From nobody Tue Jun 2 14:59:42 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53A8F3A1046 for ; Tue, 2 Jun 2020 14:59:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=redhat.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5X8AkVHp_Ytv for ; Tue, 2 Jun 2020 14:59:39 -0700 (PDT) Received: from us-smtp-delivery-1.mimecast.com (us-smtp-1.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE8C53A103C for ; Tue, 2 Jun 2020 14:59:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1591135178; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=EEIlnzd0QSQBCfuNLDSBNRjN4pJmPVp4CQX1IsKOdJ8=; b=EoPdGMW9FFjvBUX3afJVvcRgVYWcCW0sPSgGfsW627OGP/aKK3KAn6DlKYvJKh1uKBCMBo gDoUfRrCQaVZM+7G6qJKQ/U7hbMjdRmuVEIMNppwcGtg16lf+Tw21r+67trp8TxBFSdpaS j08589gjh61OilJ2dh0yIxFqFqglFHY= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-248-Og-1v3ZzMLinln2g0hv71g-1; Tue, 02 Jun 2020 17:57:53 -0400 X-MC-Unique: Og-1v3ZzMLinln2g0hv71g-1 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 051941856959; Tue, 2 Jun 2020 21:57:52 +0000 (UTC) Received: from localhost (unknown [10.10.110.64]) by smtp.corp.redhat.com (Postfix) with ESMTP id C42495C28E; Tue, 2 Jun 2020 21:57:51 +0000 (UTC) From: Robbie Harwood To: Russ Housley Cc: IETF Gen-ART , kitten@ietf.org, last-call@ietf.org, draft-ietf-kitten-krb-spake-preauth.all@ietf.org In-Reply-To: <7B24DD80-0A21-41F1-8E6A-CDE6279F0350@vigilsec.com> References: <158956185809.27642.15651397749101904532@ietfa.amsl.com> <7B24DD80-0A21-41F1-8E6A-CDE6279F0350@vigilsec.com> Date: Tue, 02 Jun 2020 17:57:48 -0400 Message-ID: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Archived-At: Subject: Re: [kitten] [Last-Call] Genart last call review of draft-ietf-kitten-krb-spake-preauth-07 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Jun 2020 21:59:40 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Russ Housley writes: >> On May 28, 2020, at 6:27 PM, Robbie Harwood wrote: >>=20 >> Signed PGP part >> Russ Housley via Datatracker writes: >>=20 >>> Reviewer: Russ Housley >>> Review result: Almost Ready >>>=20 >>> I am the assigned Gen-ART reviewer for this draft. The General Area >>> Review Team (Gen-ART) reviews all IETF documents being processed by >>> the IESG for the IETF Chair. Please treat these comments just like >>> any other last call comments. >>=20 >> Hi Russ, thanks for the review. Changes should be present in -08 unless >> discussed further below. >>=20 >>> Major Concerns: >>>=20 >>> Does this align with draft-irtf-cfrg-spake2? >>=20 >> It's derived from it, though they no longer totally align. >>=20 >>> Are you aware of https://datatracker.ietf.org/ipr/4018/? >>=20 >> I have seen it, but as Watson Ladd put it in >> https://mailarchive.ietf.org/arch/msg/cfrg/senXefqczpUZo26B35ekz8d3iLo/ >>=20 >> I=E2=80=99m not a patent lawyer, and cannot speculate on any IPR conf= licts >> that may or may not exist. > > If these documents do not align, then another 3rd party disclosure > should be made against this document, so the IPR holder can weigh in. Having now reread RFC 8179, it's my understanding that this is both a required action and does not indicate any further statement on our part. Accordingly, I've filed a separate IPR, though the system tells me it may take a day for it to appear. >>> Minor Concerns: >>>=20 >>> Abstract: Please explain "FAST", perhaps just a pointer to RFC 6113. >>=20 >> We believe this is covered by the "Document conventions" section. > > In my opinion, something needs to be in the Abstract. Otherwise, the > Abstract is not stand alone. That makes sense. If I change Second, enable the use of second factor authentication without relying on FAST. to Second, enable the use of second factor authentication without the need for a separately-established secure channel (FAST). would that address your concerns? I'd also be open to leaving out the parenthetical mention of FAST entirely if you think that's more clear. Thanks, --Robbie --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEA5qc6hnelQjDaHWqJTL5F2qVpEIFAl7Wy1wACgkQJTL5F2qV pEJiFBAAscpYlC4YANk+oRYcwJZGP/H5MDc610sCtzj6jK+t8nPAgJMh7X41GB4d K16KoVXBjZMW0Sq0pVHkpbtfUEHQtiC5Ce0R3Ers6EMNp2Bq9zMNFHcCpivsc5aM AMnK4OH+yec6JqOmBmxQJemRcRV8c8LZSLEVeMmjK57X6T+/XHlua5ZXTTowP/T6 c/j1j88dlo6tA4VzoleDakkkEyGQUGQb4ijsk7jIyhFysaLZhQjYaF1UgbgDHFqN w2mb0QVyWEYhRIsxLBchZbb1gmjzEUhMf+hhMpaaAzwLzB5rNZRrG0gOzoZGXWBC sXiPFRncgJs8zG8X4WILmAPGR7t8Dbb0erm1LX4/Oxq4ijKUNYHZRemvWBHPo1Ct UZXkE3kfAgI69WqXjUIhJg+udjhZJ4cOUnQbTK65vmxuAjfvcFFfO/lHj8johV9K do6nsa7QMU0c+kM/kpZeNZsv5ZafF63PYY4B3WhjKDG/5awQbHIjhef2c9QiQ44D NH9oSVfykdD08c2rHjjklSfA909CEz5Z6CSAZ8an/bmv283yuydz0Q5cRU56F1O6 SWVPDK0tHCmYUAWGpcRq7u82Udd/qITYwoIZAvUf0asrQJWDj2LsXW5oAlO0k8Od H1CAVKyyzydV8GRDY3KmqGiM9N0W92yUVd8cMWn9K17P+gNZ8KI= =eMMX -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Jun 3 08:54:57 2020 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D99703A0D96; Wed, 3 Jun 2020 08:54:55 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Secretariat To: Cc: ipr-announce@ietf.org, kitten@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.1.