From nea-bounces@ietf.org Wed Apr 2 04:32:53 2008 Return-Path: X-Original-To: nea-archive@megatron.ietf.org Delivered-To: ietfarch-nea-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2EF4A3A69D1; Wed, 2 Apr 2008 04:32:53 -0700 (PDT) X-Original-To: nea@core3.amsl.com Delivered-To: nea@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4C49128C235 for ; Wed, 2 Apr 2008 04:32:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xkTED-NzxrjT for ; Wed, 2 Apr 2008 04:32:48 -0700 (PDT) Received: from sj-iport-5.cisco.com (sj-iport-5.cisco.com [171.68.10.87]) by core3.amsl.com (Postfix) with ESMTP id 4262628C55E for ; Wed, 2 Apr 2008 04:32:24 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.25,593,1199692800"; d="scan'208";a="19610225" Received: from sj-dkim-4.cisco.com ([171.71.179.196]) by sj-iport-5.cisco.com with ESMTP; 02 Apr 2008 04:32:19 -0700 Received: from sj-core-2.cisco.com (sj-core-2.cisco.com [171.71.177.254]) by sj-dkim-4.cisco.com (8.12.11/8.12.11) with ESMTP id m32BWJsd018950; Wed, 2 Apr 2008 04:32:19 -0700 Received: from xbh-rtp-201.amer.cisco.com (xbh-rtp-201.cisco.com [64.102.31.12]) by sj-core-2.cisco.com (8.13.8/8.13.8) with ESMTP id m32BWFI6025364; Wed, 2 Apr 2008 11:32:19 GMT Received: from xmb-rtp-205.amer.cisco.com ([64.102.31.59]) by xbh-rtp-201.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 2 Apr 2008 07:32:15 -0400 X-Mimeole: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 2 Apr 2008 07:31:54 -0400 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Result of consensus check on NEA protocol proposals and next steps Thread-Index: AciLedL/jNskn3kaQ2ujvSjswSD6DgI/AGJA From: "Susan Thomson (sethomso)" To: X-OriginalArrivalTime: 02 Apr 2008 11:32:15.0954 (UTC) FILETIME=[33D35B20:01C894B5] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=3052; t=1207135939; x=1207999939; c=relaxed/simple; s=sjdkim4002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=sethomso@cisco.com; z=From:=20=22Susan=20Thomson=20(sethomso)=22=20 |Subject:=20Result=20of=20consensus=20check=20on=20NEA=20pr otocol=20proposals=20and=20next=20steps |Sender:=20; bh=q9Xff/TUF6B+ygIZTAampsg5ziYWGug92oUOVR8XXvc=; b=Tco9A+knX+FfxW14KiM3tK4vaZZLrrgXYcfY/k6ZOJ0nwTtfhEmAsUMOPN MRIcbQnxBjuT8mGSOgzvvaLTpswm0adh9Zp/M0MvCv6TvHOZwyFcierNtszk NI+2q4JDb5; Authentication-Results: sj-dkim-4; header.From=sethomso@cisco.com; dkim=pass ( sig from cisco.com/sjdkim4002 verified; ); Subject: [Nea] Result of consensus check on NEA protocol proposals and next steps X-BeenThere: nea@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Network Endpoint Assessment discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: nea-bounces@ietf.org Errors-To: nea-bounces@ietf.org Based on the mailing list responses, we have confirmed the consensus check taken at the NEA WG meeting at IETF 71 to: 1. adopt PA-TNC as a WG draft 2. adopt PB-TNC as a WG draft 3. defer action on PA-TNC security until further progress has been made on PA-TNC and PB-TNC. Next Steps: As discussed at the last IETF meeting, the editors of the PA-TNC and PB-TNC I-Ds will publish these drafts without change as -00 versions of the NEA WG drafts. We will now start to work on -01 version of the drafts. If you have not done so already, please submit detailed comments regarding both PA and PB drafts as soon as you can. We would like to set a target date of getting the first round of comments in by April 25, so that the WG can discuss these on the mailing list, and the editors of both documents can draft a -01 version for review based on WG feedback, in a timely manner. Thanks Susan and Steve -----Original Message----- From: Susan Thomson (sethomso) Sent: Friday, March 21, 2008 1:35 PM To: nea@ietf.org Cc: Stephen Hanna Subject: Judging consensus on NEA protocol proposals In a previous email to the NEA WG mailing list prior to the IETF, we requested feedback regarding adopting the following Internet Drafts as WG drafts for PA, PB, PA Security respectively. The drafts are: http://tools.ietf.org/wg/nea/draft-sangster-nea-pa-tnc-00.txt http://tools.ietf.org/wg/nea/draft-sahita-nea-pb-tnc-00.txt http://tools.ietf.org/wg/nea/draft-sangster-nea-pa-tnc-security-00.txt At IETF 71, we reviewed these proposals and the following consensus question was raised for each draft: "Do you support adopting the draft as a WG draft?" 