2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(39860400002)(376002)(346002)(396003)(136003)(51914003)(13464003)(199004)(189003)(6506007)(476003)(6512007)(6436002)(11346002)(33656002)(6486002)(53546011)(97736004)(26005)(58126008)(446003)(2616005)(44832011)(186003)(229853002)(36756003)(66066001)(76176011)(82746002)(316002)(110136005)(5660300002)(2501003)(102836004)(105586002)(99286004)(6116002)(6246003)(305945005)(81166006)(81156014)(25786009)(71190400001)(8936002)(86362001)(8676002)(4326008)(68736007)(486006)(106356001)(83716004)(256004)(14444005)(3846002)(2906002)(7736002)(71200400001)(53936002)(14454004)(478600001); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB4427; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:3; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: xqBRFYe06cNTAvoKk3AST1XTQD3UaSkGhtFkD41uR3hfwQCSVAt2wni4qiINADMbq4AaVaBVczjhs2sP7QVZd+Khwlmb5MPXGNNYqLtlTD5tBHJ5QwKtqJuVj7PuYaNZmVZSpxc3xvmMZ5MtL677zvqAKKthxU/s5WgL19XjwoCgcUChNuoOkA8bvzcjwpsP9qKNfcK4XW1y3xgSFZ6TFD/3s9Cx5nYJ0uMiKelZ4ZUo9iyrp5anqD47Rhnu5iI1fbqK+AFk5prbDjVHXNruzaMPZdidtmbKFkP42h0/Je2hvfEMnC0fXR2yi5roZ8t3gWUwr+Iov7SWAsTH1vn9BZguQ2w8IPyti5r+xv2KFkcwsc7LhWXDJKzxKNw2JQZ5G8u41uj60hdsrLbNze9s4yn7N1sGtt0pM2L4+Xq1Dak= Content-Type: text/plain; charset="utf-8" Content-ID: <913A6442905E544191675D5907B59797@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 240c2b3e-c9b8-465b-134c-08d6add29873 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Mar 2019 07:55:33.0338 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB4427 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA02SbUhTYRTHe+692+7MxeNyeZj24rAPibm5LAwylb5I9DKCJGyRM28qTh27 y7IPIZZQmWW6kJllmmalc2lqpmJoovgeipEmpTQwteyDb0Xl2vYU9O13zv9/OP/z8LC01CyQ s8lpJs6YptMrhB6M5cSLjJ3nDxRqVbbJrWFz9npRWLfNyoRVF60KI+noupIiYXRFxQ9KQ8V6 7Evg9MkZnFG5P84jqdFaKTDUHrlQ0tXPZKGaQ9eRmAUcCtn2XsrFUtyFYL7UyR5OXkEwPVYm IoKzKLDIiVBBwdzSIuMqGJxPw9XcYRFRzBTcqh1CpJhCsNr+3D0vxCq415YlvI5Y1hsbwTF/ 3NWmsS/Y898wLt6I1fCt+z5ysTfeBVeeDIgIq6HqWpfbw+Dt0G6ucmeV4AiYL3iPSLwIeDiy 5GYxjoSRMYfbj/AmWO2rocguH5iwl1LkZgwVbcM0YRnMfloTuFiGldBwc4ohfX/ob3/817MZ RkpzEeHDUDdTLHDdCHgcQe/CbRERAuH16EsRWXwKcnKKBKSfAoMDDiFhP7CNl1Nk+LIQHvVU ivKRsvi/gMXON6LxDrC1KAlGw3KLnjj8wZw7LSp2n+8FvRY78wAJniIZz/HxqYlqdTBnTD7D 8+lpwWmcqR45/0pHw09VM5qdiepEmEUKT0lAX4FWKtBl8JmpnQhYWuEtCQ0v1EolCbrMi5wx /bTxnJ7jO5Evyyh8JL+kXlopTtSZuBSOM3DGfyrFiuVZKLvaXxPzoenr8tveoA3ioS2/7StF jTHmV4lKjWcN46hctxi3be8ly7KX4VmQXrw+vrzgc3iHfE517EatlRMHzK1xHxfUE83NR79n t0ZNjoYm37UezIs30Wczx1RtJ/sLVwyNIRpprGVw95c9OM9PJdPwTTE9ZYm+pf6toXfeVSsY PkkXEkgbed0fHIBM1ScDAAA= Archived-At: Subject: Re: [Emu] Review of draft-ietf-emu-eap-tls13-04 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 07:55:41 -0000 VGhhbmtzIGZvciB0aGUgdGhvcm91Z2ggcmV2aWV3IEppbSENCg0K77u/LS0tLS1PcmlnaW5hbCBN ZXNzYWdlLS0tLS0NCkZyb206IEppbSBTY2hhYWQgPGlldGZAYXVndXN0Y2VsbGFycy5jb20+DQpE YXRlOiBXZWRuZXNkYXksIDIwIE1hcmNoIDIwMTkgYXQgMTE6MDMNClRvOiAiZHJhZnQtaWV0Zi1l bXUtZWFwLXRsczEzQGlldGYub3JnIiA8ZHJhZnQtaWV0Zi1lbXUtZWFwLXRsczEzQGlldGYub3Jn Pg0KQ2M6ICdFTVUgV0cnIDxlbXVAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZXZpZXcgb2YgZHJhZnQt aWV0Zi1lbXUtZWFwLXRsczEzLTA0DQpSZXNlbnQtRnJvbTogPGFsaWFzLWJvdW5jZXNAaWV0Zi5v cmc+DQpSZXNlbnQtVG86IEpvaG4gTWF0dHNzb24gPGpvaG4ubWF0dHNzb25AZXJpY3Nzb24uY29t PiwgPG1vaGl0QHBpdWhhLm5ldD4NClJlc2VudC1EYXRlOiBXZWRuZXNkYXksIDIwIE1hcmNoIDIw MTkgYXQgMTE6MDMNCg0KICAgIEdlbmVyYWwgQ29tbWVudDogIEkgaGF2ZSBhIHN0cm9uZyB0ZW5k ZW5jeSB0byBsaWtlIHBvc2l0aXZlIHJhdGhlciB0aGFuDQogICAgbmVnYXRpdmUgc3RhdGVtZW50 cyBpbiBkb2N1bWVudHMsIHRodXMgdGhlIHVzZSBvZiBNVVNUIHJhdGhlciB0aGFuIE1VU1QgTk9U Lg0KICAgIEFkZGl0aW9uYWxseSwgSSBoYXZlIGEgZ2VuZXJhbCB0ZW5kZW5jeSB0byBsaWtlIHRv IGtub3cgd2hhdCBzaG91bGQgaGFwcGVuDQogICAgaWYgYSBzdGF0ZW1lbnQgaXMgdmlvbGF0ZWQu ICBUaHVzIGNvbnNpZGVyIHRoZSBmb2xsb3dpbmcgZnJvbSBzZWN0aW9uIDIuMS4xOg0KDQpBZ3Jl ZSwgaWYgcG9zc2libGUgaXQgaXMgb2Z0ZW4gYmV0dGVyIHdpdGggIk1VU1QiIHN0YXRlbWVudHMg ZGVzY3JpYmluZyB3aGF0IGlzIGhhcHBlbmluZy4gVGhlIGRpc2FkdmFudGFnZSB3aXRoIE1VU1Qg c3RhdGVtZW50cyBhcmUgdGhhdCB0aGV5IHJ1bGUgb3V0IHRoaW5ncyB0aGF0IG1heSBiZSBzcGVj aWZpZWQgaW4gdXBkYXRlcyB0byBSRkMgODQ0Ni4NCg0KICAgIFRMUyAxLjMgaW50cm9kdWNlcyBl YXJseSBhcHBsaWNhdGlvbiBkYXRhOyBlYXJseSBhcHBsaWNhdGlvbiBkYXRhIFNIQUxMIE5PVA0K ICAgIGJlIHVzZWQgd2l0aCBFQVAtVExTLg0KICAgIA0KICAgIEkgd291bGQgcHJlZmVyIHRvIHNl ZSB0aGlzIGFzDQogICAgDQogICAgVExTIDEuMyBpbnRyb2R1Y2VkIGVhcmx5IGFwcGxpY2F0aW9u IGRhdGE7ICBpZiBhIHNlcnZlciByZWNlaXZlcyBhIGNsaWVudA0KICAgIGhlbGxvIHdpdGggZWFy bHkgYXBwbGljYXRpb24gZGF0YSBpdCBNVVNUIGFib3J0IHRoZSBoYW5kc2hha2Ugd2l0aCBhbg0K ICAgIEVBUC1GYWlsdXJlLiAgVGhlIHNlcnZlciBNQVkgZ2VuZXJhdGUgYSBUTFMtQWxlcnQgYXMg d2VsbC4NCg0KSW4gdGhlIGNhc2Ugb2YgZWFybHkgZGF0YSwgU2VjdGlvbiA0LjIuMTAgb2YgUkZD IDg0NDYgc3RhdGVzIHRoYXQgIkEgc2VydmVyIHdoaWNoIHJlY2VpdmVzIGFuICJlYXJseV9kYXRh IiBleHRlbnNpb24gTVVTVCBiZWhhdmUgaW4gb25lIG9mIHRocmVlIHdheXM6Ii4gVGhlIHRocmVl IHdheXMgYXJlOiBpZ25vcmluZyBlYXJseV9kYXRhLCBzZW5kIEhlbGxvUmV0cnlSZXF1ZXN0LCBh bmQgYWNjZXB0aW5nIGVhcmx5X2RhdGEuIA0KDQpBYm9ydGluZyB0aGUgaGFuZHNoYWtlIHdvdWxk IG5vdCBmb2xsb3cgUkZDIDg0NDYsIHNvIEkgZG9uJ3QgdGhpbmsgd2Ugd2FudCB0aGF0LiBJIHdv dWxkIHN1Z2dlc3QgdG8gZm9sbG93IFJGQyA4NDQ2IGFuZCBzcGVjaWZ5IHRoYXQgdGhlIHNlcnZl ciBpZ25vcmUgdGhlIGVhcmx5X2RhdGEgZXh0ZW5zaW9uIG9yIHJlcGxpZXMgd2l0aCBIZWxsb1Jl dHJ5UmVxdWVzdC4gSSBzdWdnZXN0IHdyaXRpbmc6DQoNClRMUyAxLjMgaW50cm9kdWNlZCBlYXJs eSBhcHBsaWNhdGlvbiBkYXRhIHdoaWNoIGlzIG5vdCB1c2VkIGluIEVBUC1UTFMuIEEgc2VydmVy IHdoaWNoIHJlY2VpdmVzIGFuICJlYXJseV9kYXRhIiBleHRlbnNpb24gTVVTVCBpZ25vcmUgdGhl IGV4dGVuc2lvbiBvciByZXNwb25kIHdpdGggYSBIZWxsb1JldHJ5UmVxdWVzdCBhcyBkZXNjcmli ZWQgaW4gU2VjdGlvbiA0LjIuMTAgb2YgUkZDIDg0NDYuDQoNClRoaXMgbWFkZSBtZSByZWFsaXpl IHRoYXQgZHJhZnQtaWV0Zi1lbXUtZWFwLXRsczEzLTA0IGRvZXMgbm90IG1lbnRpb24gSGVsbG9S ZXRyeVJlcXVlc3QgYXQgYWxsLiBJIHRoaW5rIGRyYWZ0LWlldGYtZW11LWVhcC10bHMxMy0wNCBz aG91bGQgbWVudGlvbiBIZWxsb1JldHJ5UmVxdWVzdCBhZGQgYWRkIGEgZmlndXJlIGRlc2NyaWJp bmcgdGhlIG1lc3NhZ2UgZmxvdy4gQWx0ZXJuYXRpdmVseSBzdGF0ZSB0aGF0IEhlbGxvUmV0cnlS ZXF1ZXN0IE1VU1QgTk9UIGJlIHVzZWQgKG9yIHBvc2l0aXZlbHkgdGhhdCB0aGUgc2VydmVyIE1V U1QgcmVzcG9uZCB3aXRoIFNlcnZlckhlbGxvKS4gDQogICAgDQogICAgU2VjdGlvbiAyLjEuMiAt IFRoZSBmb2xsb3dpbmcgc2VudGVuY2U6DQogICAgSWYgdGhlIEVBUCBwZWVyIGRpZCBub3Qgc3Vw cGx5IGEgImtleV9zaGFyZSIgZXh0ZW5zaW9uDQogICAgICAgd2hlbiBvZmZlcmluZyByZXN1bXB0 aW9uLCB0aGUgRUFQIHNlcnZlciBuZWVkcyB0byByZWplY3QgdGhlDQogICAgICAgQ2xpZW50SGVs bG8gYW5kIHRoZSBFQVAgcGVlciBuZWVkcyB0byByZXN0YXJ0IGEgZnVsbCBoYW5kc2hha2UuDQog ICAgDQogICAgQXBwZWFycyB0byBzdGF0ZSB0aGF0IHRoZSBrZXkgc2hhcmUgTVVTVCBiZSBwcm92 aWRlZCBldmVuIHRob3VnaCB0aGUNCiAgICBwcmV2aW91cyBzZW50ZW5jZSBzYWlkIHRoYXQgaXQg d2FzIG9ubHkgYSBTSE9VTEQuICBXaGljaCBpcyBpdD8NCg0KR29vZCBjYXRjaC4gRGVmaW5pdGVs eSBzb21ldGhpbmcgbWlzc2luZyBpbiB0aGF0IHNlbnRlbmNlLiBTaG91bGQgYmUgU0hPVUxEIGZv bGxvd2luZyBSRkMgODQ0Ni4gU3VnZ2VzdGVkIHVwZGF0ZToNCg0KIklmIHRoZSBFQVAgcGVlciBk aWQgbm90IHN1cHBseSBhICJrZXlfc2hhcmUiIGV4dGVuc2lvbiB3aGVuIG9mZmVyaW5nIHJlc3Vt cHRpb24sIGFuIEVBUCBzZXJ2ZXIgZGVjbGluaW5nIHJlc3VtcHRpb24gbmVlZHMgdG8gcmVqZWN0 IHRoZSBDbGllbnRIZWxsbyBhbmQgZm9yY2UgdGhlIEVBUCBwZWVyIHRvIHJlc3RhcnQgYSBmdWxs IGhhbmRzaGFrZS4gIFRoZSBtZXNzYWdlIGZsb3cgaW4gdGhpcyBjYXNlIGlzIGdpdmVuIGJ5IEZp Z3VyZSA0IGZvbGxvd2VkIGJ5IEZpZ3VyZSAxIG9yIEZpZ3VyZSAyLiINCiAgICANCiAgICBTZWN0 aW9uIDIuMS4zIC0gSSBhbSBoYXZpbmcgYSBwcm9ibGVtIHVuZGVyc3RhbmRpbmcgd2h5IHlvdSBo YXZlIEZpZ3VyZSA4IGluDQogICAgdGhlIHN5c3RlbS4NCg0KVGhlcmUgd2FzIGFuIGVhcmxpZXIg Y29tbWVudCBmcm9tIHNvbWVvbmUgcmVxdWVzdGluZyBtb3JlIGZpZ3VyZXMgZGVzY3JpYmluZyBt ZXNzYWdlcyBmbG93cyBmb3IgdmFyaW91cyB1c2UgY2FzZXMgYW5kIGVycm9ycy4NCg0KICAgIEZp cnN0LCBhIG5ldyBzZXNzaW9uIHRpY2tldCB3b3VsZCBvbmx5IGJlIHJldHVybmVkIGlmIHRoZQ0K ICAgIGNsaWVudCBhc2tlZCBmb3Igb25lIHRvIGJlIHJldHVybmVkLiAgVGh1cyB0aGUgY2xpZW50 IHdpbGwgbmV2ZXIgcmVjZWl2ZSBvbmUNCiAgICB0aGF0IGlzIHVuZXhwZWN0ZWQuDQoNClRoYXQg aXMgbm90IG15IHVuZGVyc3RhbmRpbmcgb2YgaG93IE5ld1Nlc3Npb25UaWNrZXQgd29ya3MgYWNj b3JkaW5nIHRvIFJGQyA4NDQ2LiBUaGUgc2Vzc2lvbl90aWNrZXQgZXh0ZW5zaW9uIGlzIGEgZmFy IGFzIEkgdW5kZXJzdGFuZCBkZXByZWNhdGVkIGluIFRMUyAxLjMuIFRoZSBvbmx5IHRleHQgSSBj YW4gZmluZCBpbiBSRkMgODQ0NiBpcyB0aGF0DQoNCiJBdCBhbnkgdGltZSBhZnRlciB0aGUgc2Vy dmVyIGhhcyByZWNlaXZlZCB0aGUgY2xpZW50IEZpbmlzaGVkIG1lc3NhZ2UsIGl0IE1BWSBzZW5k IGEgTmV3U2Vzc2lvblRpY2tldCBtZXNzYWdlLiINCg0KICAgIFNlY29uZGx5LCB0aGUgYXV0aGVu dGljYXRpb24gaGFzIGZpbmlzaGVkIGFuZCB5b3UgYXJlDQogICAgaW4gYSBzaXR1YXRpb24gd2hl cmUgaWYgeW91IGhhZCBub3QgYXNrZWQgZm9yIHRoZSB0aWNrZXQgZXZlcnl0aGluZyB3b3VsZCBi ZQ0KICAgIGZpbmUuICBUaGUgb25seSBwb3NzaWJsZSByZWFzb24gZm9yIGRvaW5nIHRoaXMgd291 