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159119969588.24141.12047222976926010944@ietfa.amsl.com> Date: Wed, 03 Jun 2020 08:54:55 -0700 Archived-At: Subject: [kitten] IPR Disclosure Nokia of America Corp's Statement about IPR related to draft-ietf-kitten-krb-spake-preauth and draft-mccallum-kitten-krb-spake-preauth X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jun 2020 15:54:56 -0000 Dear Nathaniel McCallum, Simo Sorce, Robbie Harwood, Greg Hudson: An IPR disclosure that pertains to your Internet-Draft entitled "SPAKE Pre-Authentication" (draft-ietf-kitten-krb-spake-preauth) was submitted to the IETF Secretariat on 2020-06-02 and has been posted on the "IETF Page of Intellectual Property Rights Disclosures" (https://datatracker.ietf.org/ipr/4171/). The title of the IPR disclosure is "Nokia of America Corp's Statement about IPR related to draft-ietf-kitten-krb-spake-preauth and draft-mccallum-kitten-krb-spake-preauth" Thank you IETF Secretariat From nobody Thu Jun 4 06:28:35 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 184623A09A3 for ; Thu, 4 Jun 2020 06:28:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=samwhited.com header.b=lXDrSDls; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=Lp+RAH3S Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ph2X0DpdeoCJ for ; Thu, 4 Jun 2020 06:28:32 -0700 (PDT) Received: from wout2-smtp.messagingengine.com (wout2-smtp.messagingengine.com [64.147.123.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A6303A095D for ; Thu, 4 Jun 2020 06:28:32 -0700 (PDT) Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.west.internal (Postfix) with ESMTP id 1A40D94A for ; Thu, 4 Jun 2020 09:28:31 -0400 (EDT) Received: from imap34 ([10.202.2.84]) by compute7.internal (MEProxy); Thu, 04 Jun 2020 09:28:31 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=samwhited.com; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type:content-transfer-encoding; s=fm3; bh=yqP9r 8kpr1ZsorneTM3T7UfsVS/475dUxydg33OGmD4=; b=lXDrSDlsevSGpVPk/YBkn +siyy6AVX60sliIa6MJHTl7PVa9bWosmVFBA5dyYlxYxxZ6EggQbnabnH3dSqDui QSrGDfoYmz+c5OScC5xL6leAK4bT8yfz1RzoRKNTeVmO6a7lUsO+S+Hj34GF4t2D K8tXMBMwmpTgwP4wbC85Swm03vu315rpXn9ieii4H5b671xaV4q0wW19GROzWWTr qzmIdX7atHkZMkdNmPy+H3uST9aZh/K1KiuJMQUmNzwmKDTROFYujjmVlGxr/acS QH8lhfQ8faHFZLnfUl/wUKx/V50uPV//u/EVxFFeQC6iBL6Od/+2b2HNqQc8R70O A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm2; bh=yqP9r8kpr1ZsorneTM3T7UfsVS/475dUxydg33OGm D4=; b=Lp+RAH3SnLPrd7z0J6dJ+OuLJUM73dK2LB7NbiszOrvPb35sN0U66m7i5 l0l0I9fX/j2b0Na9JWeWjszLWyJ2u4i0vtNgZGRpUWu+hfboDcoUkuOqCZa257zk 6ImTjWiYxQvv967vx69W6ARWpIsHD0Sf7TkPMQ0cekZWgPhg1zc3hC+2SID0Tp6u Q7b0bRUcczPewcjkJpZAI0C/XhReSMpcF2SPex80GAi15r3uLpNVfnBf3Fm+/QHX Cac/uDAABI93/56kaPayKWzOEUhO2952tUIL85Hjh7hD3BeY3rC0pMIjtUYg4qQe MLpeK01ac5WAGcF3ZaV7R/QHXvFPw== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduhedrudeguddgieefucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhepofgfggfkjghffffhvffutgfgsehtqhertderreejnecuhfhrohhmpedfufgr mhcuhghhihhtvggufdcuoehsrghmsehsrghmfihhihhtvggurdgtohhmqeenucggtffrrg htthgvrhhnpeefuddukeekueetueelfeeguedvuedvffehvdevieffgeehhfejffdtveev uedvffenucffohhmrghinhepihgvthhfrdhorhhgnecuvehluhhsthgvrhfuihiivgeptd enucfrrghrrghmpehmrghilhhfrhhomhepshgrmhesshgrmhifhhhithgvugdrtghomh X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 1390F1460062; Thu, 4 Jun 2020 09:28:30 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.3.0-dev0-519-g0f677ba-fm-20200601.001-g0f677ba6 Mime-Version: 1.0 Message-Id: <08f6f356-8928-424e-831d-fdc22508a196@www.fastmail.com> In-Reply-To: <10caec4c-2b6c-4602-8bf5-5d74ac1c1fa7@www.fastmail.com> References: <85d7fb9a-92f7-4b5a-bb20-bb9cfeeae67d@www.fastmail.com> <3d1e7257-004c-aabf-a259-6e532259c78e@isode.com> <80f32eca-9625-4c16-872f-5b0edb975483@www.fastmail.com> <10caec4c-2b6c-4602-8bf5-5d74ac1c1fa7@www.fastmail.com> Date: Thu, 04 Jun 2020 09:28:09 -0400 From: "Sam Whited" To: "KITTEN Working Group" Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [kitten] TLS export for channel binding X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Jun 2020 13:28:34 -0000 Gentle ping. Is this something the WG would also be interested in? Thanks. =E2=80=94Sam On Thu, May 21, 2020, at 19:02, Sam Whited wrote: > On Thu, May 21, 2020, at 19:00, Robbie Harwood wrote: > > Consensus from the TLS chairs seems to be a preference for work > > to occur in Kitten, though we should make sure that TLS folks > > review it. > > This works for me. Would you be willing to issue a formal call for > adoption on this one as well Robbie? > > Thanks! > > =E2=80=94Sam > > -- > Sam Whited > > _______________________________________________ > Kitten mailing list Kitten@ietf.org > https://www.ietf.org/mailman/listinfo/kitten > --=20 Sam Whited From nobody Thu Jun 4 09:57:56 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 93EAB3A0E06 for ; Thu, 4 Jun 2020 09:57:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=redhat.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ElZqq_e0_Xbx for ; Thu, 4 Jun 2020 09:57:54 -0700 (PDT) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [207.211.31.