1. Yes 2. No 3. Defer 1) means that the draft is regarded as a good foundation for a WG -00 draft. It does NOT mean adopting the draft "AS IS". The draft will be treated as any I-D -00 version where updates are made based on WG consensus. 2) means that the draft would not form a good basis for a WG draft. 3) means to defer a decision based on some further action taking place. The clear consensus at the meeting at IETF 71 was to support adopting PA-TNC and PB-TNC as WG drafts, and to defer the decision on the adoption of PA-TNC Security until more work has been done on the PA and PB protocols so that the security implications are better understood. We need to confirm this consensus on the NEA WG email list. Please respond to this email and indicate if you agree or disagree with the decisions above. Even if you participated in the discussion and consensus check at IETF 71, it is important for you to participate in this email consensus check. A simple "Agree" email will suffice, but if you disagree with a decision on any one of the drafts, or want to say more, a longer email is certainly OK also. If there is no consensus, we will need to discuss the matter by email until we can reach rough consensus. This consensus check will close after one week (at 5 PM EDT on Friday, March 28). Thanks Susan and Steve _______________________________________________ Nea mailing list Nea@ietf.org https://www.ietf.org/mailman/listinfo/nea From nea-bounces@ietf.org Fri Apr 4 14:15:14 2008 Return-Path: X-Original-To: nea-archive@megatron.ietf.org Delivered-To: ietfarch-nea-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 603C83A6FD3; Fri, 4 Apr 2008 14:15:14 -0700 (PDT) X-Original-To: nea@ietf.org Delivered-To: nea@core3.amsl.com Received: by core3.amsl.com (Postfix, from userid 0) id B93FE3A6CA1; Fri, 4 Apr 2008 14:15:05 -0700 (PDT) Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Message-Id: <20080404211506.B93FE3A6CA1@core3.amsl.com> Date: Fri, 4 Apr 2008 14:15:06 -0700 (PDT) Cc: nea@ietf.org Subject: [Nea] I-D ACTION:draft-ietf-nea-pb-tnc-00.txt X-BeenThere: nea@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Network Endpoint Assessment discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: nea-bounces@ietf.org Errors-To: nea-bounces@ietf.org --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Network Endpoint Assessment Working Group of the IETF. Title : PB-TNC: A Posture Broker Protocol (PB) Compatible with TNC Author(s) : R. Sahita, S. Hanna, R. Hurst Filename : draft-ietf-nea-pb-tnc-00.txt Pages : 48 Date : 2008-4-4 This document specifies PB-TNC, a Posture Broker Protocol identical to the Trusted Computing Group's IF-TNCCS 2.0 protocol. The document then evaluates PB-TNC against the requirements defined in the NEA Requirements specification. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-nea-pb-tnc-00.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-nea-pb-tnc-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2008-4-4140757.I-D@ietf.org> --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Nea mailing list Nea@ietf.org https://www.ietf.org/mailman/listinfo/nea --NextPart-- From nea-bounces@ietf.org Fri Apr 11 14:15:04 2008 Return-Path: X-Original-To: nea-archive@megatron.ietf.org Delivered-To: ietfarch-nea-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6722C28C118; Fri, 11 Apr 2008 14:15:04 -0700 (PDT) X-Original-To: nea@ietf.org Delivered-To: nea@core3.amsl.com Received: by core3.amsl.com (Postfix, from userid 0) id 5C1403A6AC8; Fri, 11 Apr 2008 14:15:01 -0700 (PDT) Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Message-Id: <20080411211502.5C1403A6AC8@core3.amsl.com> Date: Fri, 11 Apr 2008 14:15:02 -0700 (PDT) Cc: nea@ietf.org Subject: [Nea] I-D ACTION:draft-ietf-nea-pa-tnc-00.txt X-BeenThere: nea@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Network Endpoint Assessment discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: nea-bounces@ietf.org Errors-To: nea-bounces@ietf.org --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Network Endpoint Assessment Working Group of the IETF. Title : PA-TNC: A Posture Attribute Protocol (PA) Compatible with TNC Author(s) : P. Sangster Filename : draft-ietf-nea-pa-tnc-00.txt Pages : 58 Date : 2008-4-11 This document specifies PA-TNC, a Posture Attribute Protocol identical to the Trusted Computing Group's IF-M 1.0 protocol. The document then evaluates PA-TNC against the requirements defined in the NEA Requirements specification. