Subject: [Nea] Comments on PT-TLS

From: Susan Thomson <[email-masked]>
Date: Wed, 28 Mar 2012 05:29:02 -0400

Some comments on PT-TLS I-D. Apologies for delay.

Susan
------------

Section 3.4.2.3:

"Once a PT-TLS session is available to carry NEA assessments, either
   the Posture Transport Client or Server can start an assessment when
   provided a PB-TNC batch for transmission. "

I believe PB-TNC states that the initiator of the transport connection is
the one to start the first assessment (while subsequent assessments may be
started by either party).  I think the sentence should be clarified to say
that.

Section 3.8.3:

Assume the NEA Client initiates the PT-TLS session, and will be starting the
assessment. The NEA Client has no way of knowing whether the server requires
SASL authentication or not. Hence, in the case when the server does require
client authentication, it will start the assessment and receive an error.

An alternate solution would be to require the NEA server to send the SASL
mechanisms TLV (empty in the case no authn is required) - this usage is
documented in the spec, but I don't think it is a MUST. This means the
client can wait for this message before starting an assessment, avoiding the
error msg above.

What is the intended operation? The second is probably better since it
avoids spurious error messages.

Section 3.8.2:

1st 2 sentences still refers to client sending SASL Request Mechanisms
msg/TLV. Needs to be clarified for new flow.

Section 3.4.2.2:
Is initiation of SASL exchange only supported from the NEA Server
(regardless of whether NEA Server is PT-TLS Initiator or PT-TLS Responder)?
The 3rd para implies this, but it could be made explicit in 2nd paragraph.

Section 3.8.8 and 3.8.10:

The description associated with optional fields should be referring to NEA
Server, not PT-TLS Responder (assuming NEA Server always initiates SASL
exchange).