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 501B63A0D70 for ; Thu, 4 Jun 2020 09:57:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1591289869; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type; bh=zjQwi2qbimJGGyAKDNHIR9wICcavoiZlfrSxM0/BmHs=; b=ZizHAg5dLe58PmNrXXQilGlWqPuTFnB0DlHY6XT0MgPeBXsOrvTDkEGApv2HrZJoNlEKAo bqFqxEbtJHQk4GMlT4QuhzKD+Dp8yPExGOP5DRGrDWsp1pSqcP3uRSmAmO+BXNOfitz3DH NUYzs/VSOonA5ZO5o3t8bejMl9QXnmc= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-361-ZU9fauVuOuGxE2irylDhMw-1; Thu, 04 Jun 2020 12:57:27 -0400 X-MC-Unique: ZU9fauVuOuGxE2irylDhMw-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 3B8221005510 for ; Thu, 4 Jun 2020 16:57:26 +0000 (UTC) Received: from localhost (unknown [10.10.110.46]) by smtp.corp.redhat.com (Postfix) with ESMTP id E43A310013D5 for ; Thu, 4 Jun 2020 16:57:25 +0000 (UTC) From: Robbie Harwood To: kitten@ietf.org Date: Thu, 04 Jun 2020 12:57:22 -0400 Message-ID: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Archived-At: Subject: [kitten] Call for adoption on draft-whited-tls-channel-bindings-for-tls13 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Jun 2020 16:57:56 -0000 --=-=-= Content-Type: text/plain On behalf of Sam Whited, I'm issuing a call for adoption of https://datatracker.ietf.org/doc/draft-whited-tls-channel-bindings-for-tls13/ We've discussed this with the TLS working group, and consensus is that this work should take place in kitten (with consultation from TLS folks). Besides Sam, I've seen interest expressed by Alexey, Anyone else interested in this, or have objections? Thanks, --Robbie --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEA5qc6hnelQjDaHWqJTL5F2qVpEIFAl7ZJ/IACgkQJTL5F2qV pEIw7BAAhs83ptCZYgICpwZZnqroRI2XE78aMpVxeFOFQvq8fozuk+cjwLRTUoOl uhWM2bGu6hK2UuQX5sfZfvW4++dV0awDbyFDJANY+3ui/mMqv15IjxD7+1GcElOi UDCz+7N9888IO9Ns/FHjgokxaZHAen0xxEEuc1kcXSVIme0m/KDxQj+0+gKJQj2O Z9bzUYPQLAaBR47vgdH8VnD2onjdMnzEON4EnZJ1YPHSkC9ixbyXr2py4ehQU461 GARQHYc9KciGd072S4KyhqK1IlFbKCXUGDBNlgBiXIo5WKecTsdox5u+QOu5kUMJ qjQxcUvZmH9aCVpWtfY0lr7s2Cu+lmD+Mh2sNGcVNMqvnwKoN4AsdMelYHf/dAeh bYHKqpX8jNGhS+gsn27/CbO2vDj3cjUbjC+gHe2076OgcNe8yK4cDxtBuXtmQCAu X2pMphxLr2DFAuCnFQ0DVlyFqCS1M89/lwc0W6E+MNIF6qAmf5iRKC9vqi50w7z1 yo2rI7NYhp2K7DVuZoIVBs+Mj6YYlBC60ZggniadYP1umCwC/B2lVMD/UCoSHWV1 tiTXK1nwqFd96VssuwgXDuFZSOwIWunDV8gPNoty6Luzr0QFZQWI1/GPWEu/oxSz +6/itd4HQlXOi4QaLKcgXmVqWsXauP7KikEtlk/ny+JKXP3EGmk= =anb8 -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu Jun 4 09:58:08 2020 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 601FC3A0E47; Thu, 4 Jun 2020 09:58:02 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Secretariat To: , , X-Test-IDTracker: no X-IETF-IDTracker: 7.1.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159128988237.2784.2631504934800517168@ietfa.amsl.com> Date: Thu, 04 Jun 2020 09:58:02 -0700 Archived-At: Subject: [kitten] The KITTEN WG has placed draft-whited-tls-channel-bindings-for-tls13 in state "Call For Adoption By WG Issued" X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Jun 2020 16:58:07 -0000 The KITTEN WG has placed draft-whited-tls-channel-bindings-for-tls13 in state Call For Adoption By WG Issued (entered by Robbie Harwood) The document is available at https://datatracker.ietf.org/doc/draft-whited-tls-channel-bindings-for-tls13/ From nobody Thu Jun 4 11:37:48 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9ACBD3A0E37 for ; Thu, 4 Jun 2020 11:37:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=redhat.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qoObTaNvC9bb for ; Thu, 4 Jun 2020 11:37:45 -0700 (PDT) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C98123A0E30 for ; Thu, 4 Jun 2020 11:37:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1591295863; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WsfEWhUWKdSfrM4KZ3NYsal0dMctakKoIcQaGDSIAok=; b=SHE+Blvj4El3TX4t5tBxw/Hxzgiiw8xTsNiCjcI7sdPqS9gk2Z5A89alIfSZeKIIvpUTef TIYcVEaA3tmP/IXZGfMrLLLftT+58Zmi5Zc40/YsMCb1xFQcLce/FgPItpbxsbSrfcls4T 9VZKUOf9BnBNtrQQ+b4iNLmw7FENLes= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-442-7azWY3LjOhK1WtS9pvu6lA-1; Thu, 04 Jun 2020 14:37:38 -0400 X-MC-Unique: 7azWY3LjOhK1WtS9pvu6lA-1 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 78C15108BD11 for ; Thu, 4 Jun 2020 18:37:37 +0000 (UTC) Received: from ovpn-114-18.phx2.redhat.com (ovpn-114-18.phx2.redhat.com [10.3.114.18]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 182387CCCE; Thu, 4 Jun 2020 18:37:36 +0000 (UTC) Message-ID: From: Simo Sorce To: Robbie Harwood , kitten@ietf.org Date: Thu, 04 Jun 2020 14:37:35 -0400 In-Reply-To: References: Organization: Red Hat, Inc. Mime-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [kitten] Call for adoption on draft-whited-tls-channel-bindings-for-tls13 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Jun 2020 18:37:47 -0000 On Thu, 2020-06-04 at 12:57 -0400, Robbie Harwood wrote: > On behalf of Sam Whited, I'm issuing a call for adoption of > https://datatracker.ietf.org/doc/draft-whited-tls-channel-bindings-for-tls13/ > > We've discussed this with the TLS working group, and consensus is that > this work should take place in kitten (with consultation from TLS > folks). > > Besides Sam, I've seen interest expressed by Alexey, Anyone else > interested in this, or have objections? Over time I've heard comments that the current tls-unique bindings are not working out as initially expected. It would be nice to know if we also plan to address those issues in this draft (or whether this draft already avoid those). Note that in practice, in the wild, I see that most implementations I am exposed to are opting for tls-server-end-point, so it would be important to know that this new bindings of type unique for TLS 1.3 will be usable and there are consumers wanting to use them. Not pushing back just asking to address these questions in due course. Simo. -- Simo Sorce RHEL Crypto Team Red Hat, Inc From nobody Thu Jun 4 11:42:19 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 52C343A0E37 for ; Thu, 4 Jun 2020 11:42:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cryptonector.