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-nea-pa-tnc-00.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-nea-pa-tnc-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2008-4-11140347.I-D@ietf.org> --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Nea mailing list Nea@ietf.org https://www.ietf.org/mailman/listinfo/nea --NextPart-- From nea-bounces@ietf.org Tue Apr 15 12:54:02 2008 Return-Path: X-Original-To: nea-archive@megatron.ietf.org Delivered-To: ietfarch-nea-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 30CEF28C212; Tue, 15 Apr 2008 12:54:02 -0700 (PDT) X-Original-To: nea@core3.amsl.com Delivered-To: nea@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 173F73A6AC1 for ; Tue, 15 Apr 2008 12:54:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w5NdMd6D1V4q for ; Tue, 15 Apr 2008 12:53:59 -0700 (PDT) Received: from rtp-iport-1.cisco.com (rtp-iport-1.cisco.com [64.102.122.148]) by core3.amsl.com (Postfix) with ESMTP id C53873A6AC0 for ; Tue, 15 Apr 2008 12:53:58 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.25,661,1199682000"; d="scan'208";a="5210619" Received: from rtp-dkim-1.cisco.com ([64.102.121.158]) by rtp-iport-1.cisco.com with ESMTP; 15 Apr 2008 15:54:31 -0400 Received: from rtp-core-1.cisco.com (rtp-core-1.cisco.com [64.102.124.12]) by rtp-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id m3FJsVHN016708; Tue, 15 Apr 2008 15:54:31 -0400 Received: from xbh-rtp-211.amer.cisco.com (xbh-rtp-211.cisco.com [64.102.31.102]) by rtp-core-1.cisco.com (8.13.8/8.13.8) with ESMTP id m3FJsV4i006010; Tue, 15 Apr 2008 19:54:31 GMT Received: from xmb-rtp-205.amer.cisco.com ([64.102.31.59]) by xbh-rtp-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 15 Apr 2008 15:54:31 -0400 X-Mimeole: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Tue, 15 Apr 2008 15:54:03 -0400 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Draft NEA WG minutes for IETF71 Thread-Index: AcifMnTGyRweSDEkRrmwaKKZpTVWjw== From: "Susan Thomson (sethomso)" To: X-OriginalArrivalTime: 15 Apr 2008 19:54:31.0027 (UTC) FILETIME=[85195430:01C89F32] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=10854; t=1208289271; x=1209153271; c=relaxed/simple; s=rtpdkim1001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=sethomso@cisco.com; z=From:=20=22Susan=20Thomson=20(sethomso)=22=20 |Subject:=20Draft=20NEA=20WG=20minutes=20for=20IETF71 |Sender:=20 |To:=20; bh=qE1YbwKUwdJ5CbXZixeb5ga5EgMIidZQBxn95hl8G4k=; b=K3CrgrOIXRl030Eboi8SQazFEw9OqXRHtub4OzPA0Pgr4vi8D1QW85sJem YWjz0uUkCtDrbHt0cG4Qc+1zWWla9OQUmJ+Iffhj5MqFwOhnnV/E4G4ELjze eJR1hF7AWo; Authentication-Results: rtp-dkim-1; header.From=sethomso@cisco.com; dkim=pass ( sig from cisco.com/rtpdkim1001 verified; ); Subject: [Nea] Draft NEA WG minutes for IETF71 X-BeenThere: nea@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Network Endpoint Assessment discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: nea-bounces@ietf.org Errors-To: nea-bounces@ietf.org Below are the draft minutes for the NEA WG for IETF71. Please send corrections to Steve and me by Monday 4/21. Thanks very much to the note-takers, Hormuzd Khosravi and Nancy Winget. Susan --------------------------------------------------- These notes do not attempt to duplicate the content of the slides. Instead, they summarize the material presented, and focus on comments and discussion. Agenda: Date: Tuesday, March 11, 2008 Time: 0900-1130 EST (GMT-0500) WG Charter: http://www.ietf.org/html.charters/nea-charter.html WG Tools: http://tools.ietf.org/wg/nea WG email: nea@ietf.org 0900 Administrivia Blue Sheets Jabber & Minute scribes Agenda bashing 0905 WG Status 0910 Discuss IESG Requested Changes to NEA Requirements draft