bGQgYmUgaWYgdGhlIGNsaWVudA0KICAgIHN1ZGRlbmx5IGRlY2lkZWQgdGhhdCBpdCBubyBsb25n ZXIgd2FudGVkIHRoZSB0aWNrZXQgYW5kIHdhcyBnb2luZyB0byB0ZWxsDQogICAgdGhlIHNlcnZl ciB0aGF0IGl0IGRpZCBub3QgbmVlZCB0byBjYWNoZSB0aGUgaW5mb3JtYXRpb24gYXNzb2NpYXRl ZCB3aXRoIGl0Lg0KICAgIEhvd2V2ZXIsIHNpbmNlIHRoaXMgaXMgbm90IGEgbm9ybWFsIGZsb3cg aW4gVExTIHRoYXQgd291bGQgbmV2ZXIgaGFwcGVuLiAgSWYNCiAgICB0aGUgY2xpZW50IGRlY2lk ZXMgdGhhdCBpdCBkb2VzIG5vdCB3YW50IHRvIHNhdmUgdGhlIHRpY2tldCB0aGF0IGl0DQogICAg cmVjZWl2ZWQsIHNheSBiZWNhdXNlIGl0IGlzIHRvbyBiaWcsIHRoZW4gaXQgY2FuIGp1c3Qgbm90 IHNhdmUgaXQgYnV0IHN0aWxsDQogICAgaGF2ZSBFQVAgcnVuIHRvIHN1Y2Nlc3MuDQoNCkFncmVl IHRoYXQgdGhlIGNsaWVudCBzaG91bGQganVzdCBtb3N0IGxpa2VseSBqdXN0IGlnbm9yZSB0aGUg dGlja2V0LiBMZXQncyByZW1vdmUgdGhlIGZpZ3VyZSBhbmQgdGhlIHRleHQuDQogICAgDQogICAg U2VjdGlvbiAyLjEuNCAtIGFuIEVBUC1UTFMgc2VydmVyIE1VU1QgdHJlYXQgYW4gZW1wdHkgY2Vy dGlmaWNhdGVfbGlzdCBhcyBhDQogICAgdGVybWluYWwgY29uZGl0aW9uIHdoZW4gY2xpZW50IGF1 dGhlbnRpY2F0aW9uIGlzIHJlcXVpcmVkLiAgQ3VycmVudCB0ZXh0DQogICAgaW1wbGllcyBpdCBp cyBhbHdheXMgdHJ1ZS4NCg0KVGhlIHRleHQgaW4gZHJhZnQtaWV0Zi1lbXUtZWFwLXRsczEzLTA0 DQoNCiJGb3IgVExTIDEuMyB0aGlzIG1lYW5zIHRoYXQgdGhlIEVBUC1UTFMgcGVlciBvbmx5IHNl bmRzIGFuIGVtcHR5IGNlcnRpZmljYXRlX2xpc3QgaWYgaXQgZG9lcyBub3QgaGF2ZSBhbiBhcHBy b3ByaWF0ZSBjZXJ0aWZpY2F0ZSB0byBzZW5kLCBhbmQgdGhlIEVBUC1UTFMgc2VydmVyIE1BWSB0 cmVhdCBhbiBlbXB0eSBjZXJ0aWZpY2F0ZV9saXN0IGFzIGEgdGVybWluYWwgY29uZGl0aW9uLiIN Cg0KZm9sbG93cyBTZWN0aW9uIDQuNC4yLjQgb2YgUkZDIDg0NDY6DQoNCiJJZiB0aGUgY2xpZW50 IGRvZXMgbm90IHNlbmQgYW55IGNlcnRpZmljYXRlcyAoaS5lLiwgaXQgc2VuZHMgYW4gZW1wdHkg Q2VydGlmaWNhdGUgbWVzc2FnZSksIHRoZSBzZXJ2ZXIgTUFZIGF0IGl0cyBkaXNjcmV0aW9uIGVp dGhlciBjb250aW51ZSB0aGUgaGFuZHNoYWtlIHdpdGhvdXQgY2xpZW50IGF1dGhlbnRpY2F0aW9u IG9yIGFib3J0IHRoZSBoYW5kc2hha2Ugd2l0aCBhICJjZXJ0aWZpY2F0ZV9yZXF1aXJlZCIgYWxl cnQuIg0KDQpJIGRvIG5vdCB1bmRlcnN0YW5kIHdoYXQgeW91IG1lYW4gd2l0aCAiIEN1cnJlbnQg dGV4dCBpbXBsaWVzIGl0IGlzIGFsd2F5cyB0cnVlLiIgVGhlIHRlcm0gdGVybWluYWwgY29uZGl0 aW9uIGNhbWUgZnJvbSBSRkMgNTIxNi4gU2hvdWxkIEkgcmV3cml0ZSBpdCB3aXRoIHRleHQgZnJv bSBSRkMgODQ0Nj8NCg0KIkZvciBUTFMgMS4zIHRoaXMgbWVhbnMgdGhhdCB0aGUgRUFQLVRMUyBw ZWVyIG9ubHkgc2VuZHMgYW4gZW1wdHkgY2VydGlmaWNhdGVfbGlzdCBpZiBpdCBkb2VzIG5vdCBo YXZlIGFuIGFwcHJvcHJpYXRlIGNlcnRpZmljYXRlIHRvIHNlbmQsIGFuZCB0aGUgRUFQLVRMUyBz ZXJ2ZXIgTUFZIGF0IGl0cyBkaXNjcmV0aW9uIGVpdGhlciBjb250aW51ZSB0aGUgaGFuZHNoYWtl IHdpdGhvdXQgY2xpZW50IGF1dGhlbnRpY2F0aW9uIG9yIGFib3J0IHRoZSBoYW5kc2hha2Ugd2l0 aCBhICJjZXJ0aWZpY2F0ZV9yZXF1aXJlZCIgYWxlcnQuIg0KICAgIA0KICAgIFNlY3Rpb24gNS43 IHBhcmEgMyAtIFRoZSB0ZXJtICJvdGhlciBhdXRoZW50aWNhdGlvbiBpbmZvcm1hdGlvbiIgaXMN CiAgICBjb25mdXNpbmcgdG8gbWUuICBZb3Ugc2hvdWxkIG9ubHkgYmUgY2FwdHVyaW5nIHRoZSBp bmZvcm1hdGlvbiBmcm9tIHRoZSBUTFMNCiAgICBoYW5kc2hha2UgYW5kIG5vdGhpbmcgZWxzZS4N Cg0KSSB0aGluayB0aGUgZ3JvdXAgbmVlZCB0byBkaXNjdXNzIHRoaXMgbW9yZS4gSSB0aGluayBB bGFuJ3Mgc3VnZ2VzdGlvbiB3YXMgdGhhdCB5b3UgY2FwdHVyZSBxdWl0ZSBhIGxvdC4NCg0KICAg IEFzIGFuIGV4YW1wbGUsIEkgd291bGQgbm90IGV4cGVjdCB0aGF0IHRoZQ0KICAgIGNsaWVudCB3 b3VsZCBkbyBhbnkgYWRkaXRpb25hbCByZXZvY2F0aW9uIGNoZWNraW5nIHdoZW4gb2ZmZXJpbmcg dG8gdXNlIGENCiAgICBzZXNzaW9uIHRpY2tldC4gIElmIHRoZSByZXZvY2F0aW9uIGluZm9ybWF0 aW9uIGlzIG5vdCBzdWZmaWNpZW50bHkgY3VycmVudCwNCiAgICB0aGVuIHRoZSBjbGllbnQgc2hv dWxkIG5vdCBkbyByZXN1bXB0aW9uLiAgQnV0IHRoaXMgZG9lcyBub3QgcmVxdWlyZQ0KICAgIHJl ZXZhbHVhdGlvbiBvZiByZXZvY2F0aW9uIGluZm9ybWF0aW9uIG9yIHRoZSBzZXJ2ZXIgY2VydGlm aWNhdGUgY2hhaW4uICBBDQogICAgY2xpZW50IHF1aXRlIGxpa2VseSB0byBiZSB1bmFibGUgdG8g YWNjZXNzIGEgbmV0d29yayB0byBjaGVjayBmb3IgcmV2b2NhdGlvbg0KICAgIHVudGlsIGFmdGVy IHRoZSBFQVAgcHJvY2VzcyBoYXMgZmluaXNoZWQgYW5kIHRodXMgd291bGQgYmUgdW5hYmxlIGlu IEVBUCB0bw0KICAgIGRvIHRoZXNlIGNoZWNrcy4NCg0KVGhhdCBhcmUgdmVyeSBnb29kIHBvaW50 cy4gSSB3aWxsIHVwZGF0ZSB0aGUgdGV4dCBiYXNlZCBvbiB0aGVzZSBzdWdnc3Rpb25zLg0KICAg IA0KICAgIFNlY3Rpb24gNS43IHBhcmEgNyAtIEN1cnJlbnQgc2VudGVuY2UgYXBwZWFycyB0byBz YXkgdGhhdCB0aGUgSVAgYWRkcmVzcyBpcw0KICAgIHBhcnQgb2YgdGhlIEVBUC1SZXNwb25zZS9J ZGVudGl0eS4NCg0KT2ssIGxldCdzIHJlZm9ybXVsYXRlDQoNCkkgZ2VuZXJhbGx5IGZpbmQgdGhp cyBlbnRpcmUgc2VjdGlvbg0KICAgIGNvbmZ1c2luZyBhbmQgdGhpbmsgdGhhdCBhIGxhcmdlIGFt b3VudCBzaG91bGQgcHJvYmFibHkgYmUgaW4gdGhlIG1haW4gdGV4dA0KICAgIGFuZCBub3QgaGVy ZS4NCg0KWWVzLCBtb3Zpbmcgc29tZSBvZiB0aGUgaW5mb3JtYXRpb24gdG8gMi4xLjIgc2VlbXMg dG8gbWFrZSBzZW5zZQ0KDQogICAgSmltDQogICAgDQogICAgDQogICAgDQogICAgDQogICAgDQog ICAgDQogICAgDQogICAgDQogICAgDQogICAgDQoNCg== From nobody Thu Mar 21 02:01:50 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9CB54130DE7; Thu, 21 Mar 2019 02:01:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z5dKm-BbYk_a; Thu, 21 Mar 2019 02:01:45 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3DFA2130F35; Thu, 21 Mar 2019 02:01:45 -0700 (PDT) Received: from Jude (62.168.35.66) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Thu, 21 Mar 2019 02:01:39 -0700 From: Jim Schaad To: 'John Mattsson' , CC: 'EMU WG' References: <011501d4df04$3147cf80$93d76e80$@augustcellars.com> <3AED5AFD-8AFD-4A51-A3B7-3029B791E53B@ericsson.com> In-Reply-To: <3AED5AFD-8AFD-4A51-A3B7-3029B791E53B@ericsson.com> Date: Thu, 21 Mar 2019 10:01:37 +0100 Message-ID: <016c01d4dfc4$b2d785c0$18869140$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQIhkrIfPVRMOISyoFRaNpjc26pRZwGdSmBNpW93JOA= Content-Language: en-us X-Originating-IP: [62.168.35.66] Archived-At: Subject: Re: [Emu] Review of draft-ietf-emu-eap-tls13-04 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 09:01:49 -0000 > -----Original Message----- > From: John Mattsson > Sent: Thursday, March 21, 2019 8:56 AM > To: Jim Schaad ; = draft-ietf-emu-eap-tls13@ietf.org > Cc: 'EMU WG' > Subject: Re: Review of draft-ietf-emu-eap-tls13-04 >=20 > Thanks for the thorough review Jim! >=20 > =EF=BB=BF-----Original Message----- > From: Jim Schaad > Date: Wednesday, 20 March 2019 at 11:03 > To: "draft-ietf-emu-eap-tls13@ietf.org" = > Cc: 'EMU WG' > Subject: Review of draft-ietf-emu-eap-tls13-04 > Resent-From: > Resent-To: John Mattsson , > > Resent-Date: Wednesday, 20 March 2019 at 11:03 >=20 > General Comment: I have a strong tendency to like positive rather = than > negative statements in documents, thus the use of MUST rather than > MUST NOT. > Additionally, I have a general tendency to like to know what = should happen > if a statement is violated. Thus consider the following from = section 2.1.1: >=20 > Agree, if possible it is often better with "MUST" statements = describing what > is happening. The disadvantage with MUST statements are that they rule = out > things that may be specified in updates to RFC 8446. >=20 > TLS 1.3 introduces early application data; early application data = SHALL NOT > be used with EAP-TLS. >=20 > I would prefer to see this as >=20 > TLS 1.3 introduced early application data; if a server receives a = client > hello with early application data it MUST abort the handshake with = an > EAP-Failure. The server MAY generate a TLS-Alert as well. >=20 > In the case of early data, Section 4.2.10 of RFC 8446 states that "A = server > which receives an "early_data" extension MUST behave in one of three > ways:". The three ways are: ignoring early_data, send = HelloRetryRequest, > and accepting early_data. >=20 > Aborting the handshake would not follow RFC 8446, so I don't think we = want > that. I would suggest to follow RFC 8446 and specify that the server = ignore > the early_data extension or replies with HelloRetryRequest. I suggest > writing: >=20 > TLS 1.3 introduced early application data which is not used in = EAP-TLS. A > server which receives an "early_data" extension MUST ignore the = extension > or respond with a HelloRetryRequest as described in Section 4.2.10 of = RFC > 8446. That is better, an additional note that new session tickets MUST NOT = include the early data extension would also be relevant. >=20 > This made me realize that draft-ietf-emu-eap-tls13-04 does not mention > HelloRetryRequest at all. I think draft-ietf-emu-eap-tls13-04 should = mention > HelloRetryRequest add add a figure describing the message flow. > Alternatively state that HelloRetryRequest MUST NOT be used (or = positively > that the server MUST respond with ServerHello). >=20 > Section 2.1.2 - The following sentence: > If the EAP peer did not supply a "key_share" extension > when offering resumption, the EAP server needs to reject the > ClientHello and the EAP peer needs to restart a full handshake. >=20 > Appears to state that the key share MUST be provided even though = the > previous sentence said that it was only a SHOULD. Which is it? >=20 > Good catch. Definitely something missing in that sentence. Should be > SHOULD following RFC 8446. Suggested update: >=20 > "If the EAP peer did not supply a "key_share" extension when offering > resumption, an EAP server declining resumption needs to reject the > ClientHello and force the EAP peer to restart a full handshake. The = message > flow in this case is given by Figure 4 followed by Figure 1 or Figure = 2." Yes better >=20 > Section 2.1.3 - I am having a problem understanding why you have = Figure 8 > in > the system. >=20 > There was an earlier comment from someone requesting more figures > describing messages flows for various use cases and errors. >=20 > First, a new session ticket would only be returned if the > client asked for one to be returned. Thus the client will never = receive one > that is unexpected. >=20 > That is not my understanding of how NewSessionTicket works according = to > RFC 8446. The session_ticket extension is a far as I understand = deprecated in > TLS 1.3. The only text I can find in RFC 8446 is that Oh fudge. Losing the indicator that a client wants this seems to be a = stupid decision on the part of TLS. I guess that I just assumed it = was still there because it was in the past. =20 >=20 > "At any time after the server has received the client Finished = message, it > MAY send a NewSessionTicket message." >=20 > Secondly, the authentication has finished and you are > in a situation where if you had not asked for the ticket = everything would be > fine. The only possible reason for doing this would be if the = client > suddenly decided that it no longer wanted the ticket and was going = to tell > the server that it did not need to cache the information = associated with it. > However, since this is not a normal flow in TLS that would never = happen. If > the client decides that it does not want to save the ticket that = it > received, say because it is too big, then it can just not save it = but still > have EAP run to success. >=20 > Agree that the client should just most likely just ignore the ticket. = Let's > remove the figure and the text. >=20 > Section 2.1.4 - an EAP-TLS server MUST treat an empty = certificate_list as a > terminal condition when client authentication is required. = Current text > implies it is always true. >=20 > The text in draft-ietf-emu-eap-tls13-04 >=20 > "For TLS 1.3 this means that the EAP-TLS peer only sends an empty > certificate_list if it does not have an appropriate certificate to = send, and the > EAP-TLS server MAY treat an empty certificate_list as a terminal = condition." >=20 Right but the first sentence in the paragraph is As the certificate messages in TLS 1.3 are encrypted, there is no need = to send an empty certificate_list ... So both statements are not true. > follows Section 4.4.2.4 of RFC 8446: >=20 > "If the client does not send any certificates (i.e., it sends an empty = Certificate > message), the server MAY at its discretion either continue the = handshake > without client authentication or abort the handshake with a > "certificate_required" alert." >=20 > I do not understand what you mean with " Current text implies it is = always > true." The term terminal condition came from RFC 5216. Should I = rewrite it > with text from RFC 8446? >=20 > "For TLS 1.3 this means that the EAP-TLS peer only sends an empty > certificate_list if it does not have an appropriate certificate to = send, and the > EAP-TLS server MAY at its discretion either continue the handshake = without > client authentication or abort the handshake with a = "certificate_required" > alert." >=20 > Section 5.7 para 3 - The term "other authentication information" = is > confusing to me. You should only be capturing the information = from the > TLS > handshake and nothing else. >=20 > I think the group need to discuss this more. I think Alan's suggestion = was that > you capture quite a lot. Agreed on the discussions Jim >=20 > As an example, I would not expect that the > client would do any additional revocation checking when offering = to use a > session ticket. If the revocation information is not sufficiently = current, > then the client should not do resumption. But this does not = require > reevaluation of revocation information or the server certificate = chain. A > client quite likely to be unable to access a network to check for = revocation > until after the EAP process has finished and thus would be unable = in EAP to > do these checks. >=20 > That are very good points. I will update the text based on these = suggstions. >=20 > Section 5.7 para 7 - Current sentence appears to say that the IP = address is > part of the EAP-Response/Identity. >=20 > Ok, let's reformulate >=20 > I generally find this entire section > confusing and think that a large amount should probably be in the = main > text > and not here. >=20 > Yes, moving some of the information to 2.1.2 seems to make sense >=20 > Jim >=20 >=20 >=20 >=20 >=20 >=20 >=20 >=20 >=20 >=20 From nobody Thu Mar 21 05:14:26 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E04C1128661; Thu, 21 Mar 2019 05:14:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QhH1uIAc8S6o; Thu, 21 Mar 2019 05:14:22 -0700 (PDT) Received: from aer-iport-1.cisco.com (aer-iport-1.cisco.com [173.38.203.51]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ABDE2131050; Thu, 21 Mar 2019 05:14:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5049; q=dns/txt; s=iport; t=1553170462; x=1554380062; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=Rq1x5D1C6WDWV9TCC9vgcsADHteQ/c0smXYpUKz18/Q=; b=UsSPPVxM8846pbi3c+kpBZx8wCxVEg8f/1JmnchjBQ79+x8W64UzB8tp 1nTViRjCFEv2c6UCeUn7zrQJQaNAyoiSfb3h3WYxyYOJhpwj4Bvun/5AY jFzyv4Tvb+KTk+4ZtOK2/eX+PFQNYtoiG7WaBuPMlZDZke9GOCJ8rnBYo Q=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0A2AABff5Nc/xbLJq1jGwEBAQEDAQE?= =?us-ascii?q?BBwMBAQGBVAMBAQELAYEOgm0njQmMTpJAh3INAQGEbAKFFDcGDQEBAwEBCQE?= =?us-ascii?q?DAm0ohUoBAQEDAXQFBQsLDgouVwYTgyKBbgisFYVGhGuBLwGLSIF/gREnH4J?= =?us-ascii?q?MPoQdEYNRgiYDpQcJi2uHTBmLHIhXm0WCcQIEBgUCFYFjIiiBLjMaCBsVZQG?= =?us-ascii?q?CQT6QDj4DMItKAiQHgiABAQ?= X-IronPort-AV: E=Sophos; i="5.60,252,1549929600"; d="scan'208,217"; a="10881788" Received: from aer-iport-nat.cisco.com (HELO aer-core-4.cisco.com) ([173.38.203.22]) by aer-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 21 Mar 2019 12:14:19 +0000 Received: from [10.61.162.28] ([10.61.162.28]) by aer-core-4.cisco.com (8.15.2/8.15.2) with ESMTPS id x2LCEHKA027767 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Thu, 21 Mar 2019 12:14:17 GMT From: Eliot Lear Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_0ADA01D5-F0B0-40DB-92BB-881F555E94CC" Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Thu, 21 Mar 2019 13:14:16 +0100 In-Reply-To: <011501d4df04$3147cf80$93d76e80$@augustcellars.com> Cc: draft-ietf-emu-eap-tls13@ietf.org, EMU WG To: Jim Schaad References: <011501d4df04$3147cf80$93d76e80$@augustcellars.com> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.162.28, [10.61.162.28] X-Outbound-Node: aer-core-4.cisco.com Archived-At: Subject: Re: [Emu] Review of draft-ietf-emu-eap-tls13-04 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 12:14:24 -0000 --Apple-Mail=_0ADA01D5-F0B0-40DB-92BB-881F555E94CC Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi > On 20 Mar 2019, at 11:03, Jim Schaad wrote: >=20 > TLS 1.3 introduced early application data; if a server receives a = client > hello with early application data it MUST abort the handshake with an > EAP-Failure. The server MAY generate a TLS-Alert as well. This precise text actually may have implications for onboarding, where = the notion is to validate the data retrospectively. In particular this = impacts the previous statement: The EAP server MUST authenticate with a = certificate and SHOULD require the EAP peer to authenticate with a = certificate. draft-ietf-anima-bootstrapping-key-infra defers the authentication = during onboaridng stages, which I would expect draft-lear-eap-teap-brski = to do as well. However, the purpose of the deferral is extremely = limited, and the information exchanged must be authenticated in order = for any state generated to be retained. Some eyes on this particular aspect would be useful next week. Eliot= --Apple-Mail=_0ADA01D5-F0B0-40DB-92BB-881F555E94CC Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Hi