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cs9-LoNbQHKG for ; Thu, 4 Jun 2020 11:42:17 -0700 (PDT) Received: from dormouse.ash.relay.mailchannels.net (dormouse.ash.relay.mailchannels.net [23.83.222.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4BA4A3A0E31 for ; Thu, 4 Jun 2020 11:42:14 -0700 (PDT) X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id C3914541E94; Thu, 4 Jun 2020 18:42:10 +0000 (UTC) Received: from pdx1-sub0-mail-a63.g.dreamhost.com (100-96-2-93.trex.outbound.svc.cluster.local [100.96.2.93]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id C3CE7541D09; Thu, 4 Jun 2020 18:42:09 +0000 (UTC) X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com Received: from pdx1-sub0-mail-a63.g.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384) by 0.0.0.0:2500 (trex/5.18.8); Thu, 04 Jun 2020 18:42:10 +0000 X-MC-Relay: Neutral X-MailChannels-SenderId: dreamhost|x-authsender|nico@cryptonector.com X-MailChannels-Auth-Id: dreamhost X-Gusty-Trail: 4aafa88277809e89_1591296130379_517515719 X-MC-Loop-Signature: 1591296130379:1712540704 X-MC-Ingress-Time: 1591296130378 Received: from pdx1-sub0-mail-a63.g.dreamhost.com (localhost [127.0.0.1]) by pdx1-sub0-mail-a63.g.dreamhost.com (Postfix) with ESMTP id 6A3687F6D4; Thu, 4 Jun 2020 11:42:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=cryptonector.com; h=date :from:to:cc:subject:message-id:references:mime-version :content-type:in-reply-to; s=cryptonector.com; bh=c7s7HmORkEyJgB +rI+kcInjaT88=; b=sXOAV30WEHGFUMrrxSPU9RnlhnjzSsXUEjLCAkr2K0Fqy4 QWBZLmmmu5fStPEPiYo1ovZzh5JyVhmMjaG71oCPINCO3VXJeHPvPL1P6xBIDItI WjpR9g2NOyO2P5vdLMOEf8iV7mIIgwu6ZgIijMYZAek2iVBx/wa2iabqwclxI= Received: from localhost (unknown [24.28.108.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by pdx1-sub0-mail-a63.g.dreamhost.com (Postfix) with ESMTPSA id C18117F6D3; Thu, 4 Jun 2020 11:42:07 -0700 (PDT) Date: Thu, 4 Jun 2020 13:42:04 -0500 X-DH-BACKEND: pdx1-sub0-mail-a63 From: Nico Williams To: Robbie Harwood Cc: kitten@ietf.org Message-ID: <20200604184203.GS18021@localhost> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.9.4 (2018-02-28) X-VR-OUT-STATUS: OK X-VR-OUT-SCORE: -100 X-VR-OUT-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgeduhedrudeguddguddukecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucggtfgfnhhsuhgsshgtrhhisggvpdfftffgtefojffquffvnecuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenucfjughrpeffhffvuffkfhggtggujggfsehttdertddtredvnecuhfhrohhmpefpihgtohcuhghilhhlihgrmhhsuceonhhitghosegtrhihphhtohhnvggtthhorhdrtghomheqnecuggftrfgrthhtvghrnhepueffueehleeltdffudekjeeigfefhefgffffhefhheejleettddvgeehjeekveejnecuffhomhgrihhnpehivghtfhdrohhrghenucfkphepvdegrddvkedruddtkedrudekfeenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhhouggvpehsmhhtphdphhgvlhhopehlohgtrghlhhhoshhtpdhinhgvthepvdegrddvkedruddtkedrudekfedprhgvthhurhhnqdhprghthheppfhitghoucghihhllhhirghmshcuoehnihgtohestghrhihpthhonhgvtghtohhrrdgtohhmqedpmhgrihhlfhhrohhmpehnihgtohestghrhihpthhonhgvtghtohhrrdgtohhmpdhnrhgtphhtthhopehnihgtohestghrhihpthhonhgvtghtohhrrdgtohhm Archived-At: Subject: Re: [kitten] Call for adoption on draft-whited-tls-channel-bindings-for-tls13 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Jun 2020 18:42:18 -0000 On Thu, Jun 04, 2020 at 12:57:22PM -0400, Robbie Harwood wrote: > On behalf of Sam Whited, I'm issuing a call for adoption of > https://datatracker.ietf.org/doc/draft-whited-tls-channel-bindings-for-tls13/ > > We've discussed this with the TLS working group, and consensus is that > this work should take place in kitten (with consultation from TLS > folks). > > Besides Sam, I've seen interest expressed by Alexey, Anyone else > interested in this, or have objections? I support making this a KITTEN WG work item. To be sure, channel binding has not worked out to be as useful as we'd hoped. Problems arise having to do with reverse proxies, support in ECMASCript APIs, support in TLS stacks, etc. Token binding (basically, channel binding of half round trip bearer tokens) also seemed promising but has failed to become widely deployed for similar reasons. But as a general matter, we should make sure that we have solid channel bindings for TLS 1.3. Nico -- From nobody Thu Jun 4 11:44:10 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADEEF3A0E3C for ; Thu, 4 Jun 2020 11:44:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=samwhited.com header.b=boXhiWvE; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=ZvyMLJdx Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v_ubr41YbrYu for ; Thu, 4 Jun 2020 11:44:07 -0700 (PDT) Received: from wout3-smtp.messagingengine.com (wout3-smtp.messagingengine.com [64.147.123.