draft-ietf-nea-requirements-06.txt 0930 Review Proposals for NEA Protocols:PB-TNC, PA-TNC, PA-TNC Security draft-sahita-nea-pb-tnc-00.txt draft-sangster-nea-pa-tnc-00.txt draft-sangster-nea-pa-tnc-security-00.txt 1100 Consensus Check - Shall We Adopt These As WG Drafts? (To Be Confirmed On List) 1120 Review Milestones 1130 Adjourn WG Status: Susan Thomson reviewed WG status since the last IETF. --- Nea-requirements-05 submitted to IESG (12/6/2007) --- IETF Last Call issued (12/10/2007-12/24/2007) --- Call for PA and PB proposals (01/03/2008) --- IESG reviewed nea-requirements-05 (1/10/2008) --- IESG reviewed nea-requirements-06 (1/28/2008) --- PA and PB candidate submissions (2/18/2008) draft-sangster-nea-pa-tnc-00.txt draft-sahita-nea-pb-tnc-00.txt draft-sangster-nea-pa-tnc-security-00.txt Meeting Goals: Susan stated there were two main goals for the meeting: 1. Resolve remaining IESG issues with the NEA requirements draft 2. Determine WG consensus for adopting candidate proposals as WG drafts --- PB-TNC --- PA-TNC --- PA-TNC Security Consensus Check process: Susan reviewed the consensus check process. An initial consensus check would be taken at the end of the meeting after the candidate proposals have been reviewed, and then the same check would be done on the mailing list. For each of the proposed drafts, the following question would be asked: Do you support adoption as WG draft? Possible answers: 1. Yes 2. No 3. Defer 1) means that the draft is regarded as a good foundation for a WG -00 draft. The draft will be treated as any I-D -00 version where updates are made based on WG consensus. 2) means that the draft would not form a good basis for a WG draft. 3) means to defer a decision based on some further action taking place. NEA Requirements Status: Kaushik Narayan reviewed the changes that had been made to the NEA requirements draft based on IESG feedback. One concern has been that some PT choices would not be able to meet requirements for reliable bulk data transfer. A change has been made to Section 5.2.3. of -06 version of the requirements draft to acknowledge that one PT may not be able to meet all requirements and describes possible deployment considerations. Tim Polk said that he thought the IESG wanted to see a new requirement for PT. Steve Hanna said he thought this could be addressed through a wording change. Tim responded that if that addresses the IESG concern, then that would be ok. Steve said that, either way, this change would need to return to mailing list. Another IESG concern had been regarding MITM attacks on NEA endpoints, and attacks on components that trigger posture assessment. Clarifying text has been added to Section 8.1.3 to address these concerns. Other comments were mainly out of scope of NEA WG charter. GEN ART review comments have been addressed in -06 version. Alan Breese raised the issue of dealing with the lying endpoint problem. Tim pointed out that this was outside the scope of the charter, although the intent is that the NEA WG protocols accommodate solutions to addressing this problem. Susan asked about next steps for addressing IESG concerns re the requirements draft. Steve responded that Paul Sangster is working with the IESG to resolve the PT concern. A new -07 version will be posted and changes reviewed by the mailing list prior to sending to the IESG. Review of PB-TNC: Steve described the PB-TNC protocol for carrying PB messages between a Posture Broker Client and Server. He reviewed the protocol requirements, state machine and protocol format, and then took questions from the working group. Kaushik said he would send editorial comments to the mailing list. Kaushik asked about how the protocol handled multiple sessions, possibly over multiple PTs. Steve responded that multiple sessions can be supported by assigning a different connection ID or socket number to each session. This would be handled through APIs, which are not in scope for this WG. Kaushik raised the issue of supporting server-initiated reassessment given the half-duplex nature of the protocol. Steve responded that this is an important issue. If the WG consensus is to address this issue, it could be in a