From nobody Tue Mar 4 03:06:50 2014 Return-Path: X-Original-To: nea@ietfa.amsl.com Delivered-To: nea@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7758C1A0495 for ; Tue, 4 Mar 2014 03:06:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.047 X-Spam-Level: X-Spam-Status: No, score=-15.047 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.547, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xw_7-VNJjVmH for ; Tue, 4 Mar 2014 03:06:45 -0800 (PST) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by ietfa.amsl.com (Postfix) with ESMTP id D75141A069C for ; Tue, 4 Mar 2014 03:06:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1801; q=dns/txt; s=iport; t=1393931202; x=1395140802; h=from:to:subject:date:message-id:references:mime-version; bh=bHkNaaEFL/BDUFUrDvb2ifp2dg8B3/EZ1wE0j9jCdiU=; b=aWR8AEYjHg80XCN9PSdoWSjXAXd8ZpVQnCzEqjmTuDFpcbzf7vsstHK4 O7LVSfPdeCe2uLnCHG7SpCMmMfnWLPGqv3pMlnwOcZfZ9NfY4E6q7sHsG UDRTEhcc1418YWzPjnx1x6vxJv2GFoG8xhBSZLxFJYFFyohhRT5klJxps A=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: ApYRAPCyFVOtJXG//2dsb2JhbABagwY7V4gWuFeBIBZ0ghwKAQEEgQkCAQsBQjIbCgIEiAzMPRMEjk2DL4EUBJg8kiuDLYIq X-IronPort-AV: E=Sophos;i="4.97,584,1389744000"; d="scan'208,217";a="307716135" Received: from rcdn-core2-4.cisco.com ([173.37.113.191]) by rcdn-iport-1.cisco.com with ESMTP; 04 Mar 2014 11:06:40 +0000 Received: from xhc-aln-x13.cisco.com (xhc-aln-x13.cisco.com [173.36.12.87]) by rcdn-core2-4.cisco.com (8.14.5/8.14.5) with ESMTP id s24B6elC029480 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Tue, 4 Mar 2014 11:06:40 GMT Received: from xmb-rcd-x09.cisco.com ([169.254.9.247]) by xhc-aln-x13.cisco.com ([173.36.12.87]) with mapi id 14.03.0123.003; Tue, 4 Mar 2014 05:06:40 -0600 From: "Joseph Salowey (jsalowey)" To: "nea@ietf.org" Thread-Topic: [TLS] MITM Attacks on Client Authentication after Resumption Thread-Index: AQHPNvQ8MwvLIF45O0S80vyn0IwaCw== Date: Tue, 4 Mar 2014 11:06:39 +0000 Message-ID: References: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.61.222.63] Content-Type: multipart/alternative; boundary="_000_BCE812CEA07A43399D8828D07BFA0490ciscocom_" MIME-Version: 1.0 Archived-At: http://mailarchive.ietf.org/arch/msg/nea/6p0imR-ykRtlpjSTGGt3OjPZ0ho Subject: [Nea] Fwd: [TLS] MITM Attacks on Client Authentication after Resumption X-BeenThere: nea@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Network Endpoint Assessment discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Mar 2014 11:06:47 -0000 --_000_BCE812CEA07A43399D8828D07BFA0490ciscocom_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable The link below details a vulnerability involving session resumption and TLS= channel bindings that is applicable to PT-TLS. There is ongoing discussio= n on the TLS and Kitten lists. https://secure-resumption.com Basically if the TLS connection is torn down and resumed before channel bin= ding within the EMA takes place a man-in-the-middle will not be discovered. Joe --_000_BCE812CEA07A43399D8828D07BFA0490ciscocom_ Content-Type: text/html; charset="Windows-1252" Content-ID: Content-Transfer-Encoding: quoted-printable The link below details a vulnerability involving session resumption and TLS= channel bindings that is applicable to PT-TLS.  There is ongoing disc= ussion on the TLS and Kitten lists.  


Basically if the TLS connection is torn down and resumed before channe= l binding within the EMA takes place a man-in-the-middle will not be discov= ered. 