On 20 Mar 2019, at 11:03, Jim Schaad <ietf@augustcellars.com> wrote:

TLS 1.3 introduced early = application data;  if a server receives a client
hello with early application = data it MUST abort the handshake with an
EAP-Failure.  The server MAY generate a TLS-Alert as = well.


This precise text = actually may have implications for onboarding, where the notion is to = validate the data retrospectively.  In particular this impacts the = previous statement: The EAP server MUST authenticate with a certificate = and SHOULD require the EAP peer to authenticate with a = certificate.

draft-ietf-anima-bootstrapping-key-infra defers the = authentication during onboaridng stages, which I would expect = draft-lear-eap-teap-brski to do as well.  However, the purpose of = the deferral is extremely limited, and the information exchanged must be = authenticated in order for any state generated to be retained.

Some eyes on this = particular aspect would be useful next week.

Eliot
= --Apple-Mail=_0ADA01D5-F0B0-40DB-92BB-881F555E94CC-- From nobody Sun Mar 24 01:23:47 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38F16127971; Sun, 24 Mar 2019 01:23:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bfeu4-RbW-5H; Sun, 24 Mar 2019 01:23:43 -0700 (PDT) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-eopbgr50084.outbound.protection.outlook.com [40.107.5.84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C5BB01277D8; Sun, 24 Mar 2019 01:23:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=nAQjDp8IG4dHxDwE5/7lSlBtxq77vBIDcBDBoAD0Suo=; b=hLu5jOeg3wgTmVCdtI5Y0X9Bthi2aaukTaNjiZ/6p637UBmPqqInwAknEpdyemJqH9D4Zhl4naeeQPKU52vLgGJztagmLoONmomb/I/2QBQlli4wauWM7KsQu/f0kZxh4elpoU45+J1OimcTi+2r2p8gjEHZ6f4qE4qIcAfesV8= Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com (10.168.98.146) by HE1PR0701MB2794.eurprd07.prod.outlook.com (10.168.189.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1750.14; Sun, 24 Mar 2019 08:23:38 +0000 Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::6877:aa58:3e6:6a4b]) by HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::6877:aa58:3e6:6a4b%5]) with mapi id 15.20.1750.013; Sun, 24 Mar 2019 08:23:38 +0000 From: Mohit Sethi M To: "emu@ietf.org" , "emu-chairs@ietf.org" Thread-Topic: Slides for EMU session @ IETF 104 Thread-Index: AQHU4hrhHTGYLG+ZBEO+RBoBYyAszw== Date: Sun, 24 Mar 2019 08:23:37 +0000 Message-ID: <46ab2a8a-ed6b-7ed4-7ad6-e592e7c46828@ericsson.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 x-originating-ip: [89.166.49.243] x-clientproxiedby: HE1P191CA0017.EURP191.PROD.OUTLOOK.COM (2603:10a6:3:cf::27) To HE1PR0701MB2905.eurprd07.prod.outlook.com (2603:10a6:3:57::18) x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 96a45e69-e527-4274-2bfe-08d6b03203c3 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:HE1PR0701MB2794; x-ms-traffictypediagnostic: HE1PR0701MB2794: authentication-results: spf=none (sender IP is ) smtp.mailfrom=mohit.m.sethi@ericsson.com; x-microsoft-antispam-prvs: x-forefront-prvs: 09860C2161 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(396003)(136003)(376002)(39860400002)(346002)(199004)(189003)(64126003)(81166006)(58126008)(31686004)(478600001)(6512007)(316002)(8676002)(81156014)(25786009)(71200400001)(71190400001)(110136005)(65826007)(6436002)(2906002)(3846002)(97736004)(450100002)(6116002)(5660300002)(99286004)(106356001)(105586002)(8936002)(7736002)(413944005)(68736007)(14454004)(6506007)(386003)(6486002)(486006)(53936002)(256004)(476003)(26005)(2616005)(102836004)(186003)(2501003)(66066001)(65956001)(65806001)(36756003)(4744005)(86362001)(52116002)(31696002)(305945005); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2794; H:HE1PR0701MB2905.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: ymqwTtx4TLdkf319fOce4QDo74Jxq6BTw9Ul6jJK2riHLqEsLL9WKfucY1zbkDB21oXHMj7eyFINHAfmZNS9fFvXYnhlR7Kkwj0Pi9eT0Ls7q9ZCL283UuTUHels3emBOagSymcxgdcMuR9i5yDXWS6Ec5afC+sruQDYuQaezaZruUiIb+S6GYhy21ODJzGGsZ4fd6WjqoXb4pV3FrD6qVcHsKRNfEkDdAFo0J9+IkB1RZ6D2B+3iei0d1f0937FYU4IFeErRHsmvbNldRNCCLb3rJTnY1JMl7K5ubalB1KRE5NejnDvD/cV3a95EVWIS69qtgGT+F6KpHY3rZ+S/m+rGrtxnw8M6tJO/nAxn+AaQqavf4GU0EWbBB/IrfG9U0OOVK49uMYsN46jr0P0yohu0o0nxsGQvlD+JVEOsvI= Content-Type: text/plain; charset="utf-8" Content-ID: <9D8ED02177B84A439350A455378DFD5C@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: 96a45e69-e527-4274-2bfe-08d6b03203c3 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Mar 2019 08:23:38.0842 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2794 Archived-At: Subject: [Emu] Slides for EMU session @ IETF 104 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 08:23:45 -0000 RGVhciBhbGwsDQoNCldlIGhhdmUgYSAyIGhvdXIgc2Vzc2lvbiB0b21vcnJvdyAoTW9uZGF5LCAy NXRoIE1hcmNoKSBtb3JuaW5nIGJldHdlZW4gDQowOTowMC0xMTowMCBpbiByb29tIEJlcmxpbi9C cnVzc2Vscy4NCg0KSWYgeW91IGFyZSBwcmVzZW50aW5nLCBwbGVhc2Ugc2VuZCB1cyB5b3VyIHNs aWRlcyBieSBtaWRuaWdodCB0b25pZ2h0Lg0KDQpJZiB5b3UgaGF2ZSBhbnkgbGFzdCBtaW51dGUg dXBkYXRlcyB0byB0aGUgc2xpZGVzLCB3ZSBjYW4gYWxzbyB0cnkgdG8gDQp1cGxvYWQgbmV3ZXIg dmVyc2lvbnMgdG9tb3Jyb3cgbW9ybmluZyBiZWZvcmUgdGhlIHNlc3Npb24gYmVnaW5zLg0KDQpK b2UgYW5kIE1vaGl0DQoNCg== From nobody Sun Mar 24 04:42:18 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5C36130ECA for ; Sun, 24 Mar 2019 04:42:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mCHuCPpTtS5z for ; Sun, 24 Mar 2019 04:42:14 -0700 (PDT) Received: from p130.piuha.net (p130.piuha.net [IPv6:2001:14b8:1829::130]) by ietfa.amsl.com (Postfix) with ESMTP id 9A29D127817 for ; Sun, 24 Mar 2019 04:42:14 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id 2EA8E6601FA; Sun, 24 Mar 2019 13:42:13 +0200 (EET) Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k_ONjDv35hOs; Sun, 24 Mar 2019 13:42:11 +0200 (EET) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2001:14b8:1829::130]) by p130.piuha.net (Postfix) with ESMTPS id 9CFB8660161; Sun, 24 Mar 2019 13:42:11 +0200 (EET) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Jari Arkko In-Reply-To: <1B155AEF-C12E-4A70-9A45-76B34E4C76F5@ericsson.com> Date: Sun, 24 Mar 2019 12:42:11 +0100 Cc: "emu@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <1B155AEF-C12E-4A70-9A45-76B34E4C76F5@ericsson.com> To: John Mattsson X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [Emu] WGLC for RFC5448bis X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 11:42:17 -0000 Thanks for your review, John. I agree with all the points and will = address them in a new version during the IETF week. Jari From nobody Sun Mar 24 21:59:24 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C591D12031F for ; Sun, 24 Mar 2019 21:59:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DtEBqhig1tSz for ; Sun, 24 Mar 2019 21:59:20 -0700 (PDT) Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-eopbgr130042.outbound.protection.outlook.com [40.107.13.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DA4CF12031B for ; Sun, 24 Mar 2019 21:59:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=O1Ye0lJcKggWBnggmUfgf47Ky9yc0/uaMMfKgOJrvvc=; b=ZUOT5LZNjjmxrc/tuViQu1mjvJS8F7rZzCXAwGUhxYxEvoW2Is0DtH1l7AU2yc7cACqoETbzsXorjgn3nwvQLYMtuwQ8Dnx6nP0WorXK2Em7GqkxhRSUUvmPiR2K+sxjW2wUBCP6IRKzyVHikSvQ91+R54OogaSED/76ko4ujso= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3258.eurprd07.prod.outlook.com (10.170.246.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1750.13; Mon, 25 Mar 2019 04:59:16 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8%3]) with mapi id 15.20.1730.013; Mon, 25 Mar 2019 04:59:16 +0000 From: John Mattsson To: 'EMU WG' Thread-Topic: EAP-TLS 1.3 - Session-Id and extended EAP types Thread-Index: AQHU4sd/izsRm44DbEGtlWuxPfo1kw== Date: Mon, 25 Mar 2019 04:59:15 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 x-originating-ip: [212.24.152.234] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 164aadb3-0f79-42de-7f87-08d6b0dea1a9 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3258; x-ms-traffictypediagnostic: HE1PR07MB3258: x-microsoft-antispam-prvs: x-forefront-prvs: 0987ACA2E2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(376002)(366004)(39860400002)(136003)(346002)(199004)(189003)(44832011)(6916009)(186003)(6512007)(6346003)(102836004)(26005)(86362001)(106356001)(305945005)(97736004)(2906002)(33656002)(82746002)(8936002)(4744005)(6486002)(7736002)(68736007)(5660300002)(6436002)(66066001)(58126008)(25786009)(6116002)(3846002)(6506007)(71200400001)(71190400001)(316002)(256004)(83716004)(8676002)(14454004)(478600001)(486006)(476003)(2616005)(36756003)(105586002)(99286004)(53936002)(81156014)(81166006); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3258; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: UPQ4YfcV/KRXlXAHlgRNn6/8QG8zZhcrN0RCVYnbSpj6paEtmz4QOtn+SlTybfy5gnfVwC991DMkAb8JUU1zXdJb71UwSyBn/su4g+qVzFMLkcfhIxnzqkBvFWyzkW8M+Gs4AnkeZ8mXVTmm+ndzuWGTCk+qrmTvcvmUoDqodZjAOObfaSBeGIzaCLe4B2JzgQ+kLCIe1gcSqydWrWvPcHYMsXiqK+Zkrc1EsvD06iTrv1xQG9ldHSoO8BfnoBqQIBN4sqKdu4x/vj7j7ZsS0S8tan7oO0i8S1OTXkEBXb5jKJb47Bx0xLMsJPmeUosvoeZryMA8MjIEKdHf6BdYrhUkePgMY1BbTm0FKJpV/2CxY1mN+Zxu+qaxBtD1X96vtmUE6ty8v2kHGgmH+KQdvmcjlXCUN16qe0EwnnBHsqA= Content-Type: text/plain; charset="utf-8" Content-ID: <95887E943B58944EB22F7127B5D41D91@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: 164aadb3-0f79-42de-7f87-08d6b0dea1a9 X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Mar 2019 04:59:15.9341 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3258 Archived-At: Subject: [Emu] EAP-TLS 1.3 - Session-Id and extended EAP types X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 04:59:22 -0000 Tm90aWNlZCB0aGUgZm9sbG93aW5nOg0KDQogZHJhZnQtaWV0Zi1lbXUtZWFwLXRsczEzLTA0IGRl ZmluZXMgdGhlIGtleSBoaWVyYXJjaHkgYXMNCg0KICAgVHlwZS1Db2RlICAgID0gMHgwRA0KICAg S2V5X01hdGVyaWFsID0gVExTLUV4cG9ydGVyKCJFWFBPUlRFUl9FQVBfVExTX0tleV9NYXRlcmlh bCIsDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVHlwZS1Db2RlLCAxMjgpDQogICBJ ViAgICAgICAgICAgPSBUTFMtRXhwb3J0ZXIoIkVYUE9SVEVSX0VBUF9UTFNfSVYiLA0KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIFR5cGUtQ29kZSwgNjQpDQogICBNZXRob2QtSWQgICAg PSBUTFMtRXhwb3J0ZXIoIkVYUE9SVEVSX0VBUF9UTFNfTWV0aG9kLUlkIiwNCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBUeXBlLUNvZGUsIDY0KQ0KICAgU2Vzc2lvbi1JZCAgID0gVHlw ZS1Db2RlIHx8IE1ldGhvZC1JZA0KDQpCdXQgc2VjdGlvbiAxLjQgb2YgUkZDIDUyNDcgZGVmaW5l cyBTZXNzaW9uLUlkIGFzIA0KDQogICBTZXNzaW9uLUlkID0gVHlwZS1Db2RlIHx8IE1ldGhvZC1J ZA0KDQogICBvcg0KDQogICBTZXNzaW9uLUlkID0gMHhGRSB8fCBWZW5kb3ItSWQgfHwgVmVuZG9y LVR5cGUgfHwgTWV0aG9kLUlkDQoNClRoZSBkZWZpbml0aW9uIGluIGRyYWZ0LWlldGYtZW11LWVh cC10bHMxMy0wNCBkb2VzIG5vdCBzZWVtIGNvbXBhdGlibGUgd2l0aCAgZXh0ZW5kZWQgRUFQIHR5 cGVzLg0KDQo= From nobody Sun Mar 24 22:22:18 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BA0F1202DE for ; Sun, 24 Mar 2019 22:22:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lH3Nu-RxYxUV for ; Sun, 24 Mar 2019 22:22:14 -0700 (PDT) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40052.outbound.protection.outlook.com [40.107.4.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EEFC81202B4 for ; Sun, 24 Mar 2019 22:22:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PVsNnsXUXMjHS8FrDNr6ah3ezUfXE+nK54yYkdlG+lI=; b=GvVgXzgNpURvCtXgTVwGtEL9FBho4jBug3faBi7XDTPW2hY0VaTd0R7yH7u3jMgRdi57zrTaByM4zUDGHirwYWFMH62Cfr9cqMgKJTcJ1MAmqkGm8Tx6uo7im01pqJwQdVnBEAhCCkGtxXinmVNTJxZO+1urFKyZLvZW5dIxN3c= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3084.eurprd07.prod.outlook.com (10.170.244.158) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1750.13; Mon, 25 Mar 2019 05:22:11 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8%3]) with mapi id 15.20.1730.013; Mon, 25 Mar 2019 05:22:11 +0000 From: John Mattsson To: 'EMU WG' Thread-Topic: [Emu] Review of draft-ietf-emu-eap-tls13-04 Thread-Index: AQHU4sqyLf6Mnda+e0yP3dfNRjixOQ== Date: Mon, 25 Mar 2019 05:22:11 +0000 Message-ID: <94BDD095-8F91-43CD-90CC-3AADBD74AC08@ericsson.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [212.24.152.234] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ed3006e9-8538-41f9-886c-08d6b0e1d597 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3084; x-ms-traffictypediagnostic: HE1PR07MB3084: x-microsoft-antispam-prvs: x-forefront-prvs: 0987ACA2E2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(346002)(396003)(376002)(136003)(39860400002)(189003)(199004)(2906002)(58126008)(82746002)(6436002)(6916009)(486006)(26005)(105586002)(68736007)(81156014)(81166006)(8676002)(186003)(97736004)(102836004)(256004)(33656002)(6246003)(36756003)(8936002)(86362001)(106356001)(5660300002)(6506007)(25786009)(305945005)(6512007)(316002)(2616005)(53936002)(3846002)(66066001)(6116002)(476003)(478600001)(229853002)(14454004)(44832011)(71190400001)(71200400001)(99286004)(83716004)(6486002)(7736002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3084; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Um+JB64wQqA+Ba1BEQO1M8PMD2dwE30FvImlz/8zT5x57hHD+RB5UuLostJAidnwQTxUvGXPgZS7tO21S5Ba0WFWyET4x2cVYmgx8iwxrNA+ECzUbGSneryA3S9Ze1Bq8wX5IhytSv0ooNTKY3BLRzi4biYPUz4u7DJPgwm6f1o3tJBSSEQ42yr7cCPfwzHE+OPNg5Tmj4xeRnjU02pGkIdLsHVD63T8P4maFhLfJe9JNuJwp02Bu4pi7kQTEVfl+RQHLiSWS/9c3Yj+91DBWIrltYZ/cdl+oHlu4+z4Mn55a5SLdG8jgzLO5rFmjKF8opBBDuCpT/yUpvC246AGpv2HFfnDdDCT5qQO0nAP1r59eIf8S4AvzazCRruCMNxS9IK0lz4vaDkGWIfMeMiF2cuEShQPPKpH0BCrCmHCIiY= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: ed3006e9-8538-41f9-886c-08d6b0e1d597 X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Mar 2019 05:22:11.5600 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3084 Archived-At: Subject: Re: [Emu] Review of draft-ietf-emu-eap-tls13-04 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 05:22:16 -0000 SmltIFNjaGFhZCB3cm90ZToNCg0KPj4gSSBzdWdnZXN0IHdyaXRpbmc6DQo+PiANCj4+IFRMUyAx LjMgaW50cm9kdWNlZCBlYXJseSBhcHBsaWNhdGlvbiBkYXRhIHdoaWNoIGlzIG5vdCB1c2VkIGlu IEVBUC1UTFMuIEENCj4+IHNlcnZlciB3aGljaCByZWNlaXZlcyBhbiAiZWFybHlfZGF0YSIgZXh0 ZW5zaW9uIE1VU1QgaWdub3JlIHRoZSBleHRlbnNpb24NCj4+IG9yIHJlc3BvbmQgd2l0aCBhIEhl bGxvUmV0cnlSZXF1ZXN0IGFzIGRlc2NyaWJlZCBpbiBTZWN0aW9uIDQuMi4xMCBvZiBSRkMNCj4+ IDg0NDYuDQo+DQo+IFRoYXQgaXMgYmV0dGVyLCBhbiBhZGRpdGlvbmFsIG5vdGUgdGhhdCBuZXcg c2Vzc2lvbiB0aWNrZXRzIE1VU1QgTk9UIGluY2x1ZGUgdGhlIGVhcmx5IGRhdGEgZXh0ZW5zaW9u IHdvdWxkIGFsc28gYmUgcmVsZXZhbnQuDQoNCkkgZG9uJ3QgdGhpbmsgdGhpcyBzZW50ZW5jZSB3 b3Jrcy4uLiBhY2NvcmRpbmcgdG8gRmlndXJlIDMgb2YgUkZDIDg0NDYsIHRoZSBUTFMgc2VydmVy IChidXQgbm90IHRoZSBUTFMgY2xpZW50KSBjYW4gc2VuZCBlYXJseSBkYXRhIGV2ZW4gaWYgdGhl IGNsaWVudCBkaWQgbm90IHByb3ZpZGUgYSBlYXJseV9kYXRhIGV4dGVuc2lvbi4gVGhlIHRleHQg aW4gUkZDIDg0NDYgc2F5cyB2ZXJ5IGxpdHRsZSBhYm91dCB0aGUgW0FwcGxpY2F0aW9uIERhdGEq XSBmcm9tIHRoZSBUTFMgc2VydmVyLi4uLg0KDQogICAgICAgICAgQ2xpZW50ICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBTZXJ2ZXINCg0KICAgSW5pdGlhbCBI YW5kc2hha2U6DQogICAgICAgICAgQ2xpZW50SGVsbG8NCiAgICAgICAgICArIGtleV9zaGFyZSAg ICAgICAgICAgICAgIC0tLS0tLS0tPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIFNlcnZlckhlbGxvDQogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKyBrZXlfc2hhcmUNCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHtFbmNyeXB0ZWRFeHRl bnNpb25zfQ0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg e0NlcnRpZmljYXRlUmVxdWVzdCp9DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAge0NlcnRpZmljYXRlKn0NCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB7Q2VydGlmaWNhdGVWZXJpZnkqfQ0KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB7Rmlu aXNoZWR9DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8LS0tLS0tLS0gICAg IFtBcHBsaWNhdGlvbiBEYXRhKl0NCiAgICAgICAgICB7Q2VydGlmaWNhdGUqfQ0KICAgICAgICAg IHtDZXJ0aWZpY2F0ZVZlcmlmeSp9DQogICAgICAgICAge0ZpbmlzaGVkfSAgICAgICAgICAgICAg ICAtLS0tLS0tLT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwtLS0tLS0t LSAgICAgIFtOZXdTZXNzaW9uVGlja2V0XQ0KICAgICAgICAgIFtBcHBsaWNhdGlvbiBEYXRhXSAg ICAgICAgPC0tLS0tLS0+ICAgICAgW0FwcGxpY2F0aW9uIERhdGFdDQogDQoNCg0KDQo= From nobody Mon Mar 25 01:26:03 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 737BE120373 for ; Mon, 25 Mar 2019 01:26:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GLgrLusV-yWJ for ; Mon, 25 Mar 2019 01:25:59 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 28B85120370 for ; Mon, 25 Mar 2019 01:25:58 -0700 (PDT) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 6B8D6713; Mon, 25 Mar 2019 08:25:57 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Alan DeKok In-Reply-To: Date: Mon, 25 Mar 2019 04:25:55 -0400 Cc: EMU WG Content-Transfer-Encoding: quoted-printable Message-Id: <3466C871-C85B-4AD2-AD24-925B592E7063@deployingradius.com> References: To: John Mattsson X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Emu] EAP-TLS 1.3 - Session-Id and extended EAP types X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 08:26:01 -0000 On Mar 25, 2019, at 12:59 AM, John Mattsson = wrote: >=20 > Noticed the following: >=20 > draft-ietf-emu-eap-tls13-04 defines the key hierarchy as >=20 > Type-Code =3D 0x0D > Key_Material =3D TLS-Exporter("EXPORTER_EAP_TLS_Key_Material", > Type-Code, 128) > IV =3D TLS-Exporter("EXPORTER_EAP_TLS_IV", > Type-Code, 64) > Method-Id =3D TLS-Exporter("EXPORTER_EAP_TLS_Method-Id", > Type-Code, 64) > Session-Id =3D Type-Code || Method-Id >=20 > But section 1.4 of RFC 5247 defines Session-Id as=20 >=20 > Session-Id =3D Type-Code || Method-Id >=20 > or >=20 > Session-Id =3D 0xFE || Vendor-Id || Vendor-Type || Method-Id >=20 > The definition in draft-ietf-emu-eap-tls13-04 does not seem compatible = with extended EAP types. TBH, the simple approach is to extend the definition of Type-Code when = extended types are used. Type-Code =3D 0x0d=20 for types < 254 Type-Code =3D 0xFE || Vendor-Id || Vendor-Type for extended types And then use that definition for Key_Material, Method-Id, Session-Id, = etc. Alan DeKok. From nobody Mon Mar 25 02:36:49 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2ECD81203C0 for ; Mon, 25 Mar 2019 02:36:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4FM_N1zN3PqP for ; Mon, 25 Mar 2019 02:36:38 -0700 (PDT) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-eopbgr140080.outbound.protection.outlook.com [40.107.14.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E375B1203CF for ; Mon, 25 Mar 2019 02:36:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=SVRsPK4KS8qG2tPgVwzkFXLsrjaR3sdVauAjcH5y0HQ=; b=UeNpnwTq9OAvLVc5H4imE8PcJNtk/kfWSN2UgKaf8tpCnzkrekBXcgl1Pm79lpHCdEv0otvReSskhekJvF59XrV/VM5TGNRCjz4Wz02lBi0MGPctyq9D+Twi1D+2TWCmFsBXWWuRkGHiEuNatbWiIYMqCvxy4tqyQ5ifrNNH9ok= Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3083.eurprd07.prod.outlook.com (10.170.244.157) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1750.14; Mon, 25 Mar 2019 09:36:35 +0000 Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::ace2:9258:766:85a8%3]) with mapi id 15.20.1730.013; Mon, 25 Mar 2019 09:36:35 +0000 From: John Mattsson To: 'EMU WG' Thread-Topic: TLS Resumption across Server Name Indications for TLS 1.3 Thread-Index: AQHU4u48CJ239dHpr0yJ8MNwg4Qjsw== Date: Mon, 25 Mar 2019 09:36:35 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [2001:67c:370:128:7973:98a8:af09:12f1] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: eceb1a63-0d11-4e22-ada1-08d6b1055f51 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3083; x-ms-traffictypediagnostic: HE1PR07MB3083: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-forefront-prvs: 0987ACA2E2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(39860400002)(136003)(346002)(366004)(376002)(199004)(189003)(8936002)(478600001)(7736002)(305945005)(2616005)(476003)(99286004)(966005)(102836004)(6506007)(6436002)(36756003)(97736004)(58126008)(81166006)(81156014)(558084003)(6486002)(316002)(25786009)(46003)(33656002)(486006)(105586002)(86362001)(106356001)(8676002)(256004)(44832011)(14454004)(53936002)(83716004)(71200400001)(71190400001)(6306002)(82746002)(68736007)(6116002)(5660300002)(6916009)(186003)(6512007)(2906002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3083; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: WPB36qaZ2ElRssq7CFCNahfUd1k3rlgXdwNzFylQw9A5yUju9QHYDHiemARHfJYMaY36D7i0w7uTiHo0B6WbBS4I2NL2+FOWQdCFd6SoeZ/ATXoi1gr4etqMSxq9EgvggYtlolQBkidzLC/Z1klRhV7257jKl7dQjHj6EyWAcwBJW84EMeWwhRWSnUZ+JjYAP3jl/TYhDjYI70tNlZAQdarp1iBMQ67tuFtMqOSMq6TAH8RHSRvTXpeVBW3lF2/e5FQCcbtE76sO0LLx/vVEbA7o0mK6zPVL93JY2iyMY6Ch9qiGxWJVSkggbzLY3DM0cZkHgxio5izau7O/aheqiZs79QszanzeHUBduYb80hBpp2fANb/jfTtCzi0OCGZgjO7tbK13hH5Tp4vIvMawSsOwSLz9gyr00LTEGmf7PNA= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: eceb1a63-0d11-4e22-ada1-08d6b1055f51 X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Mar 2019 09:36:35.0264 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3083 Archived-At: Subject: [Emu] TLS Resumption across Server Name Indications for TLS 1.3 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 09:36:49 -0000 aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXN5LXRscy1yZXN1bXB0aW9uLWdyb3Vw DQoNClRoaXMgZG9jdW1lbnQgd2lsbCBiZSBkaXNjdXNzZWQgdG9kYXkgaW4gdGhlIFRMUyBXRyAx MS4yMCAtIDEyLjIwLiBNaWdodCBiZSBpbnRlcmVzdGluZyBmb3IgdGhlIGRpc2N1c3Npb24gb24g Y3Jvc3MgbWV0aG9kIHJlc3VtcHRpb24gZm9yIFRMUy1iYXNlZCBFQVAgbWV0aG9kcy4NCg0KQ2hl ZXJzLA0KSm9obg0KDQoNCg0K From nobody Mon Mar 25 02:50:31 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DCDD712037B for ; Mon, 25 Mar 2019 02:50:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4N5VtmHNpf5N for ; Mon, 25 Mar 2019 02:50:27 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 32B8512014F for ; Mon, 25 Mar 2019 02:50:27 -0700 (PDT) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id D6C6D63C; Mon, 25 Mar 2019 09:50:25 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Alan DeKok In-Reply-To: Date: Mon, 25 Mar 2019 05:50:24 -0400 Cc: EMU WG Content-Transfer-Encoding: quoted-printable Message-Id: <2765961A-DC4E-4776-A869-C52FC7856BE2@deployingradius.com> References: To: John Mattsson X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Emu] TLS Resumption across Server Name Indications for TLS 1.3 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 09:50:30 -0000 On Mar 25, 2019, at 5:36 AM, John Mattsson = wrote: >=20 > https://tools.ietf.org/html/draft-sy-tls-resumption-group >=20 > This document will be discussed today in the TLS WG 11.20 - 12.20. = Might be interesting for the discussion on cross method resumption for = TLS-based EAP methods. I took a quick look. It is related. It addresses a problem people = have been ignoring in EAP-TLS implementations. :( i.e. high load systems sometimes require multiple servers for = load-balancing. Right now, the common practice is to just copy the = server certificate to each machine. That works, but it's imperfect. This draft would allow each server to have it's own certificate, while = still allowing resumption across different servers. It may be worth discussing the issues EMU has been having, too. e.g. = There's nothing *in principle* that prevents a client from = authenticating via EAP-TLS, and then using that TLS data to "resume" an = HTTPS connection. That may be surprising to people. Alan DeKok. From nobody Mon Mar 25 03:05:28 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5202C120385; Mon, 25 Mar 2019 03:05:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.502 X-Spam-Level: X-Spam-Status: No, score=-14.502 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TWwAxHvi8h_3; Mon, 25 Mar 2019 03:05:26 -0700 (PDT) Received: from aer-iport-2.cisco.com (aer-iport-2.cisco.com [173.38.203.52]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A313D12037F; Mon, 25 Mar 2019 03:05:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=387; q=dns/txt; s=iport; t=1553508326; x=1554717926; h=from:content-transfer-encoding:mime-version:subject: message-id:date:to; bh=EeJHiE4E0Z2X8nLCvEFJnACAxPZnyp+GUUhAlBykaNs=; b=gN5q4LEaI+e6aco4/mYElGlWnOTbZBhSq7ofIy3l9RyhZ5m2s4G4yMLc y2iILMK5Yz1ayKLozI9AWhWjjon6xSwtq9q6gYyiqYVigwSc9sfApWnaS YONiGr5kMctLl9qrCY3bhH/9iphxzQMty2SJxzRrccLFZNkOtw1CQ+PgC w=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ASAAAEp5hc/xbLJq1jGwEBAQEDAQE?= =?us-ascii?q?BBwMBAQGBUgUBAQELAYIQRXMhEoQ1iHulCIF7DQEBihs1CA0BAQMBAQkBAwJ?= =?us-ascii?q?tKIV0gQsCJgJfAYM0gXatfYEvhUaEYoELJAGLSIF/gTgfgh6IOjGCJgOlFgm?= =?us-ascii?q?CAZE4GYFyAZILixyQOIJyAgQGBQIVgU8BNYFWMxoIGxVlAYJCPZAOPgOQAwE?= =?us-ascii?q?B?= X-IronPort-AV: E=Sophos;i="5.60,256,1549929600"; d="scan'208";a="10949457" Received: from aer-iport-nat.cisco.com (HELO aer-core-3.cisco.com) ([173.38.203.22]) by aer-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 25 Mar 2019 10:05:23 +0000 Received: from dhcp-10-61-105-142.cisco.com (dhcp-10-61-105-142.cisco.com [10.61.105.142]) by aer-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id x2PA5NC7018221 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 25 Mar 2019 10:05:23 GMT From: Eliot Lear Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Message-Id: <52A21066-ACB8-40D5-8C3F-D376CDD26BF2@cisco.com> Date: Mon, 25 Mar 2019 11:05:22 +0100 To: EMU WG , IETF X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.105.142, dhcp-10-61-105-142.cisco.com X-Outbound-Node: aer-core-3.cisco.com Archived-At: Subject: [Emu] Another side meeting on IOT onboarding X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 10:05:27 -0000 For those who are interested, we will be continuing our IoT Onboarding = discussion Wednesday @ 2:00pm in Karlin 3. Topics will include review = of the various onboarding mechanisms that we listed on Github, review of = the questions we were asking, some live editing of THAT, and some = mapping of all of the various BRSKI-related work. There=E2=80=99s a lot = of it. Eliot= From nobody Mon Mar 25 06:27:07 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 19AF11203FD for ; Mon, 25 Mar 2019 06:27:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.749 X-Spam-Level: X-Spam-Status: No, score=-1.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PJWyYnihf73j for ; Mon, 25 Mar 2019 06:27:03 -0700 (PDT) Received: from mail-lf1-x12c.google.com (mail-lf1-x12c.google.com [IPv6:2a00:1450:4864:20::12c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A93F1203F0 for ; Mon, 25 Mar 2019 06:27:02 -0700 (PDT) Received: by mail-lf1-x12c.google.com with SMTP id b7so1430355lfg.9 for ; Mon, 25 Mar 2019 06:27:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=5B3JdSuSFGU3asDWkiD8ZbRZhKesUFI1P8d7rf52z4s=; b=AdHqA6q0L59HWox0apvZZA1L7B3ndmxplnzd7YUz2zkYBgim42FYPYJFMeqtE6VnZU rRVTWwySTl3HTZZKvvJflfpkOvzM6nU9xk1CedT+BpMzQRIYTQU5WeSDEiKzw4F2n/ND jlLyTp5vm0l9WS7BiknmlBzn1pQK9kXgFLeUi/mXUyWCD1ptaXs9tEmosrhuH+wvNGAP B/A7QtEw/teril5ZmcZ41Ojf9US1nSPled81oGeqdmaA3xdMNYPzgZaZt8FJ8r4vlai3 os+DpjmwXBY3e/bvygIDQZrdr5dE3uIa3uK/47VcBzy7WW0wArpB3OPblVlJVuBGXs7L 9ImQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=5B3JdSuSFGU3asDWkiD8ZbRZhKesUFI1P8d7rf52z4s=; b=QHw/oup7ibpKWh1D6ypRTNccE4fWxbu/zC8ntfDcC10oLhl2Gro/Pm9ggPeloErj0p maCAHFqKTJzTUZ1v//ygW2MvlRuwHGy68qQ0qTYiWntzkSMkjvSpH4rIFXuv8qVZG/zt a+/YDqr9mZwPeYJVs5aZ+UOw4pLeJjJ4grZHiPMStep7+k4hlocxmO8UCZjaO2cA6b3I ZOBVNDYl5k35a3hxvkLy+ma5l+uh6zFbTcDzMY8yggjp1BxrPSUu622s2Vo9MpXJc/Xm Cx2NjS51dHZFfPih+69TM32q2+QtQdQGjGnlxAi9l9IEO5Qk1PvwRC1OFu9LK40ZT5T7 OHiA== X-Gm-Message-State: APjAAAVctfxSAFeWuOjv0XZ6yQFsMXwjJ/nQpzoxtzOg3qiyVRXiqR5W sa1Ou21UFRpYfkzqpc2S1W9EULe64vDVh2A4eYcznqZm5s0= X-Google-Smtp-Source: APXvYqzmGMr/DpWNkFtR2pzFaCbDSaYqlmtoV7BORoDAtVhxDVtDL5rAMjDEkpnNx5Zy8v9qoVQ70KPobAn+2GqIR0E= X-Received: by 2002:ac2:4554:: with SMTP id j20mr12125483lfm.112.1553520418909; Mon, 25 Mar 2019 06:26:58 -0700 (PDT) MIME-Version: 1.0 From: Oleg Pekar Date: Mon, 25 Mar 2019 15:26:48 +0200 Message-ID: To: emu@ietf.org Content-Type: multipart/alternative; boundary="000000000000b873900584eb28e5" Archived-At: Subject: [Emu] Query about two types of TEAP TLS session resume X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 13:27:05 -0000 --000000000000b873900584eb28e5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, I have several questions about TEAP TLS session resume since I am not sure I succeeded to interpret the relevant sections of RFC 7170 and RFC 5077 correctly. 1) Does it make sense for TEAP server to support both TLS session resume using server state and TLS session resume using PAC? Should the server have an explicit configuration of which type of session resume it supports? In EAP-FAST there was a dedicated stage of PAC provisioning (Phase 0) that typically ended with PAC provisioning to the client inside the tunnel. However TEAP RFC says that PAC should be provisioned either as TLS session ticket after client sent empty TLS SessionTicket extension or in Phase 2 after client requested a PAC in Request-Action TLV + PAC TLV. So in TEAP PAC provisioning is always initiated by the client. This gives the server a chance to presume that if the client didn=E2=80=99t ask for PAC - it doesn= =E2=80=99t support PACs and thus the server should save TLS state of this conversation in its memory for subsequent TLS session resume using server state. 2) Should it be a restriction for the total time of TLS session resume using PAC as it exists for TLS session resume using server state? RFC 5077 says that if the conversation was resumed using SessionTicket then the server can provide a new SessionTicket. Every SessionTicket has its lifetime restriction but the total time of sequential conversations that apply TLS session resume using SessionTicket (PAC) is not restricted. I.e. there is no requirement to conduct a full TLS handshake once per specific time interval. Doesn=E2=80=99t it create a security issue? Or is it totally= on client's responsibility to conduct a full TLS handshake once per specific time so the client can verify TLS server's certificate? 3) TEAP RFC says: "If the PAC-Opaque included in the SessionTicket extension is valid and the EAP server permits the abbreviated TLS handshake, it will select the ciphersuite from information within the PAC-Opaque and finish with the abbreviated TLS handshake." What is the reason for storing ciphersuite in the PAC and using it in TLS session resume using PAC, if server can anyway control the ciphersuites to eliminate weak cipher usage? Thank you in advance for your answers, Oleg --000000000000b873900584eb28e5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Hi,=C2=A0