subsequent draft. Tim added that adoption of this proposal as a -00 draft does not preclude such changes, assuming it is agreed that the draft provides a sound foundation for doing so. It is good to highlight such issues, but the draft should not be regarded as fully baked. Gary Tomlinson says there are issues to be worked through, but believed the draft provides a solid starting point. Yaron Sheffer queried the size of the Private Enterprise Number. Steve clarified that it was 24 bits. Yaron asked whether there was a need for conflict resolution if two servers initiated a posture exchange at the same time. Steve said the assumption is that this use case would be supported through distinct sessions. Yaron asked for clarification regarding how information was routed between Posture Collectors and Validators. Are Posture Collector Indetifier (PCI) and Posture Validator Identifier (PVI) types or instances? Steve answered that the PA subtype indicates the type of information the PC and PV are reporting on e.g. anti-virus. PCI and PVI indicate the instance. Kaushik asked about the reason for vendor-specific identifiers in PB. Steve responded that this supports vendor-specific PB message types. Kaushik says need to take offline to clarify. Susan asked why assertion attributes had been omitted from the spec. Steve said it was not part of the requirements. There was no particular reason for omitting it in the first version, but rather it was mainly due to lack of time to consider a proposal. Jeffery Dion asked about queuing up messages prior to sending them for efficiency purposes. Steve responded that this could be done, and was an implementation issues versus a protocol issue. PA-TNC Review: Steve described the PA-TNC protocol which carries posture attributes between one or more Posture Collectors and Validators. He reviewed the requirements, design and protocol format, and then took questions. Kaushik raised the question again of the need for vendor identifiers at both the PA and PB layers and suggested that there may be alternate ways to support vendor-specific attributes that could be taken to the list. Gary Tomlinson asked about constraints on port filter semantics. It was agreed to take this issue and comments on other posture attributes to the list. PA-TNC Security Review: Steve described the PA-TNC security protocol which secures communication between Posture Collectors and Validators and is based on Cryptographic Message Syntax (CMS). Steve also presented a list of concerns regarding the draft including the need for review by CMS experts, data size, implementation complexity and ease of configuration of PC and PV authorization. Michael Peck questioned the MUST requirement for including the signer's certificate. Steve agreed that client may not need it. Michael said there are many options in the spec which may need to be trimmed down. Kaushik shared Steve's concerns re deployability. He suggested deferring a decision on PA-TNC security until further progress has been made on PA and PB and the implications are better understood. Steve said that given the publish/subscribe model, there is some concern regarding the appropriate authorization for Posture Collectors and Validators. Gary concurs re concerns, and believes that most people will not need this level of security, and that PT security is sufficient. Kaushik added that one of the original reasons for PA security was because server components are not co-located. However, it is possible that the security issue can be addressed by securing the vertical protocol itself when it is defined. Steve agreed that this was one possible approach. Yaron asked whether mutual authentication is required at the PT layer. Steve answered yes. Yaron said that he is still confused on message routing between different components. Steve explained how individual instances of PC/PV are identified and clarified the use of the correlation ID. Gary added that the "wildcard" usage in PA needs to be clarified. Steve agreed and, said that, as Nancy pointed out on the mailing list, it would be good to have examples. Consensus Check: The following consensus question was raised for each draft: "Do you support adopting the draft as a WG draft?" 