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 737B63A0E3B for ; Thu, 4 Jun 2020 11:44:07 -0700 (PDT) Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.west.internal (Postfix) with ESMTP id D176843E for ; Thu, 4 Jun 2020 14:44:06 -0400 (EDT) Received: from imap34 ([10.202.2.84]) by compute7.internal (MEProxy); Thu, 04 Jun 2020 14:44:06 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=samwhited.com; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type:content-transfer-encoding; s=fm3; bh=6TSaU if9gshbA1liKIi/9+WGEcyJ7YJhc3ATBEIe7Sw=; b=boXhiWvEJkEZw7xy7x77a 9BjIdxkBAMKyy/ec793Hm1D3GCXNXNp89qqisP+QPq+cvWCGTamqMRpW9WpgY3ES 0k1RaP9gb6xalJnW0fyqbtnM03H0Wo0aUQSn9CM30FocTAm9Qx5u3xwtPD+RkfAc yhx7/Jex+dswUVeKmYUI+PBN7q/nfRao0WBZ8zIPUVpVCgyBJTYKoeVLRSc0URrR YvDyQVy0lt6qL4g4q89HvafdtAExGdimMGkWAUvW5+UEuLg24XmEtANyobozGLYN wMw75mnlC+RCbl43NO1uWCgJzfrfjM5+XKPFvSP5kc6O0IxcTjiXsfOUo+J0x0Fe Q== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm2; bh=6TSaUif9gshbA1liKIi/9+WGEcyJ7YJhc3ATBEIe7 Sw=; b=ZvyMLJdxb61B9b71FhJfybpRStnYpvhYUK26FD4jZGfPNAph1Lsz4qvqX 9LAwGfIMq+bU65mn87wp43wamnU47JRGnCxSunBCBOZjFMes4435Aw6TZVcfesJ6 jHLU2f1oG2hHWIDOMbuHqXiFvnL6WtC6Hb3Y1vlHhJYdfUCxLiXkzy0Y1VDpF+Ra sNxkP9Ph2GCeAXr8nAq2k/BR8RzbjbqCXgN901A09xLilTfly5iz3L4g5CLcTGI4 5urcbMRpg+EG7VZoblHZRDjeTTcJ8W/5ng/jKdtlvHQTWr/v1xZmNOv97YANaNJI cjUdF1YjWTCcgZDFg9CpU7tY6y88g== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduhedrudeguddguddvtdcutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd enucfjughrpefofgggkfgjfhffhffvufgtgfesthhqredtreerjeenucfhrhhomhepfdfu rghmucghhhhithgvugdfuceoshgrmhesshgrmhifhhhithgvugdrtghomheqnecuggftrf grthhtvghrnhepvdffuedvudfhfedvieehueekfffhkeejvefggfegtdelhffhhfeiveek udevhfejnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomh epshgrmhesshgrmhifhhhithgvugdrtghomh X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id CCA571460062; Thu, 4 Jun 2020 14:44:05 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.3.0-dev0-519-g0f677ba-fm-20200601.001-g0f677ba6 Mime-Version: 1.0 Message-Id: In-Reply-To: References: Date: Thu, 04 Jun 2020 14:43:45 -0400 From: "Sam Whited" To: "KITTEN Working Group" Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [kitten] =?utf-8?q?Call_for_adoption_on_draft-whited-tls-channel?= =?utf-8?q?-bindings-for-tls13?= X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Jun 2020 18:44:09 -0000 On Thu, Jun 4, 2020, at 14:37, Simo Sorce wrote: > Over time I've heard comments that the current tls-unique bindings are= > not working out as initially expected. It would be nice to know if we > also plan to address those issues in this draft (or whether this draft= > already avoid those). To my knowledge there are two problems here: 1) it's not long enough, and 2) without the master secret fix it's not actually unique enough. This spec should fix both of those. If there are any other problems with= tls-unique that I'm not aware of, we should definitely fix them and this= is why the TLS WG would need to be involved most likely. > Note that in practice, in the wild, I see that most implementations I > am exposed to are opting for tls-server-end-point, so it would be > important to know that this new bindings of type unique for TLS 1.3 > will be usable and there are consumers wanting to use them. I wouldn't mind having an end-point binding mechanism too, and could see= us adding that to this document eventually; to start though I wanted to get the most dead simple thing in the hands of the IETF. > Not pushing back just asking to address these questions in due course.= Indeed; I've added them to my list of TODOs, issues, and open questions. Thanks! =E2=80=94Sam --=20 Sam Whited From nobody Fri Jun 5 04:28:03 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 900243A149B for ; Fri, 5 Jun 2020 04:27:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isode.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VaMx3lIfy_2M for ; Fri, 5 Jun 2020 04:27:54 -0700 (PDT) Received: from statler.isode.com (Statler.isode.com [62.232.206.189]) by ietfa.amsl.com (Postfix) with ESMTP id 353183A14B2 for ; Fri, 5 Jun 2020 04:27:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1591356473; d=isode.com; s=june2016; i=@isode.com; bh=/ctvAF1GlSHVvBUp2Ii+wZqvPNa1vyUpvSltMZD14RY=; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version: In-Reply-To:References:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description; b=v5f+QUh2oXCU4JCoQlOCtdu0eBlKbAGyWwaU5xR2zG0OqETavi7e69uueRL1M4BB0GLq55 Z3fiWqiC+H88Aqe1iY7dt0FITP++aIPotfjSjd+wJQ+3mT7bySRErD+IFgbleENa++0u46 T1E4Gz50zzXy+P0/yTx54cX6tFsZ5qs=; Received: from [172.27.253.126] (connect.isode.net [172.20.0.72]) by statler.isode.com (submission channel) via TCP with ESMTPSA id ; Fri, 5 Jun 2020 12:27:53 +0100 To: Robbie Harwood , kitten@ietf.org References: From: Alexey Melnikov Message-ID: <85b3c3ba-ca51-a625-5586-727b278cfcba@isode.com> Date: Fri, 5 Jun 2020 12:27:33 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.7.0 In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-GB Archived-At: Subject: Re: [kitten] Call for adoption on draft-whited-tls-channel-bindings-for-tls13 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Jun 2020 11:28:02 -0000 On 04/06/2020 17:57, Robbie Harwood wrote: > On behalf of Sam Whited, I'm issuing a call for adoption of > https://datatracker.ietf.org/doc/draft-whited-tls-channel-bindings-for-tls13/ > > We've discussed this with the TLS working group, and consensus is that > this work should take place in kitten (with consultation from TLS > folks). > > Besides Sam, I've seen interest expressed by Alexey, Anyone else > interested in this, or have objections? I am still interested :-). I think the document needs to change, but it is a good starting point for the WG discussions. From nobody Wed Jun 10 11:14:35 2020 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 94AC83A0AC9; Wed, 10 Jun 2020 11:14:33 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: kitten@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.3.