I have severa= l questions about TEAP TLS session resume since I am not sure I succeeded t= o interpret the relevant sections of RFC 7170 and RFC 5077 correctly.


1) Does it make sense for TEAP server to support both TLS session resume= using server state and TLS session resume using PAC? Should the server hav= e an explicit configuration of which type of session resume it supports? In= EAP-FAST there was a dedicated stage of PAC provisioning (Phase 0) that ty= pically ended with PAC provisioning to the client inside the tunnel. Howeve= r TEAP RFC says that PAC should be provisioned either as TLS session ticket= after client sent empty TLS SessionTicket extension or in Phase 2 after cl= ient requested a PAC in Request-Action TLV + PAC TLV. So in TEAP PAC provis= ioning is always initiated by the client. This gives the server a chance to= presume that if the client didn=E2=80=99t ask for PAC - it doesn=E2=80=99t= support PACs and thus the server should save TLS state of this conversatio= n in its memory for subsequent TLS session resume using server state.


2) Should it be a restriction for the total time of TLS session resume u= sing PAC as it exists for TLS session resume using server state? RFC 5077 s= ays that if the conversation was resumed using SessionTicket then the serve= r can provide a new SessionTicket. Every SessionTicket has its lifetime res= triction but the total time of sequential conversations that apply TLS sess= ion resume using SessionTicket (PAC) is not restricted. I.e. there is no re= quirement to conduct a full TLS handshake once per specific time interval. = Doesn=E2=80=99t it create a security issue? Or is it totally on client'= s responsibility to conduct a full TLS handshake once per specific time so = the client can verify TLS server's certificate?


3) TEAP RFC say= s: "If = the PAC-Opaque included in the

=C2=A0 =C2=A0SessionTicket extension is valid and the E= AP server permits the

=C2=A0 =C2=A0abbreviated TLS handshake, it will select the ciphe= rsuite from

=C2=A0 =C2=A0information within the PAC-Opaque and finish with the abbrevi= ated TLS

= =C2=A0 =C2=A0handshake."


What is the reason for storing ciphersuite in the PAC and usi= ng it in TLS session resume using PAC, if server can anyway control the cip= hersuites to eliminate weak cipher usage?