1. Yes 2. No 3. Defer There was unanimous support at the meeting for adopting PA-TNC and PB- TNC as WG drafts. A majority supported deferring the decision on the adoption of PA-TNC Security until more work has been done on the PA and PB protocols so that the protocol implications are better understood. Tim said that the next step is to post this same consensus check on the WG mailing list. Kaushik asked whether there are any IPR claims to be aware of. Steve says none that he is aware of so far. Milestone Review: Susan reviewed the milestones saying that these have not changed since review at the last meeting. They have been posted to the mailing list and no issues raised. Tim agreed that these milestones could be added to the charter now. Next Steps: If consensus holds on adopting PA-TNC and PB-TNC, Tim suggests these drafts be published as -00 WG drafts. The PA-TNC security draft should be left as an individual submission. Meeting adjourned. _______________________________________________ Nea mailing list Nea@ietf.org https://www.ietf.org/mailman/listinfo/nea From nea-bounces@ietf.org Fri Apr 18 13:15:08 2008 Return-Path: X-Original-To: nea-archive@megatron.ietf.org Delivered-To: ietfarch-nea-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 55A4D3A6EFB; Fri, 18 Apr 2008 13:15:08 -0700 (PDT) X-Original-To: nea@ietf.org Delivered-To: nea@core3.amsl.com Received: by core3.amsl.com (Postfix, from userid 0) id 24F543A691F; Fri, 18 Apr 2008 13:15:01 -0700 (PDT) Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Message-Id: <20080418201502.24F543A691F@core3.amsl.com> Date: Fri, 18 Apr 2008 13:15:02 -0700 (PDT) Cc: nea@ietf.org Subject: [Nea] I-D ACTION:draft-ietf-nea-requirements-07.txt X-BeenThere: nea@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Network Endpoint Assessment discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: nea-bounces@ietf.org Errors-To: nea-bounces@ietf.org --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Network Endpoint Assessment Working Group of the IETF. Title : Network Endpoint Assessment (NEA): Overview and Requirements Author(s) : P. Sangster Filename : draft-ietf-nea-requirements-07.txt Pages : 53 Date : 2008-4-18 This document defines the problem statement, scope and protocol requirements between the components of the NEA (Network Endpoint Assessment) reference model. NEA provides owners of networks (e.g. an enterprise offering remote access) a mechanism to evaluate the posture of a system. This may take place during the request for network access and/or subsequently at any time while connected to the network. The learned posture information can then be applied to a variety of compliance oriented decisions. The posture information is frequently useful for detecting systems that are lacking or have out of date security protective mechanisms such as: anti-virus and host-based firewall software. In order to provide context for the requirements, a reference model and terminology are introduced. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-nea-requirements-07.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-nea-requirements-07.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2008-4-18130904.I-D@ietf.org> --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Nea mailing list Nea@ietf.org https://www.ietf.org/mailman/listinfo/nea --NextPart-- From nea-bounces@ietf.org Fri Apr 18 16:29:19 2008 Return-Path: X-Original-To: nea-archive@megatron.ietf.org Delivered-To: ietfarch-nea-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6A7A53A681C; Fri, 18 Apr 2008 16:29:19 -0700 (PDT) X-Original-To: nea@core3.amsl.com Delivered-To: nea@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 462C13A681C for ; Fri, 18 Apr 2008 16:29:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MGEdnzFH+-hz for ; Fri, 18 Apr 2008 16:29:17 -0700 (PDT) Received: from extu-mxob-2.symantec.com (extu-mxob-2.symantec.com [216.10.194.135]) by core3.amsl.com (Postfix) with ESMTP id 5DB453A67FC for ; Fri, 18 Apr 2008 16:29:17 -0700 (PDT) Received: from tus1opsmtapin01.ges.symantec.com (tus1opsmtapin01.ges.symantec.com [192.168.214.43]) by extu-mxob-2.symantec.com (8.14.1/8.14.1) with ESMTP id m3INTJbB000341 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 18 Apr 2008 16:29:19 -0700 Received: from reserved-155-64-230-18.ges.symantec.com ([155.64.230.18] helo=TUS1XCHECNPIN01.enterprise.veritas.com) by tus1opsmtapin01.ges.symantec.com with esmtp (Exim 4.67) (envelope-from ) id 1Jn019-0000Ll-He for nea@ietf.org; Fri, 18 Apr 2008 16:29:19 -0700 Received: from TUS1XCHEVSPIN05.enterprise.veritas.com ([155.64.231.28]) by TUS1XCHECNPIN01.enterprise.veritas.