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: kitten@ietf.org Message-ID: <159181287347.12131.7953681528915103581@ietfa.amsl.com> Date: Wed, 10 Jun 2020 11:14:33 -0700 Archived-At: Subject: [kitten] I-D Action: draft-ietf-kitten-krb-spake-preauth-09.txt X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Jun 2020 18:14:34 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Common Authentication Technology Next Generation WG of the IETF. Title : SPAKE Pre-Authentication Authors : Nathaniel McCallum Simo Sorce Robbie Harwood Greg Hudson Filename : draft-ietf-kitten-krb-spake-preauth-09.txt Pages : 37 Date : 2020-06-10 Abstract: This document defines a new pre-authentication mechanism for the Kerberos protocol that uses a password authenticated key exchange. This document has three goals. First, increase the security of Kerberos pre-authentication exchanges by making offline brute-force attacks infeasible. Second, enable the use of second factor authentication without the need for a separately-established secure channel. This is achieved using the existing trust relationship established by the shared first factor. Third, make Kerberos pre- authentication more resilient against time synchronization errors by removing the need to transfer an encrypted timestamp from the client. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-kitten-krb-spake-preauth/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-kitten-krb-spake-preauth-09 https://datatracker.ietf.org/doc/html/draft-ietf-kitten-krb-spake-preauth-09 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-kitten-krb-spake-preauth-09 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Jun 10 11:17:39 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2B963A0B0B for ; Wed, 10 Jun 2020 11:17:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=redhat.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bGq4ZBBM_1Pi for ; Wed, 10 Jun 2020 11:17:15 -0700 (PDT) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [207.211.31.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 44C123A0B33 for ; Wed, 10 Jun 2020 11:17:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1591813034; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=ZvcN+5z0o9LbamqVw3+f/ALN6UqF8v+Bd56oT4FC9qo=; b=CQQ3zrL2lf4DtirFdmfpdNsxGSWfJ72N1XMfN/RG1Q3uha6duBQ1eLED/YhtFnUKgFZwyE mXP8rsThtmfRsS+zHAbGhOsqMk/c4anIef9hGztEcSPHw0rgp0qD31EEwOFU6D2AjqRUPD 2rfTkAOf5pGf/SUpvz+G0gPdDztXuAA= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-323-rClfoHO5Nq2dr_IQtzckbA-1; Wed, 10 Jun 2020 14:17:11 -0400 X-MC-Unique: rClfoHO5Nq2dr_IQtzckbA-1 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 011E6107ACF5; Wed, 10 Jun 2020 18:17:10 +0000 (UTC) Received: from localhost (unknown [10.10.110.65]) by smtp.corp.redhat.com (Postfix) with ESMTP id BDA9E5D9D3; Wed, 10 Jun 2020 18:17:09 +0000 (UTC) From: Robbie Harwood To: Russ Housley Cc: IETF Gen-ART , kitten@ietf.org, last-call@ietf.org, draft-ietf-kitten-krb-spake-preauth.all@ietf.org In-Reply-To: References: <158956185809.27642.15651397749101904532@ietfa.amsl.com> <7B24DD80-0A21-41F1-8E6A-CDE6279F0350@vigilsec.com> Date: Wed, 10 Jun 2020 14:17:06 -0400 Message-ID: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Archived-At: Subject: Re: [kitten] [Last-Call] Genart last call review of draft-ietf-kitten-krb-spake-preauth-07 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Jun 2020 18:17:17 -0000 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Robbie Harwood writes: > Russ Housley writes: >> On May 28, 2020, at 6:27 PM, Robbie Harwood wrote: >>> Russ Housley via Datatracker writes: >>>=20 >>>> Reviewer: Russ Housley >>>> Review result: Almost Ready >>>>=20 >>>> I am the assigned Gen-ART reviewer for this draft. The General Area >>>> Review Team (Gen-ART) reviews all IETF documents being processed by >>>> the IESG for the IETF Chair. Please treat these comments just like >>>> any other last call comments. >>>> >>>> Minor Concerns: >>>>=20 >>>> Abstract: Please explain "FAST", perhaps just a pointer to RFC 6113. >>>=20 >>> We believe this is covered by the "Document conventions" section. >> >> In my opinion, something needs to be in the Abstract. Otherwise, the >> Abstract is not stand alone. > > That makes sense. If I change > > Second, enable the use of second factor authentication without > relying on FAST. > > to > > Second, enable the use of second factor authentication without the > need for a separately-established secure channel (FAST). > > would that address your concerns? I'd also be open to leaving out the > parenthetical mention of FAST entirely if you think that's more clear. I've opted to make this change, removing explicit mention of FAST entirely. It is part of -09. Thanks, --Robbie --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEA5qc6hnelQjDaHWqJTL5F2qVpEIFAl7hI6IACgkQJTL5F2qV pELlGQ//X5ni3JCmgOQyWHjW89Y3nO1NWYnGjrECElDYxrfsFj0IsmYU1nL8lHXK gYEVu/HoN7d97hvI/rpTpVKKFSp/UxPQ+rZ+jJo8lNt0ZAMLO2cQ6tL93/7m3n/W Ckyxkid6WE+ZCs8xk9oC3VUylSqaJTvayyWRlOkWh+aSvmeNkPBhPd+GOcK8Oa4t hecriNugbiWvB4kPm6AgCQCvo0pSYsH5us4H2IARic/2p4CBwuOMbwY+jhlKLQG9 wdjGL/lxWRcDGVfUoxsD70bAm4ZyJVnrPmJ7uaKMWlANHXqju8cQ9y4KsAiXSwmN 9q3KAFlzAqjkaBqIZHOjRQfWgFcjFRhsNMxL4OJFV7KpwFlavFgVWaXia5njrV0J 7BpFcrKwoQWutOwDdD4766kWSnYhX7QYjlIyfvHNyWbi3+Yn20lLyzeJ4DDaRggm Cn00DnaPNimo5qfpQW/sQyg3etSo6++urTGBwfd23HvOCc1Fzf89uNHtlUj0iyBd j4OC0FWf932XsanPtt9ooC1hRpWgOiMMhlE6SYV0MMGmHwNksJYNPN1YIGDMpD2R bwQt3I+NQrcO0M+90+7PS4Hx5oaG/2hTYU0V4tPw1FGULOIYKXn61uDreDdi3ldK qrFx/R0uJvujcgrrB0JAwq6q6FbSujo+euQltBLnrk0bxUUwdLQ= =naqW -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu Jun 11 15:46:34 2020 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 84A3A3A0945; Thu, 11 Jun 2020 15:46:32 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: kitten@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.3.