=

Thank you in advance for your answers,

Oleg

=
--000000000000b873900584eb28e5-- From nobody Fri Mar 29 02:40:49 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E64F512026C for ; Fri, 29 Mar 2019 02:40:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E35iGNvZWdS9 for ; Fri, 29 Mar 2019 02:40:45 -0700 (PDT) Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-eopbgr130051.outbound.protection.outlook.com [40.107.13.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B6CA012012B for ; Fri, 29 Mar 2019 02:40:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ckqe6HH37z4L3M+MMZnQcs+KeEj1nYop+HoPhb8AP0M=; b=ivFC9xVR2nOEKUY3ctwzn4/wldHreGSxEdY5IsEB+4brnnBuSqY0QpWg/ix4/lF3w5MOQNeDk6AnAvFqyjkGFs3jTIjiDy4QxgDcWM8hFJElISRr5aOFUHD+ZKLOrJAZcJlQvOs/4AgbD39o/HwusTifKisw478ObpBY9MWuV00= Received: from VI1PR07MB4175.eurprd07.prod.outlook.com (20.176.6.24) by VI1PR07MB5614.eurprd07.prod.outlook.com (20.178.80.91) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1771.8; Fri, 29 Mar 2019 09:40:41 +0000 Received: from VI1PR07MB4175.eurprd07.prod.outlook.com ([fe80::5424:92d0:ef7:e047]) by VI1PR07MB4175.eurprd07.prod.outlook.com ([fe80::5424:92d0:ef7:e047%5]) with mapi id 15.20.1750.014; Fri, 29 Mar 2019 09:40:41 +0000 From: John Mattsson To: 'EMU WG' Thread-Topic: [TLS] Comment on draft-thomson-tls-sic-00 Thread-Index: AQHU5hN5aNELG7Vd00CJ6I5TO/V00w== Date: Fri, 29 Mar 2019 09:40:41 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.17.0.190309 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [2001:67c:370:128:c96c:3e64:faa0:4fcd] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: fcd78fd0-a5fc-4bfe-2fc5-08d6b42a9c0a x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:VI1PR07MB5614; x-ms-traffictypediagnostic: VI1PR07MB5614: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-forefront-prvs: 0991CAB7B3 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(346002)(366004)(376002)(136003)(396003)(13464003)(199004)(189003)(5660300002)(186003)(99286004)(53546011)(6506007)(102836004)(83716004)(25786009)(486006)(44832011)(68736007)(33656002)(46003)(2616005)(476003)(966005)(8936002)(6116002)(36756003)(478600001)(7736002)(6916009)(53936002)(229853002)(97736004)(8676002)(305945005)(81166006)(81156014)(105586002)(6486002)(256004)(71190400001)(71200400001)(6436002)(2906002)(316002)(6306002)(14454004)(106356001)(2473003)(82746002)(6512007)(86362001)(58126008); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR07MB5614; H:VI1PR07MB4175.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: El3+mrMd2mgJPHBJ5s1xHRT7ZPoC3C+mFAYb5yThIiNeBqklKMfRWAQyMYkj0LTa/9EXj9itDZnqdAslDXolc7YC3+TDv8W5ezio+x9KZ6MeQkTg/itFCu6WiFfyicuvp/iMTpacoDMBO5fxjt2VUti9doFI1uoEse6C+V4r3dU0oTx1NmGopP+ecKEsvv+WoLuZ0FHlyegqP+9TVbMr/bNQMOY0HV+0beKvJtMIvMuxqwfCNdCZkPquy2kctMYJkuiAAm0djClhwtejV7JeJv/pplf3Rwg07e0QzMvN+7Hd0BrfwDfeY88P4A3Wefp2kLTRxdvaJz2JLiQuKYqrhUeCvrNTP1JscV1un2a3klzUzB+U/H5aTcJOmHR3fN2a5upl1siiFXy0PhclJmOaewubfR5Q+wiQsQfbYIRSKHQ= Content-Type: text/plain; charset="utf-8" Content-ID: <9E18E92A0586CC4490E58DFED49514B5@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: fcd78fd0-a5fc-4bfe-2fc5-08d6b42a9c0a X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Mar 2019 09:40:41.7932 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR07MB5614 Archived-At: Subject: [Emu] FW: [TLS] Comment on draft-thomson-tls-sic-00 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 09:40:48 -0000 SGkgRU1VLA0KDQpUaGlzIG5ldyBkcmFmdCBmcm9tIE1hcnRpbiBUaG9tc29uIGlzIHNvbHZpbmcg YSBsb3Qgb2YgdGhlIHByb2JsZW1zIHdpdGggbGFyZ2UgY2VydGlmaWNhdGUgY2hhaW5zIGluIFRM UywgYXQgbGVhc3QgZm9yIEVBUC1UTFMgMS4zLiBJIHRoaW5rIHRoZSBFTVUgd29ya2luZyBncm91 cCBzaG91bGQgZGlzY3VzcyBpZiB0aGlzIGRyYWZ0IHNvbHZlcyB0aGUgcHJvYmxlbXMgb2YgdGhl IEVNVSB3b3JraW5nIGdyb3VwLCBpZiBub3Qgd2Ugc2hvdWxkIHRyeSB0byBpbmZsdWVuY2UgdGhl IGRyYWZ0IHNvIGl0IGRvZXMuDQoNClVzZSBvZiB0aGlzIGRyYWZ0IHJlcXVpcmVzIHByZS1kaXN0 cmlidXRpbmcgYWxsIGludGVybWVkaWFyeSBjZXJ0aWZpY2F0ZXMuDQoNCkpvaG4NCg0K77u/LS0t LS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IFRMUyA8dGxzLWJvdW5jZXNAaWV0Zi5vcmc+ IG9uIGJlaGFsZiBvZiBKb2huIE1hdHRzc29uIDxqb2huLm1hdHRzc29uQGVyaWNzc29uLmNvbT4N CkRhdGU6IEZyaWRheSwgMjkgTWFyY2ggMjAxOSBhdCAxMDozMA0KVG86ICJUTFNAaWV0Zi5vcmci IDxUTFNAaWV0Zi5vcmc+DQpTdWJqZWN0OiBbVExTXSBDb21tZW50IG9uIGRyYWZ0LXRob21zb24t dGxzLXNpYy0wMA0KDQogICAgSGksDQogICAgDQogICAgSSBhbSBzdHJvbmdseSBzdXBwb3J0aW5n IG9mIHNvbHZpbmcgdGhlIHByb2JsZW0gdGhpcyBkcmFmdCBpcyB0cnlpbmcgdG8gc29sdmUuIFRo aXMgaXMgYSBwcm9ibGVtIHRoYXQgdGhlIEVNVSBXRyBoYXMgaWRlbnRpZmllZCBhbmQgZGlzY3Vz c2VkIGluIHRoZSBwYXN0Lg0KICAgIA0KICAgIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9k cmFmdC1tcy1lbXUtZWFwdGxzY2VydC0wMg0KICAgIA0KICAgIEkgd2lsbCBhZGQgdGV4dCBkaXNj dXNzaW5nIGRyYWZ0LXRob21zb24tdGxzLXNpYy0wMCB0byBkcmFmdC1tcy1lbXUtZWFwdGxzY2Vy dC0wMyBhbmQgYXNrIGZvciBhZ2VuZGEgdGltZSBpbiBFTVUgYXQgSUVURiAxMDUgdG8gZGlzY3Vz cyBpZiBkcmFmdC10aG9tc29uLXRscy1zaWMtMDAgc29sdmVzIHRoZSBwcm9ibGVtcyBvZiB0aGUg RU1VIFdHLg0KICAgIA0KICAgIFRoZSBFTVUgV0cgYWN0dWFsbHkgc2hvcnRseSBkaXNjdXNzZWQg dGhpcyBNb25kYXkgaWYgdGhlIFdHIHRob3VnaHQgdGhlcmUgd2FzIGFueSB1cGRhdGVzIHRvIFRM UyB0aGF0IG5lZWRlZCB0byBiZSBkcml2ZW4gaW4gdGhlIFRMUyBXRy4NCiAgICANCiAgICBDaGVl cnMsDQogICAgSm9obg0KICAgIA0KICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fDQogICAgVExTIG1haWxpbmcgbGlzdA0KICAgIFRMU0BpZXRmLm9yZw0K ICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzDQogICAgDQoNCg== From nobody Fri Mar 29 03:50:44 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD32912027D for ; Fri, 29 Mar 2019 03:50:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0EDR-u_ysllV for ; Fri, 29 Mar 2019 03:50:34 -0700 (PDT) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40089.outbound.protection.outlook.com [40.107.4.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 835CF120165 for ; Fri, 29 Mar 2019 03:50:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YWHpWBDWmhzI7lKgUaK3ON1X4rVCJftB+juv25Zj3bw=; b=aXvfprIhNYps5Duiy+emy4qPM6r97NfwPA2QoS4mHF8vMW5lzEJiKuKbsL8QIKz8DNDRQNRfAF5Gw9yI7CEz8KEPByIweWxHI0dlh5U2lpBNCyHZjhtU2V+SrdyGyLp6xZzAWh9bZzAJ83vVQVZ+SzLoOKuwyBbHonH9zhUq9Bk= Received: from VI1PR07MB4175.eurprd07.prod.outlook.com (20.176.6.24) by VI1PR07MB5837.eurprd07.prod.outlook.com (20.178.122.151) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1771.6; Fri, 29 Mar 2019 10:50:30 +0000 Received: from VI1PR07MB4175.eurprd07.prod.outlook.com ([fe80::5424:92d0:ef7:e047]) by VI1PR07MB4175.eurprd07.prod.outlook.com ([fe80::5424:92d0:ef7:e047%5]) with mapi id 15.20.1750.014; Fri, 29 Mar 2019 10:50:30 +0000 From: John Mattsson To: 'EMU WG' Thread-Topic: Comment on draft-thomson-tls-sic-00 Thread-Index: AQHU5hHk9r1yI3Oidk+mAiqUq9JKM6YierSAgAAEXwA= Date: Fri, 29 Mar 2019 10:50:30 +0000 Message-ID: References: <745ED9FE-9C31-4687-BD64-836155A28AEC@ericsson.com> In-Reply-To: <745ED9FE-9C31-4687-BD64-836155A28AEC@ericsson.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.17.0.190309 x-originating-ip: [2001:67c:370:128:7c96:4baf:7492:e0ae] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 8d02a395-e5db-4a99-39f0-08d6b4345cc8 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:VI1PR07MB5837; x-ms-traffictypediagnostic: VI1PR07MB5837: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-forefront-prvs: 0991CAB7B3 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(346002)(136003)(396003)(366004)(39860400002)(51444003)(13464003)(189003)(199004)(11346002)(86362001)(106356001)(8676002)(105586002)(478600001)(256004)(99286004)(14444005)(53936002)(966005)(6306002)(6512007)(7736002)(71190400001)(83716004)(6506007)(53546011)(305945005)(6436002)(2473003)(102836004)(14454004)(25786009)(6346003)(6486002)(82746002)(46003)(229853002)(36756003)(71200400001)(186003)(486006)(6116002)(44832011)(8936002)(76176011)(97736004)(5660300002)(81156014)(81166006)(2906002)(316002)(476003)(446003)(33656002)(68736007)(58126008)(6916009)(2616005); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR07MB5837; H:VI1PR07MB4175.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: KTSvlpxwk/H8eCG2Z1nR6P5YptTCDuioWZU4FJ+ZSD6/jX5IIjTGd3h2QUuRtOHt+7rbvFajthEGeSto/gEh2JnR9ET+i9+5S4o17tjO8NZ9l5vQ6q4sRweLZ07FBA+mVIKBbHTB6JiisXA6UUqbqQjMMmvw24y9Lmp+WK0TL6QGKDATZevqdqHbUlOk+Kf+uFGiw6l9+SeJULzfNexDFNh7tPn7j/Wm8dYVu8rgpFneIoXCUio1uM0xqhhdcv0W917l5bb74JLt5hspc8myqlP2OF3krf1JogYsl/oEo7+y/es5C7FQAJIT3XFu7znclRCC9ddu1gngg/g+TzSGlJDMv2R1JZ++Z5a90BkZNoUUiia7EQEQf3j5oG07vMpk3r5pht68ec83FwTQieFuwYrMIqgoDVXpKhG9vTxo2HY= Content-Type: text/plain; charset="utf-8" Content-ID: <43FE378BF6D5D7438B399A2FBF689EA7@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8d02a395-e5db-4a99-39f0-08d6b4345cc8 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Mar 2019 10:50:30.6458 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR07MB5837 Archived-At: Subject: [Emu] FW: Comment on draft-thomson-tls-sic-00 X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 10:50:41 -0000 SSB0aGluayBkcmFmdC10aG9tc29uLXRscy1zaWMtMDAgc29sdmVzIGFsbCB0aGUgcHJvYmxlbXMg dGhhdCB0aGUgRU1VIHdnIGhhdmUgaWRlbnRpZmllZC4gVGhlIGRyYWZ0IG9ubHkgd29ya3Mgd2l0 aCBFQVAtVExTIDEuMyBidXQgSSB0aGluayB0aGF0IGlzIGZpbmUuIEFueSBpbXBsZW1lbnRhdGlv biB3aWxsaW5nIHRvIHVwZGF0ZSB0aGUgVExTIGNvZGUsIHNob3VsZCB1cGRhdGUgdG8gVExTIDEu My4gSSBhZ3JlZSB3aXRoIE1hcnRpbiBUaG9tcHNvbiB0aGF0IHRoZSBUTFMgV0cgc2hvdWxkIG5v dCBzcGVuZCB0aW1lIG9uIFRMUyAxLjIuDQoNCkNoZWVycywNCkpvaG4NCg0K77u/LS0tLS1Pcmln aW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IEpvaG4gTWF0dHNzb24gPGpvaG4ubWF0dHNzb25AZXJp Y3Nzb24uY29tPg0KRGF0ZTogRnJpZGF5LCAyOSBNYXJjaCAyMDE5IGF0IDExOjM0DQpUbzogIlRM U0BpZXRmLm9yZyIgPFRMU0BpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBDb21tZW50IG9uIGRyYWZ0 LXRob21zb24tdGxzLXNpYy0wMA0KDQogICAgU29tZSBtb3JlIGNvbW1lbnRzIGFmdGVyIHJlYWRp bmcgdGhlIGRyYWZ0IGluIGRldGFpbC4NCiAgICANCiAgICAtIFRoZSBhYnN0cmFjdCBhbmQgaW50 cm9kdWN0aW9uIG9ubHkgdGFsa3MgYWJvdXQgdGhlIENsaWVudEhlbGxvIHVzZSBjYXNlLiBTaG91 bGQgc2hvcnRseSBtZW50aW9uIHRoZSBDZXJ0aWZpY2F0ZVJlcXVlc3QgdXNlIGNhc2UgYXMgd2Vs bC4NCiAgICANCiAgICAtIEkgbm90aWNlIHRoYXQgdGhlIGRyYWZ0IGRvZXMgbm90IGhhdmUgYW55 IHJlcXVpcmVtZW50IG9uIGhvdyB0aGUgY2xpZW50IGdldHMgYWNjZXNzIHRvIHRoZSBpbnRlcm1l ZGlhcnkgY2VydGlmaWNhdGVzLiBJIHRoaW5rIHRoaXMgaXMgdGhlIHJpZ2h0IGFwcHJvYWNoLg0K ICAgIA0KICAgIFRoZSBwcm9ibGVtIGRpc2N1c3NlZCBpbiBFTVUgaXMgdGhhdCB0aGF0IG1hbnkg YWNjZXNzIHBvaW50cyBkcm9wcyBFQVAgY29ubmVjdGlvbnMgYWZ0ZXIgNDAgLSA1MCBwYWNrZXRz IGFuZCB0aGF0IEVBUC1UTFMgY29ubmVjdGlvbnMgd2l0aCBsYXJnZSBjZXJ0aWZpY2F0ZSBjaGFp bnMgbWF5IHRoZXJlZm9yZSBiZSB1bmFibGUgdG8gY29tcGxldGUuDQogICAgDQogICAgT25lIGFw cHJvYWNoIGRpc2N1c3NlZCBpbiBFTVUgaXMgdGhhdCB0aGUgY2xpZW50IGNvdWxkIHRha2UgaW50 ZXJtZWRpYXRlIGNlcnRpZmljYXRlcyBmcm9tIGFuIGVhcmxpZXIgRUFQLVRMUyBjb25uZWN0aW9u IHRoYXQgd2FzIGRyb3BwZWQgYnkgdGhlIGFjY2VzcyBwb2ludC4gVGhpcyBkcmFmdHMgY3VycmVu dGx5IGFsbG93cyB0aGF0LiBJIHRoaW5rIHRoYXQgaXMgY29ycmVjdC4gSSBjYW5ub3Qgc2VlIHRo YXQgdGhlIGRpc3RyaWJ1dGlvbiBvZiBpbnRlcm1lZGlhcnkgY2VydGlmaWNhdGVzIG5lZWQgYW55 IHNlY3VyaXR5IHJlcXVpcmVtZW50cyBhcyB0aGUgY2xpZW50IGNhbiB2ZXJpZnkgdGhlbSB3aXRo IHRoZSBoZWxwIG9mIG9uZSBvZiBpdHMgdHJ1c3QgYW5jaG9ycy4NCiAgICANCiAgICBDaGVlcnMs DQogICAgSm9obg0KICAgIA0KICAgIC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQogICAgRnJv bTogSm9obiBNYXR0c3NvbiA8am9obi5tYXR0c3NvbkBlcmljc3Nvbi5jb20+DQogICAgRGF0ZTog RnJpZGF5LCAyOSBNYXJjaCAyMDE5IGF0IDEwOjI5DQogICAgVG86ICJUTFNAaWV0Zi5vcmciIDxU TFNAaWV0Zi5vcmc+DQogICAgU3ViamVjdDogQ29tbWVudCBvbiBkcmFmdC10aG9tc29uLXRscy1z aWMtMDANCiAgICANCiAgICAgICAgSGksDQogICAgICAgIA0KICAgICAgICBJIGFtIHN0cm9uZ2x5 IHN1cHBvcnRpbmcgb2Ygc29sdmluZyB0aGUgcHJvYmxlbSB0aGlzIGRyYWZ0IGlzIHRyeWluZyB0 byBzb2x2ZS4gVGhpcyBpcyBhIHByb2JsZW0gdGhhdCB0aGUgRU1VIFdHIGhhcyBpZGVudGlmaWVk IGFuZCBkaXNjdXNzZWQgaW4gdGhlIHBhc3QuDQogICAgICAgIA0KICAgICAgICBodHRwczovL3Rv b2xzLmlldGYub3JnL2h0bWwvZHJhZnQtbXMtZW11LWVhcHRsc2NlcnQtMDINCiAgICAgICAgDQog ICAgICAgIEkgd2lsbCBhZGQgdGV4dCBkaXNjdXNzaW5nIGRyYWZ0LXRob21zb24tdGxzLXNpYy0w MCB0byBkcmFmdC1tcy1lbXUtZWFwdGxzY2VydC0wMyBhbmQgYXNrIGZvciBhZ2VuZGEgdGltZSBp biBFTVUgYXQgSUVURiAxMDUgdG8gZGlzY3VzcyBpZiBkcmFmdC10aG9tc29uLXRscy1zaWMtMDAg c29sdmVzIHRoZSBwcm9ibGVtcyBvZiB0aGUgRU1VIFdHLg0KICAgICAgICANCiAgICAgICAgVGhl IEVNVSBXRyBhY3R1YWxseSBzaG9ydGx5IGRpc2N1c3NlZCB0aGlzIE1vbmRheSBpZiB0aGUgV0cg dGhvdWdodCB0aGVyZSB3YXMgYW55IHVwZGF0ZXMgdG8gVExTIHRoYXQgbmVlZGVkIHRvIGJlIGRy aXZlbiBpbiB0aGUgVExTIFdHLg0KICAgICAgICANCiAgICAgICAgQ2hlZXJzLA0KICAgICAgICBK b2huDQogICAgICAgIA0KICAgICAgICANCiAgICANCiAgICANCg0K From nobody Fri Mar 29 13:57:47 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 07FCF120351 for ; Fri, 29 Mar 2019 13:57:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZVYCpEwNz98i for ; Fri, 29 Mar 2019 13:57:42 -0700 (PDT) Received: from relay.sandelman.ca (relay.cooperix.net [IPv6:2a01:7e00::f03c:91ff:feae:de77]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BD161202B0 for ; Fri, 29 Mar 2019 13:57:41 -0700 (PDT) Received: from dooku.sandelman.ca (cst-prg-34-242.cust.vodafone.cz [46.135.34.242]) by relay.sandelman.ca (Postfix) with ESMTPS id 32CC11F45B for ; Fri, 29 Mar 2019 20:57:39 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id 499F74076; Fri, 29 Mar 2019 21:57:42 +0100 (CET) From: Michael Richardson To: emu@ietf.org In-reply-to: References: Comments: In-reply-to Joseph Salowey message dated "Thu, 08 Nov 2018 10:13:06 +0700." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Date: Fri, 29 Mar 2019 21:57:42 +0100 Message-ID: <20357.1553893062@dooku.sandelman.ca> Archived-At: Subject: [Emu] EAP-AKA' and Re: WG adoption call for draft-arkko-eap-aka-pfs X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 20:57:45 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Joseph Salowey wrote: > that consensus.=C2=A0 If you do not support adoption of > draft-arkko-eap-aka-pfs-03.txt as WG item please say so by 2359UTC on > 30 November 2018 (and say why). I don't think that this was decided. At least, I did not find a message about this in the archives! I implemented server side EAP-SIM and EAP-AKA back 16 some years ago. Based upon the many emails I got asking for help configuring EAP-SIM, and the zero I got for EAP-AKA, I have never been sure to what extend AKA really go out there. Is the nano-SIM in my phone SIM or did it mutate into AKA? I never quite knew. I was always very sad that AKA did not get more uptake as it authenticates the network to the phone, and therefore would have (as I understand things) defended against "Stingray" like equipment used without judicial review, requiring interceptors to significantly involve telco in such things, and limiting who they would actually "catch". ... I've heard other claims too. So anything that prevents AKA' from being taken on seems like a significant thing to me! I re-read pfs-04, and wound up reading draft-ietf-emu-rfc5448bis-04, which I had not read before. I found the extensive references to TS-3GPP.24 made that document rather hard to read, but at least I can download them easily, unlike some other SDOs. There are also some awkward sentences where maybe a pass through with a language editor would help. for instance: Upon receiving an EAP-Response/AKA'-Challenge with AT_KDF from the peer, the server checks that the suggested AT_KDF value was one of the alternatives in its offer. The first AT_KDF value in the message from the server is not a valid alternative. If the peer has replied with the first AT_KDF value, the server behaves as if AT_MAC of the response had been incorrect and fails the authentication. I couldn't understand this at all. You sure you want to call this EAP-AKA', and not EAP-AKA2 ? That lone single quote seems to be asking for problems in code to me. section 4: This mechanism comes in the form of the AT_BIDDING attribute. This allows both endpoints to communicate their desire and support for EAP-AKA' when exchanging EAP-AKA messages. This attribute is not included in EAP-AKA' messages as defined in this RFC. It is only included in EAP-AKA messages. Why not include it in EAP-AKA'? You assume that there isn't a third mechanism which should not be bid down to EAP-AKA' (some EAP-TLS or something). As I understand it, AT_KDF is an alternate KDF for EAP-AKA', and the KDF is negotiated between the parties. It seems like a reasonable thing to do from a technical point of view, and the implementation seems rather simp= le and straightforward. =3D=3D=3D=3D I followed the link to the IPR page, but I have not (and won't) read the patent. Having read the pseudo code in section 6.3, I can't see how it's significantly different than IKEv2. If there is something novel here, I don't know what it might be. I found it interesting the IPR claim has the word "Possible", which kind of makes one wonder: Reasonable and Non-Discriminatory License to All Implementers with Possible Royalty/Fee I think that it is a template though, not something they chose. The difference between RAND and RF is significant to open source projects. Why is the claim duplicated, I also wonder. If draft-arkko-eap-aka-pfs is important, I think it should be folded into draft-ietf-emu-rfc5448bis. It seems terribly useful to me, and if we are going to have it, I'd rather have it by default. Compared to when EAP-AKA was defined, the use of open source systems to enable roaming is very very very significant. If open source eco-systems feel there is FUD here, then I think it is important to think hard. Entities that want 5G to succeed, should think hard about whether litigating this patent is more important than 5G succeeding for roaming. Finally, I want to point to: https://lwn.net/Articles/780078/ =2D-=20 ] Never tell me the odds! | ipv6 mesh network= s [=20 ] Michael Richardson, Sandelman Software Works | network architect= [=20 ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails = [=20 =09 --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEERK+9HEcJHTJ9UqTMlUzhVv38QpAFAlyehsUACgkQlUzhVv38 QpCo4gf/ZVSK8Op+vKTZ8yk3n4mz5SvaM/iCISZ4x6urty1pxNqb5+QC2DIKq0Dl JmlOXcJ7bTg4MrOdIrEikudDQofPNerswBiZrAx2a7A1BtW2B40RZE+PQaIWirKw 5m+6DjEVFRjwOHmDmSkRUMWHdg4bouuIHQfNKTiEb0ZHcU7Sl1szefFpeTdBo6xf RVF5eih7rdbFGnvtA690fWq9g8voazxkT4UPrpya0VFEuvM7in1Hjijw7kpIo7iU DqpDYJ7jX5U7iHlppfn1otKKCi+TeSgKOmVZCNmd5vlHyNUlRHIZGo9AAIL49s3r poSfPxirt5IzQzgODQNNz6RS/og0Fw== =gkWM -----END PGP SIGNATURE----- --=-=-=-- From nobody Sat Mar 30 06:34:27 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 018291201B3 for ; Sat, 30 Mar 2019 06:34:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, LOTS_OF_MONEY=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1P-_nEwWrYRo for ; Sat, 30 Mar 2019 06:34:21 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 25D981201AC for ; Sat, 30 Mar 2019 06:34:21 -0700 (PDT) Received: from [192.168.46.58] (198-84-237-221.cpe.teksavvy.com [198.84.237.221]) by mail.networkradius.com (Postfix) with ESMTPSA id 82676363; Sat, 30 Mar 2019 13:34:19 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Alan DeKok In-Reply-To: <20357.1553893062@dooku.sandelman.ca> Date: Sat, 30 Mar 2019 09:34:17 -0400 Cc: emu@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <3A358E18-F3C3-40FF-BF87-DEB963549BE8@deployingradius.com> References: <20357.1553893062@dooku.sandelman.ca> To: Michael Richardson X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Emu] EAP-AKA' and Re: WG adoption call for draft-arkko-eap-aka-pfs X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 Mar 2019 13:34:24 -0000 On Mar 29, 2019, at 4:57 PM, Michael Richardson = wrote: > I followed the link to the IPR page, but I have not (and won't) read = the > patent. Having read the pseudo code in section 6.3, I can't see how = it's > significantly different than IKEv2. If there is something novel here, = I > don't know what it might be. >=20 > I found it interesting the IPR claim has the word "Possible", which > kind of makes one wonder: > Reasonable and Non-Discriminatory License to All Implementers with > Possible Royalty/Fee > I think that it is a template though, not something they chose. > The difference between RAND and RF is significant to open source = projects. Very much so. Especially since few projects have funding, much less = funding to pay for things like this. > If draft-arkko-eap-aka-pfs is important, I think it should be folded = into > draft-ietf-emu-rfc5448bis. It seems terribly useful to me, and if we = are > going to have it, I'd rather have it by default. I'm OK with them being two separate documents, but they should be = closely tied. > Compared to when EAP-AKA was defined, the use of open source systems = to > enable roaming is very very very significant. If open source = eco-systems > feel there is FUD here, then I think it is important to think hard. The patent issues are non-trivial. Let's be realistic about the IETF. While we pretend that we have = individual contributors, the reality is that large companies fund huge = chunks of it. Those companies effectively shield individual = contributors from patent lawsuits. i.e. no one will sue an employee of = Cisco about a standard, they will instead sue Cisco directly. Michael and I have no such protection. As an implementor of EAP-SIM = and EAP-AKA, he may be personally liable. As the person hosting the web = site and source code, I may also be personally liable. That liability means we're very concerned about these issues. In = contrast, a Cisco employee might be "personally involved" in litigation = by being deposed. During work hours, while getting paid a normal = salary. And realistically, Open Source has driven the explosion of tech = companies in the past 10 years. I think few companies could have been = profitable if they had paid license fees for an OS, web server, etc. So = there should be a vested interest in protecting open source as part of = the IETF standardization process. > Entities that want 5G to succeed, should think hard about whether = litigating > this patent is more important than 5G succeeding for roaming. That's assuming the litigation group talks to the engineering group. = Large companies can have internal groups at odds with each other. > Finally, I want to point to: https://lwn.net/Articles/780078/ It may take $1M to get to the point where such legal arguments matter. = That rules out such a defence for me. Alan DeKok. From nobody Sat Mar 30 17:53:28 2019 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA64D120381 for ; Sat, 30 Mar 2019 17:53:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9RbMrUoKxztR for ; Sat, 30 Mar 2019 17:53:26 -0700 (PDT) Received: from relay.sandelman.ca (relay.cooperix.net [176.58.120.209]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6400120075 for ; Sat, 30 Mar 2019 17:53:25 -0700 (PDT) Received: from dooku.sandelman.ca (unknown [209.171.88.16]) by relay.sandelman.ca (Postfix) with ESMTPS id 977051F45B; Sun, 31 Mar 2019 00:53:21 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id 6416A425B; Sun, 31 Mar 2019 01:53:11 +0100 (CET) From: Michael Richardson To: Alan DeKok cc: emu@ietf.org In-reply-to: <3A358E18-F3C3-40FF-BF87-DEB963549BE8@deployingradius.com> References: <20357.1553893062@dooku.sandelman.ca> <3A358E18-F3C3-40FF-BF87-DEB963549BE8@deployingradius.com> Comments: In-reply-to Alan DeKok message dated "Sat, 30 Mar 2019 09:34:17 -0400." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Date: Sat, 30 Mar 2019 20:53:11 -0400 Message-ID: <8549.1553993591@dooku.sandelman.ca> Archived-At: Subject: Re: [Emu] EAP-AKA' and Re: WG adoption call for draft-arkko-eap-aka-pfs X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Mar 2019 00:53:28 -0000 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Alan DeKok wrote: > Let's be realistic about the IETF. While we pretend that we have > individual contributors, the reality is that large companies fund huge > chunks of it. Those companies effectively shield individual > contributors from patent lawsuits. i.e. no one will sue an employee = of > Cisco about a standard, they will instead sue Cisco directly. Actually, nobody seems to sue the majors except other majors. Nobody seems to sue small entities that have no money except patent trolls. > Michael and I have no such protection. As an implementor of EAP-SIM > and EAP-AKA, he may be personally liable. As the person hosting the > web site and source code, I may also be personally liable. I don't think you can be sued for patent infringemenet for writing about the patent, only for using it. Copyright, yes, but not patents. > And realistically, Open Source has driven the explosion of tech > companies in the past 10 years. I think few companies could have been > profitable if they had paid license fees for an OS, web server, etc. > So there should be a vested interest in protecting open source as part > of the IETF standardization process. I agree with you, and so it borders on seriously insulting to open source authors to have these super-vague IPR claims show up from non-technical lawyers. Let me restate my original opinion: - if this is important to 5G, then anything that gets in the way of adoption is a problem. If it's not important enough to fix the IPR, then it's actually that important. - adopting AKA is very important. =2D-=20 ] Never tell me the odds! | ipv6 mesh network= s [=20 ] Michael Richardson, Sandelman Software Works | network architect= [=20 ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails = [=20 =09 --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEERK+9HEcJHTJ9UqTMlUzhVv38QpAFAlygD3YACgkQlUzhVv38 QpB/LwgAk3KJTkA0biO1z0W2TMi4XaZsowWLv6WM+RTyNxYxc4GwmSfrzeXpSKgl aF0eetWvxDwscsIF7yM917GGd3CETtQF2LLA6ziz4SRARKo7ZRPAf6oLFiKgR51a irxleY6rz4iTl2YV3QVKWjglzVcVOugsHFy5OVn4e2YQ3LYYsZ7ovjbK01a8gygV on2oOnH3OqjYfKduMe3XCFOCMUKOxS3P7y6PlZbslz4fZIFWwZ9itMYnYmN94LQ2 0UlKRJrWcP1flnURoqs3DAW1GyjWgmWh+QtZVrSFBUOQYbZv4oxzEtI0b3Qa9qbq vDDXMB5LXaEgb/dj+ujwJ3FiLMDREg== =aBMC -----END PGP SIGNATURE----- --=-=-=--