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 18 Apr 2008 16:29:19 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Fri, 18 Apr 2008 16:28:40 -0700 Message-ID: In-Reply-To: <20080418201502.24F543A691F@core3.amsl.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [Nea] I-D ACTION:draft-ietf-nea-requirements-07.txt Thread-Index: AcihkfvzR0W9kBVQQNGDlVtTUNg1iQAFWUgQ References: <20080418201502.24F543A691F@core3.amsl.com> From: "Paul Sangster" To: X-OriginalArrivalTime: 18 Apr 2008 23:29:19.0526 (UTC) FILETIME=[067B7460:01C8A1AC] Subject: Re: [Nea] I-D ACTION:draft-ietf-nea-requirements-07.txt X-BeenThere: nea@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Network Endpoint Assessment discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: nea-bounces@ietf.org Errors-To: nea-bounces@ietf.org As everyone noticed from the mail below, we have submitted an update to the overview and requirements specification. The additions were to address comments raised by the IESG review. This revision includes 3 notable changes. Two of the changes involve the use of the NEA protocols in constrained environments, specifically: a new common requirement (C-11) and a discussion of the issue in section 5.2.3 (paragraphs 2 and 3) with regard to the PT protocol. The third change was to add to the description of potential man in the middle threats at the end of section 8.3.1. Because we added significant text and in particular a new requirement, we believe the new portions of the document require another WG review prior to returning to the IESG review. Please review the changes and send any significant issues. Paul > -----Original Message----- > From: nea-bounces@ietf.org [mailto:nea-bounces@ietf.org] On > Behalf Of Internet-Drafts@ietf.org > Sent: Friday, April 18, 2008 1:15 PM > To: i-d-announce@ietf.org > Cc: nea@ietf.org > Subject: [Nea] I-D ACTION:draft-ietf-nea-requirements-07.txt > > A New Internet-Draft is available from the on-line > Internet-Drafts directories. > This draft is a work item of the Network Endpoint Assessment > Working Group of the IETF. > > Title : Network Endpoint Assessment (NEA): > Overview and Requirements > Author(s) : P. Sangster > Filename : draft-ietf-nea-requirements-07.txt > Pages : 53 > Date : 2008-4-18 > > This document defines the problem statement, scope and protocol > requirements between the components of the NEA (Network Endpoint > Assessment) reference model. NEA provides owners of networks > (e.g. an enterprise offering remote access) a mechanism to > evaluate the posture of a system. This may take place during the > request for network access and/or subsequently at any time while > connected to the network. The learned posture information can > then be applied to a variety of compliance oriented decisions. > The posture information is frequently useful for detecting > systems that are lacking or have out of date security protective > mechanisms such as: anti-virus and host-based firewall software. > In order to provide context for the requirements, a reference > model and terminology are introduced. > > A URL for this Internet-Draft is: > http://www.ietf.org/internet-drafts/draft-ietf-nea-requirements-07.txt > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > Below is the data which will enable a MIME compliant mail > reader implementation to automatically retrieve the ASCII > version of the Internet-Draft. > _______________________________________________ Nea mailing list Nea@ietf.org https://www.ietf.org/mailman/listinfo/nea From nea-bounces@ietf.org Wed Apr 30 15:42:05 2008 Return-Path: X-Original-To: nea-archive@megatron.ietf.org