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: kitten@ietf.org Message-ID: <159191559247.6723.1236087056368618574@ietfa.amsl.com> Date: Thu, 11 Jun 2020 15:46:32 -0700 Archived-At: Subject: [kitten] I-D Action: draft-ietf-kitten-tls-channel-bindings-for-tls13-00.txt X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Jun 2020 22:46:33 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Common Authentication Technology Next Generation WG of the IETF. Title : Channel Bindings for TLS 1.3 Author : Sam Whited Filename : draft-ietf-kitten-tls-channel-bindings-for-tls13-00.txt Pages : 5 Date : 2020-06-11 Abstract: This document defines a channel binding type, tls-exporter, that is compatible with TLS 1.3 [RFC8446] in accordance with On Channel Binding [RFC5056]. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-kitten-tls-channel-bindings-for-tls13/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-kitten-tls-channel-bindings-for-tls13-00 https://datatracker.ietf.org/doc/html/draft-ietf-kitten-tls-channel-bindings-for-tls13-00 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Jun 30 00:22:39 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6261D3A0C9F for ; Tue, 30 Jun 2020 00:22:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=padl.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UOkms6nFLREb for ; Tue, 30 Jun 2020 00:22:35 -0700 (PDT) Received: from us.padl.com (us.padl.com [216.154.215.154]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB7C53A0B45 for ; Tue, 30 Jun 2020 00:22:35 -0700 (PDT) Received: by us.padl.com with ESMTP id 05U7MST3029024; Tue, 30 Jun 2020 07:22:31 GMT DKIM-Filter: OpenDKIM Filter v2.11.0 us.padl.com 05U7MST3029024 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=padl.com; s=default; t=1593501752; bh=WrpF7PV5raCG/SUsGjOn7N8jcS+L0uDJUGrZOYsXdUY=; h=From:Subject:Date:References:To:In-Reply-To:From; b=yVFP6VKHCKwJ7xvgQ6ruzSb9oh6L20jp7WjYvga0XpcnocUBBCiyw6JzzFjiOa9iw RYPuCUQ3piQJ8GY5opOdQbww21F7EoxzPCwQbTPCnz03EFaNS+PmC04Z5a9ilfQ0RV ZEim4cJjU4ZZvTZDbHiAkmdSp11q94c5wSW2zLinhYbV2f6P+SP2hACStE5dX9SyM0 /EnMH/uxNs+sUnSvlDML728wjfPBCf0qoYjW2E2OI1lvQrAfaqPKK1bwTLigh2epHh ylsNrRySRExqW7qE4QGKTxQMvbE2hto99QEyX+iXgtpfxfiEBUvIYbrl+gTVsisQED xhy+P2tD931YQ== From: Luke Howard Content-Type: multipart/alternative; boundary="Apple-Mail=_E36B61DF-9135-41CF-9BA4-0AE278776AA1" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) Date: Tue, 30 Jun 2020 17:22:28 +1000 References: <5822327E-C113-447B-AAB8-34902F585566@padl.com> <0674f16b-742c-8e4b-ee56-7112242684ed@secure-endpoints.com> <20200426044120.GD18021@localhost> <18CAFEE0-179F-427F-B661-7BBF68DE7233@padl.com> To: "kitten@ietf.org" In-Reply-To: <18CAFEE0-179F-427F-B661-7BBF68DE7233@padl.com> Message-Id: <4AAACA11-B421-4FAD-AE61-0F0E48C88BB2@padl.com> X-Mailer: Apple Mail (2.3608.80.23.2.2) Archived-At: Subject: Re: [kitten] SAnon kitten adoption X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jun 2020 07:22:37 -0000 --Apple-Mail=_E36B61DF-9135-41CF-9BA4-0AE278776AA1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Just gently nudging this along :) I=E2=80=99ll update for IANA assignments soon. > On 13 May 2020, at 12:21 pm, Luke Howard = wrote: >=20 > So =E2=80=93 how do we move this forward? I realise I probably need to = update to request an IANA assignment if it=E2=80=99s going to be = standards track. >=20 > Luke Howard > web / facebook = / instagram = / spotify = >=20 >> On 6 May 2020, at 8:26 am, Jeffrey Altman = > = wrote: >>=20 >> On 5/5/2020 5:00 PM, Robbie Harwood wrote: >>> Nico Williams > = writes: >>>=20 >>>> On Sun, Apr 26, 2020 at 12:02:16AM -0400, Jeffrey Altman wrote: >>>>=20 >>>>> SAnon will be implemented in Heimdal. I would be interested in = seeing >>>>> it adaopted by Kitten as a standards track document. >>>>=20 >>>> Me too. >>>=20 >>> Hearing no objections, seeing voices in favor, and an implementation = for >>> Heimdal, SAnon has been adopted for work in kitten and is now known = as >>> draft-ietf-kitten-gss-sanon. >>=20 >> Thank you Robbie. >>=20 >> There is also an implementation as a mechanism plugin for MIT that = works >> with RHEL7/8. >>=20 >> Jeffrey Altman >>=20 >>=20 >> _______________________________________________ >> Kitten mailing list >> Kitten@ietf.org >> https://www.ietf.org/mailman/listinfo/kitten >=20 > _______________________________________________ > Kitten mailing list > Kitten@ietf.org > https://www.ietf.org/mailman/listinfo/kitten --Apple-Mail=_E36B61DF-9135-41CF-9BA4-0AE278776AA1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Just = gently nudging this along :)

