Subject: [Nea] Asokan attack draft

From: Joe Salowey <[email-masked]>
Date: Fri, 9 Mar 2012 16:43:04 -0800

We had some previous discussion on expanding the scope of the Asokan draft to beyond the NEA scenario.  The looks to involve a fair amount of work to cover the general case.  I'm thinking that focusing on and how the Asokan attack applies to NEA and how it is mitigated in NEA would be much better bounded and some thing we could complete more quickly.  

Comments?

Thanks,

Joe

---

From: Stephen Hanna <[email-masked]>
Date: Fri, 9 Mar 2012 21:26:10 -0500

Yes, Joe. I agree. The Asokan attack does have broader implications
beyond NEA but explaining and analyzing those properly would require
the active involvement of at least the EMU WG. They're quite busy so
doing this would slow down the completion of the NEA WG's efforts.
Anyway, the original Asokan paper does a good job of explaining the
implications for tunnel EAP methods. However, it doesn't explain the
implications for endpoint assessment. That's the special value of
this draft.

I'll update the NEA Asokan draft so that it's up-to-date (adding
references to PT-EAP and PT-TNC, etc.) and submit that updated
version before Monday's non-00 deadline. The NEA WG can discuss
this more and decide whether we want to take that on as WG draft
headed for Informational status or to have us submit it as an
AD-sponsored submission or whatever.

Thanks,

Steve

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Joe Salowey
> Sent: Friday, March 09, 2012 7:43 PM
> To: [email-masked]
> Subject: [Nea] Asokan attack draft
> 
> We had some previous discussion on expanding the scope of the Asokan
> draft to beyond the NEA scenario.  The looks to involve a fair amount
> of work to cover the general case.  I'm thinking that focusing on and
> how the Asokan attack applies to NEA and how it is mitigated in NEA
> would be much better bounded and some thing we could complete more
> quickly.
> 
> Comments?
> 
> Thanks,
> 
> Joe
> _______________________________________________
> Nea mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nea

---

From: Stephen Hanna <[email-masked]>
Date: Mon, 19 Mar 2012 16:16:33 -0400

As promised below, Joe and I updated the NEA Asokan draft so that
it's up-to-date. The new draft is available online at
http://www.ietf.org/internet-drafts/draft-salowey-nea-asokan-01.txt
Please look it over and send comments to this email list. We're
not going to call a WGLC now since we already have two under way
but we will be discussing this draft at the NEA WG meeting next
week so it would be great to get some comments before then. At
least, you'll want to come to the meeting with a clue about it.

At the last NEA WG meeting (at IETF 82), we all agreed that it
would be best to have this document become a WG draft. If you
have any concerns about this course of action, please speak up.
Otherwise, we'll repost it after IETF 82 as a WG draft and plan
to start a WGLC for it then. After WG consensus is reached on
the draft, we'll send it to the IESG for Informational status.

BTW, our AD has indicated that there's no need to update our
charter to add this document because it's effectively just a
part of the PT-EAP and PT-TLS Security Considerations sections.
And it doesn't have any normative text. It's just a description
of the NEA Asokan attack and of appropriate countermeasures,
which are implemented in PT-EAP and PT-TLS. Those documents
will point at the NEA Asokan Attack Analysis instead of including
duplicate text in their Security Considerations sections,
explaining the same attack and countermeasures twice.

Thanks,

Steve

> Stephen Hanna
> Sent: Friday, March 09, 2012 9:26 PM
> To: Joe Salowey; [email-masked]
> Subject: Re: [Nea] Asokan attack draft
>