Subject: Re: [Nea] Verifying consensus on mitigating NEA Asokan attack

From: "Susan Thomson (sethomso)" <[email-masked]>
Date: Tue, 11 Jan 2011 17:24:33 -0600

I have seen 3 messages (2 public, one private) in support of the design
team's recommended approach to the NEA Asokan attack. No concerns have
been expressed. Based on the consensus checks taken in the last WG
meeting and on the mailing list, I declare consensus for incorporating
this approach into the PT proposals.

Thanks
Susan

-----Original Message-----
From: Susan Thomson (sethomso) 
Sent: Tuesday, December 14, 2010 6:06 PM
To: [email-masked]
Subject: Verifying consensus on mitigating NEA Asokan attack

At IETF79, the design team responsible for evaluating counter-
measures to the NEA Asokan attack reported their findings to the 
NEA WG. 

The recommended approach is to use "tls-unique" Channel Binding 
defined in RFC5929 to bind the Posture Transport to the entity(*) 
at the PA layer that is authenticating the posture attributes. 
"tls-unique" is the content of the first Finished message in the 
TLS handshake. The advantage of this proposal over the other 
approaches evaluated is that it works with any ciphersuite, and it 
binds to a specific TLS connection.

There was unanimous consensus at the meeting to adopt this 
proposal.

(*) Referred to as External Measurement Agent (EMA) in the design 
team's report.

The chairs would like to verify this consensus on the mailing 
list. Please review the proposal and respond by Monday, 5pm PT on 
Dec 20. Indicate in your response whether you support the changes. 
If you support the changes, a one word response ("Support") is 
sufficient. If not, please explain your concerns and suggest how 
they could be resolved.

Links to information describing the NEA Asokan attack, the 
analysis done by the design team, and the meeting materials are 
below.

Thanks
Susan
--------------------

NOTE: draft-salowey-nea-asokan-00.txt describes 2 of the three 
proposals evaluated by the design team. The recommended approach 
was developed after the I-D was posted and is described in the 
meeting slides.

IETF79 meeting slides (8-20): http://tools.ietf.org/wg/nea/agenda
IETF79 meeting minutes: http://tools.ietf.org/wg/nea/minutes
Design team report: http://tools.ietf.org/id/draft-salowey-nea-
asokan-00.txt
NEA Asokan attack: http://www.ietf.org/mail-
archive/web/nea/current/msg01080.html