Joe
--_000_BCE812CEA07A43399D8828D07BFA0490ciscocom_-- From nobody Thu Mar 27 07:19:04 2014 Return-Path: X-Original-To: nea@ietfa.amsl.com Delivered-To: nea@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B2AD1A06F6 for ; Thu, 27 Mar 2014 07:18:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.912 X-Spam-Level: X-Spam-Status: No, score=-1.912 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GN_T6MbABtXH for ; Thu, 27 Mar 2014 07:18:50 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [IPv6:2607:f170:8000:1500::d3]) by ietfa.amsl.com (Postfix) with ESMTP id 82A911A027F for ; Thu, 27 Mar 2014 07:18:50 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id E42C97FC396; Thu, 27 Mar 2014 07:18:47 -0700 (PDT) To: Paul_Sangster@symantec.com, kaushik@cisco.com, stephen.farrell@cs.tcd.ie, Kathleen.Moriarty.ietf@gmail.com, shanna@juniper.net, sethomso@cisco.com From: RFC Errata System Message-Id: <20140327141847.E42C97FC396@rfc-editor.org> Date: Thu, 27 Mar 2014 07:18:47 -0700 (PDT) Archived-At: http://mailarchive.ietf.org/arch/msg/nea/eaP24EOZr9YXMT9ltFv8jo4WzNY Cc: steve@hannas.com, nea@ietf.org, rfc-editor@rfc-editor.org Subject: [Nea] [Technical Errata Reported] RFC5792 (3935) X-BeenThere: nea@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Network Endpoint Assessment discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Mar 2014 14:18:56 -0000 The following errata report has been submitted for RFC5792, "PA-TNC: A Posture Attribute (PA) Protocol Compatible with Trusted Network Connect (TNC)". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata_search.php?rfc=5792&eid=3935 -------------------------------------- Type: Technical Reported by: Steve Hanna Section: 3.1 Original Text ------------- Each PA-TNC message may contain one or more attributes associated with the functional component identified in the component type (PA Subtype) of the Posture Broker (PB) protocol. Corrected Text -------------- Each PA-TNC message may contain zero or more attributes associated with the functional component identified in the component type (PA Subtype) of the Posture Broker (PB) protocol. Notes ----- Section 4 of RFC 5792 says “A PA-TNC message MUST contain a PA-TNC header (defined in section 3.6. followed by a sequence of zero or more PA-TNC attributes.” This contradicts the text in section 3.1, which says “one or more”. The correct text is “zero or more”. There’s no reason why a PA-TNC message containing zero attributes should be prohibited. For PA-TNC messages with some PA subtypes, an empty message containing no attributes may be enough. Instructions: ------------- This errata is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party (IESG) can log in to change the status and edit the report, if necessary. -------------------------------------- RFC5792 (draft-ietf-nea-pa-tnc-06) -------------------------------------- Title : PA-TNC: A Posture Attribute (PA) Protocol Compatible with Trusted Network Connect (TNC) Publication Date : March 2010 Author(s) : P. Sangster, K. Narayan Category : PROPOSED STANDARD Source : Network Endpoint Assessment Area : Security Stream : IETF Verifying Party : IESG From nobody Thu Mar 27 07:19:52 2014 Return-Path: X-Original-To: nea@ietfa.amsl.com Delivered-To: nea@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DB9C1A0700 for ; Thu, 27 Mar 2014 07:19:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.912 X-Spam-Level: X-Spam-Status: No, score=-1.912 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ltYkEZ-u5XiT for ; Thu, 27 Mar 2014 07:19:40 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [IPv6:2607:f170:8000:1500::d3]) by ietfa.amsl.com (Postfix) with ESMTP id 968FE1A072A for ; Thu, 27 Mar 2014 07:19:38 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id E71A87FC396; Thu, 27 Mar 2014 07:19:36 -0700 (PDT) To: Paul_Sangster@symantec.com, kaushik@cisco.com, stephen.farrell@cs.tcd.ie, Kathleen.Moriarty.ietf@gmail.com, shanna@juniper.net, sethomso@cisco.com From: RFC Errata System Message-Id: <20140327141936.E71A87FC396@rfc-editor.org> Date: Thu, 27 Mar 2014 07:19:36 -0700 (PDT) Archived-At: http://mailarchive.ietf.org/arch/msg/nea/HBqJf_2mnTivdDvF_eGGKPzTeG0 Cc: steve@hannas.com, nea@ietf.org, rfc-editor@rfc-editor.org Subject: [Nea] [Technical Errata Reported] RFC5792 (3936) X-BeenThere: nea@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Network Endpoint Assessment discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Mar 2014 14:19:45 -0000 The following errata report has been submitted for RFC5792, "PA-TNC: A Posture Attribute (PA) Protocol Compatible with Trusted Network Connect (TNC)". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata_search.php?rfc=5792&eid=3936 -------------------------------------- Type: Technical Reported by: Steve Hanna Section: 3.4 Original Text ------------- As depicted in section 3.2, a PA-TNC message consists of a PA-TNC header followed by a sequence of one or more attributes. Corrected Text -------------- As depicted in section 3.2, a PA-TNC message consists of a PA-TNC header followed by a sequence of zero or more attributes. Notes ----- Section 4 of RFC 5792 says “A PA-TNC message MUST contain a PA-TNC header (defined in section 3.6. followed by a sequence of zero or more PA-TNC attributes.” This contradicts the text in section 3.4, which says “one or more”. The correct text is “zero or more”. There’s no reason why a PA-TNC message containing zero attributes should be prohibited. For PA-TNC messages with some PA subtypes, an empty message containing no attributes may be enough. Instructions: ------------- This errata is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party (IESG) can log in to change the status and edit the report, if necessary. -------------------------------------- RFC5792 (draft-ietf-nea-pa-tnc-06) -------------------------------------- Title : PA-TNC: A Posture Attribute (PA) Protocol Compatible with Trusted Network Connect (TNC) Publication Date : March 2010 Author(s) : P. Sangster, K. Narayan Category : PROPOSED STANDARD Source : Network Endpoint Assessment Area : Security Stream : IETF Verifying Party : IESG From nobody Thu Mar 27 07:21:03 2014 Return-Path: X-Original-To: nea@ietfa.amsl.com Delivered-To: nea@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD4A21A069C for ; Thu, 27 Mar 2014 07:21:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cMilWXky-bMW for ; Thu, 27 Mar 2014 07:21:00 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) by ietfa.amsl.com (Postfix) with ESMTP id 76B8A1A0700 for ; Thu, 27 Mar 2014 07:20:59 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 6C036BDE3; Thu, 27 Mar 2014 14:20:57 +0000 (GMT) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P3EX6DmN231c; Thu, 27 Mar 2014 14:20:57 +0000 (GMT) Received: from [134.226.36.180] (stephen-think.dsg.cs.tcd.ie [134.226.36.180]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id EAE0FBDDC; Thu, 27 Mar 2014 14:20:56 +0000 (GMT) Message-ID: <533433C9.6010604@cs.tcd.ie> Date: Thu, 27 Mar 2014 14:20:57 +0000 From: Stephen Farrell User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.4.0 MIME-Version: 1.0 To: RFC Errata System , Paul_Sangster@symantec.com, kaushik@cisco.com, Kathleen.Moriarty.ietf@gmail.com, shanna@juniper.net, sethomso@cisco.com References: <20140327141847.E42C97FC396@rfc-editor.org> In-Reply-To: <20140327141847.E42C97FC396@rfc-editor.org> X-Enigmail-Version: 1.6 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit Archived-At: http://mailarchive.ietf.org/arch/msg/nea/hWAQaOJgTJkMoVXGpnnGma9PE38 Cc: steve@hannas.com, nea@ietf.org Subject: Re: [Nea] [Technical Errata Reported] RFC5792 (3935) X-BeenThere: nea@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Network Endpoint Assessment discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Mar 2014 14:21:02 -0000 Given that the WG chair is the reporter here I guess this is probably going to be ok to approve. I'll do so next week if nobody complains. But, Steve (H) please do send me a reminder? Errata are not naturally top of my list of things to do :-) Cheers, S. On 03/27/2014 02:18 PM, RFC Errata System wrote: > The following errata report has been submitted for RFC5792, > "PA-TNC: A Posture Attribute (PA) Protocol Compatible with Trusted Network Connect (TNC)". > > -------------------------------------- > You may review the report below and at: > http://www.rfc-editor.org/errata_search.php?rfc=5792&eid=3935 > > -------------------------------------- > Type: Technical > Reported by: Steve Hanna > > Section: 3.1 > > Original Text > ------------- > Each PA-TNC message may > contain one or more attributes associated with the functional > component identified in the component type (PA Subtype) of the > Posture Broker (PB) protocol. > > Corrected Text > -------------- > Each PA-TNC message may > contain zero or more attributes associated with the functional > component identified in the component type (PA Subtype) of the > Posture Broker (PB) protocol. > > Notes > ----- > Section 4 of RFC 5792 says “A PA-TNC message MUST contain a PA-TNC header (defined in section 3.6. followed by a sequence of zero or more PA-TNC attributes.” This contradicts the text in section 3.1, which says “one or more”. The correct text is “zero or more”. There’s no reason why a PA-TNC message containing zero attributes should be prohibited. For PA-TNC messages with some PA subtypes, an empty message containing no attributes may be enough. > > Instructions: > ------------- > This errata is currently posted as "Reported". If necessary, please > use "Reply All" to discuss whether it should be verified or > rejected. When a decision is reached, the verifying party (IESG) > can log in to change the status and edit the report, if necessary. > > -------------------------------------- > RFC5792 (draft-ietf-nea-pa-tnc-06) > -------------------------------------- > Title : PA-TNC: A Posture Attribute (PA) Protocol Compatible with Trusted Network Connect (TNC) > Publication Date : March 2010 > Author(s) : P. Sangster, K. Narayan > Category : PROPOSED STANDARD > Source : Network Endpoint Assessment > Area : Security > Stream : IETF > Verifying Party : IESG > > From nobody Thu Mar 27 07:27:53 2014 Return-Path: X-Original-To: nea@ietfa.amsl.com Delivered-To: nea@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFD7F1A0714 for ; Thu, 27 Mar 2014 07:27:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vYLOnWxEOBUh for ; Thu, 27 Mar 2014 07:27:48 -0700 (PDT) Received: from ch1outboundpool.messaging.microsoft.com (ch1ehsobe005.messaging.microsoft.com [216.32.181.185]) by ietfa.amsl.com (Postfix) with ESMTP id 611AF1A068A for ; Thu, 27 Mar 2014 07:27:48 -0700 (PDT) Received: from mail89-ch1-R.bigfish.com (10.43.68.232) by CH1EHSOBE005.bigfish.com (10.43.70.55) with Microsoft SMTP Server id 14.1.225.22; Thu, 27 Mar 2014 14:27:46 +0000 Received: from mail89-ch1 (localhost [127.0.0.1]) by mail89-ch1-R.bigfish.com (Postfix) with ESMTP id E035F20331; Thu, 27 Mar 2014 14:27:45 +0000 (UTC) X-Forefront-Antispam-Report: CIP:157.56.240.101; KIP:(null); UIP:(null); IPV:NLI; H:BL2PRD0510HT005.namprd05.prod.outlook.com; RD:none; EFVD:NLI X-SpamScore: -24 X-BigFish: VPS-24(zzbb2dI98dI9371I542I1432I4015Izz1f42h2148h208ch1ee6h1de0h1fdah2073h2146h1202h1e76h2189h1d1ah1d2ah21bch1fc6hzdchz1de098h1033IL17326ah172cdfh8275bh8275dh19a27bh1de097h186068hz2fh109h2a8h839h944hd24hf0ah1220h1288h12a5h12a9h12bdh137ah13b6h1441h1504h1537h153bh162dh1631h1758h18e1h1946h19b5h19ceh1ad9h1b0ah224fh1d07h1d0ch1d2eh1d3fh1de9h1dfeh1dffh1fe8h1ff5h2216h22d0h2336h2461h2487h24d7h2516h2545h255eh25cch25f6h2605h262fh268bh9a9j1155h) Received-SPF: pass (mail89-ch1: domain of juniper.net designates 157.56.240.101 as permitted sender) client-ip=157.56.240.101; envelope-from=shanna@juniper.net; helo=BL2PRD0510HT005.namprd05.prod.outlook.com ; .outlook.com ; X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(10009001)(6009001)(428001)(199002)(189002)(479174003)(377454003)(51704005)(24454002)(164054003)(13464003)(86362001)(15975445006)(95666003)(65816001)(47446002)(74502001)(74662001)(19580405001)(16799955002)(15188155005)(98676001)(87936001)(93136001)(51856001)(53806001)(2656002)(74706001)(94316002)(76576001)(76786001)(76796001)(93516002)(95416001)(66066001)(94946001)(19580395003)(87266001)(31966008)(76482001)(85306002)(83072002)(54356001)(85852003)(80022001)(15202345003)(81542001)(56776001)(63696002)(2201001)(69226001)(56816005)(74876001)(81342001)(92566001)(74366001)(90146001)(74316001)(77982001)(50986001)(83322001)(97336001)(79102001)(97186001)(20776003)(46102001)(33646001)(47736001)(4396001)(47976001)(54316002)(59766001)(49866001)(81816001)(80976001)(81686001)(24736002); DIR:OUT; SFP:1101; SCL:1; SRVR:BLUPR05MB740; H:BLUPR05MB737.namprd05.prod.outlook.com; FPR:E25CC181.AFD396CA.79F3BD43.4AF42281.203EE; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; L ANG:en; Received: from mail89-ch1 (localhost.localdomain [127.0.0.1]) by mail89-ch1 (MessageSwitch) id 1395930464226146_20360; Thu, 27 Mar 2014 14:27:44 +0000 (UTC) Received: from CH1EHSMHS035.bigfish.com (snatpool2.int.messaging.microsoft.com [10.43.68.239]) by mail89-ch1.bigfish.com (Postfix) with ESMTP id 2638A3A0076; Thu, 27 Mar 2014 14:27:44 +0000 (UTC) Received: from BL2PRD0510HT005.namprd05.prod.outlook.com (157.56.240.101) by CH1EHSMHS035.bigfish.com (10.43.70.35) with Microsoft SMTP Server (TLS) id 14.16.227.3; Thu, 27 Mar 2014 14:27:38 +0000 Received: from BLUPR05MB740.namprd05.prod.outlook.com (10.141.208.28) by BL2PRD0510HT005.namprd05.prod.outlook.com (10.255.100.40) with Microsoft SMTP Server (TLS) id 14.16.435.0; Thu, 27 Mar 2014 14:27:38 +0000 Received: from BLUPR05MB737.namprd05.prod.outlook.com (10.141.208.17) by BLUPR05MB740.namprd05.prod.outlook.com (10.141.208.28) with Microsoft SMTP Server (TLS) id 15.0.898.11; Thu, 27 Mar 2014 14:27:37 +0000 Received: from BLUPR05MB737.namprd05.prod.outlook.com ([10.141.208.17]) by BLUPR05MB737.namprd05.prod.outlook.com ([10.141.208.17]) with mapi id 15.00.0898.005; Thu, 27 Mar 2014 14:27:37 +0000 From: Stephen Hanna To: Stephen Farrell , RFC Errata System , "Paul_Sangster@symantec.com" , "kaushik@cisco.com" , "Kathleen.Moriarty.ietf@gmail.com" , "sethomso@cisco.com" Thread-Topic: [Nea] [Technical Errata Reported] RFC5792 (3935) Thread-Index: AQHPSceFvR0l2HhpbUemqofljyWBiZr0+/uAgAAAj2A= Date: Thu, 27 Mar 2014 14:27:36 +0000 Message-ID: <2b637dd56f544f4e91262d9d31353d19@BLUPR05MB737.namprd05.prod.outlook.com> References: <20140327141847.E42C97FC396@rfc-editor.org> <533433C9.6010604@cs.tcd.ie> In-Reply-To: <533433C9.6010604@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.14] x-forefront-prvs: 01630974C0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-FOPE-CONNECTOR: Id%0$Dn%*$RO%0$TLS%0$FQDN%$TlsDn% Archived-At: http://mailarchive.ietf.org/arch/msg/nea/vs2X5foLs7E6LRAnmrIyeAj3b-I Cc: "steve@hannas.com" , "nea@ietf.org" Subject: Re: [Nea] [Technical Errata Reported] RFC5792 (3935) X-BeenThere: nea@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Network Endpoint Assessment discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Mar 2014 14:27:51 -0000 Steve, The Trusted Computing Group team found these two errors when we were writing compliance tests for PA-TNC (which we call IF-M). Nothing like writing code to uncover bugs! I'll send you a reminder next week on these. If anyone has any further comments on the errata, please speak up now. Thanks, Steve > -----Original Message----- > From: Nea [mailto:nea-bounces@ietf.org] On Behalf Of Stephen Farrell > Sent: Thursday, March 27, 2014 10:21 AM > To: RFC Errata System; Paul_Sangster@symantec.com; kaushik@cisco.com; > Kathleen.Moriarty.ietf@gmail.com; Stephen Hanna; sethomso@cisco.com > Cc: steve@hannas.com; nea@ietf.org > Subject: Re: [Nea] [Technical Errata Reported] RFC5792 (3935) >=20 >=20 > Given that the WG chair is the reporter here I guess this > is probably going to be ok to approve. >=20 > I'll do so next week if nobody complains. >=20 > But, Steve (H) please do send me a reminder? Errata are > not naturally top of my list of things to do :-) >=20 > Cheers, > S. >=20 > On 03/27/2014 02:18 PM, RFC Errata System wrote: > > The following errata report has been submitted for RFC5792, > > "PA-TNC: A Posture Attribute (PA) Protocol Compatible with Trusted > Network Connect (TNC)". > > > > -------------------------------------- > > You may review the report below and at: > > http://www.rfc-editor.org/errata_search.php?rfc=3D5792&eid=3D3935 > > > > -------------------------------------- > > Type: Technical > > Reported by: Steve Hanna > > > > Section: 3.1 > > > > Original Text > > ------------- > > Each PA-TNC message may > > contain one or more attributes associated with the functional > > component identified in the component type (PA Subtype) of the > > Posture Broker (PB) protocol. > > > > Corrected Text > > -------------- > > Each PA-TNC message may > > contain zero or more attributes associated with the functional > > component identified in the component type (PA Subtype) of the > > Posture Broker (PB) protocol. > > > > Notes > > ----- > > Section 4 of RFC 5792 says "A PA-TNC message MUST contain a PA-TNC > header (defined in section 3.6. followed by a sequence of zero or more > PA-TNC attributes." This contradicts the text in section 3.1, which > says "one or more". The correct text is "zero or more". There's no > reason why a PA-TNC message containing zero attributes should be > prohibited. For PA-TNC messages with some PA subtypes, an empty message > containing no attributes may be enough. > > > > Instructions: > > ------------- > > This errata is currently posted as "Reported". If necessary, please > > use "Reply All" to discuss whether it should be verified or > > rejected. When a decision is reached, the verifying party (IESG) > > can log in to change the status and edit the report, if necessary. > > > > -------------------------------------- > > RFC5792 (draft-ietf-nea-pa-tnc-06) > > -------------------------------------- > > Title : PA-TNC: A Posture Attribute (PA) Protocol > Compatible with Trusted Network Connect (TNC) > > Publication Date : March 2010 > > Author(s) : P. Sangster, K. Narayan > > Category : PROPOSED STANDARD > > Source : Network Endpoint Assessment > > Area : Security > > Stream : IETF > > Verifying Party : IESG > > > > >=20 > _______________________________________________ > Nea mailing list > Nea@ietf.org > https://www.ietf.org/mailman/listinfo/nea >=20