I=E2=80=99ll update for IANA assignments = soon.

On 13 May 2020, at 12:21 pm, Luke Howard <lukeh=3D40padl.com@dmarc.ietf.org> wrote:

So =E2=80=93 how do we = move this forward? I realise I probably need to update to request an = IANA assignment if it=E2=80=99s going to be standards track.

Luke Howard
web / facebook / instagram / spotify

On 6 May 2020, at 8:26 am, Jeffrey Altman <jaltman@secure-endpoints.com> wrote:

On = 5/5/2020 5:00 PM, Robbie Harwood wrote:
Nico Williams <nico@cryptonector.com> writes:

On Sun, Apr 26, 2020 at = 12:02:16AM -0400, Jeffrey Altman wrote:

SAnon will be = implemented in Heimdal.  I would be interested in seeing
it adaopted by Kitten as a standards track document.

Me too.

Hearing no objections, seeing = voices in favor, and an implementation for
Heimdal, SAnon = has been adopted for work in kitten and is now known as
draft-ietf-kitten-gss-sanon.

Thank you Robbie.

There is also = an implementation as a mechanism plugin for MIT that works
with RHEL7/8.

Jeffrey Altman


_______________________________________________
Kitten mailing list
Kitten@ietf.org
https://www.ietf.org/mailman/listinfo/kitten

_______________________________________________
Kitten mailing list
Kitten@ietf.org
https://www.ietf.org/mailman/listinfo/kitten

= --Apple-Mail=_E36B61DF-9135-41CF-9BA4-0AE278776AA1--