Delivered-To: ietfarch-nea-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D06903A6A33; Wed, 30 Apr 2008 15:42:05 -0700 (PDT) X-Original-To: nea@core3.amsl.com Delivered-To: nea@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0375A3A695F for ; Wed, 30 Apr 2008 15:42:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UkswWj3TWLBm for ; Wed, 30 Apr 2008 15:42:04 -0700 (PDT) Received: from sj-iport-6.cisco.com (sj-iport-6.cisco.com [171.71.176.117]) by core3.amsl.com (Postfix) with ESMTP id 95CED3A68B0 for ; Wed, 30 Apr 2008 15:42:03 -0700 (PDT) Received: from sj-dkim-2.cisco.com ([171.71.179.186]) by sj-iport-6.cisco.com with ESMTP; 30 Apr 2008 15:42:06 -0700 Received: from sj-core-1.cisco.com (sj-core-1.cisco.com [171.71.177.237]) by sj-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id m3UMg6Ux031305; Wed, 30 Apr 2008 15:42:06 -0700 Received: from xbh-rtp-201.amer.cisco.com (xbh-rtp-201.cisco.com [64.102.31.12]) by sj-core-1.cisco.com (8.13.8/8.13.8) with ESMTP id m3UMg6l6016501; Wed, 30 Apr 2008 22:42:06 GMT Received: from xmb-rtp-205.amer.cisco.com ([64.102.31.59]) by xbh-rtp-201.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 30 Apr 2008 18:42:05 -0400 X-Mimeole: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 30 Apr 2008 18:41:34 -0400 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: WGLC for comments on draft-ietf-nea-requirements-07.txt Thread-Index: AcirE1dsPsq9QvIqS06B5GGHc9G0CA== From: "Susan Thomson (sethomso)" To: X-OriginalArrivalTime: 30 Apr 2008 22:42:05.0795 (UTC) FILETIME=[6A676B30:01C8AB13] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1638; t=1209595326; x=1210459326; c=relaxed/simple; s=sjdkim2002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=sethomso@cisco.com; z=From:=20=22Susan=20Thomson=20(sethomso)=22=20 |Subject:=20WGLC=20for=20comments=20on=20=20draft-ietf-nea- requirements-07.txt |Sender:=20; bh=RlxGLPZEtSeg1evWkPrrQMoKiBrGvC7jgG6TR/7gnf4=; b=bz6mQhIdV1wFBkY8nzNh9ddA1sLP0ZESnayRFRlcBW5FCPYU1Dds1pZ6zd JNa85b+qw2ILG7Ona9mfTTaXeHK1Yfl1TH47bSywLN98BTgVxSQXdFlzJqsZ FEHB9qQhaH; Authentication-Results: sj-dkim-2; header.From=sethomso@cisco.com; dkim=pass ( sig from cisco.com/sjdkim2002 verified; ); Subject: [Nea] WGLC for comments on draft-ietf-nea-requirements-07.txt X-BeenThere: nea@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Network Endpoint Assessment discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: nea-bounces@ietf.org Errors-To: nea-bounces@ietf.org A revised version of the NEA requirements draft has been posted (-07), addressing comments received during the IESG review. Please see Paul Sangster's message below regarding the few specific updates made. The draft specification is at: http://www.ietf.org/internet-drafts/draft-ietf-nea-requirements-07.txt We are now issuing a WG Last Call for comments on the updated document. Please review the changes and send any comments to the NEA mailing list. This WG Last Call will end on May 14, two weeks from today. Thanks Steve and Susan -----Original Message----- From: nea-bounces@ietf.org [mailto:nea-bounces@ietf.org] On Behalf Of Paul Sangster Sent: Friday, April 18, 2008 7:29 PM To: nea@ietf.org Subject: Re: [Nea] I-D ACTION:draft-ietf-nea-requirements-07.txt As everyone noticed from the mail below, we have submitted an update to the overview and requirements specification. The additions were to address comments raised by the IESG review. This revision includes 3 notable changes. Two of the changes involve the use of the NEA protocols in constrained environments, specifically: a new common requirement (C-11) and a discussion of the issue in section 5.2.3 (paragraphs 2 and 3) with regard to the PT protocol. The third change was to add to the description of potential man in the middle threats at the end of section 8.3.1. Because we added significant text and in particular a new requirement, we believe the new portions of the document require another WG review prior to returning to the IESG review. Please review the changes and send any significant issues. Paul _______________________________________________ Nea mailing list Nea@ietf.org https://www.ietf.org/mailman/listinfo/nea