Subject: [Nea] Review comments on Asokan Attack Analysis

From: Clifford Kahn <[email-masked]>
Date: Sat, 28 Apr 2012 23:36:07 -0400

Hello.  I reviewed the latest version of the NEA Asokan Attack Analysis at http://datatracker.ietf.org/doc/draft-ietf-nea-asokan/.

I found it strong right up to the conclusions, but them I found unclear.

Ø  The recommendations for addressing the NEA Asokan Attack are as follows:

To whom are these recommendations?  To implementers, or to writers of specs?

Ø  1. Make use of cryptographic binding, however binding identities of the tunnel endpoints in the EMA may be useful.

The "however" is confusing.  I think it means that one should make use of cryptographic binding, and that in addition binding identities of the tunnel endpoints in the EMA may be useful.  Whether I got it right or not, please consider rephrasing.

Ø  2. Use the same mechanism in L2 and L3 PT transports that make use of TLS (e.g. PT-TLS and PT-EAP).

I take it that "the same mechanism" refers to the two mechanisms in recommendation 1.  But will others take it that way?

Doesn't recommendation 1 entail recommendation 2?  Why is 2 here?  Since 2 is here, I take it that 1 must have in mind transports other than the ones 2 mentions.  But 1 doesn't say what transports it has in mind - or I don't understand.

Ø  3. Neither TLS endpoint can be in sole control of the TLS pre-master secret.  This is not strictly necessary when tls-unique channel binding values are used.

I'm a bit confused by the double negative.  The first sentence is a negative, and the second negates that negative.

I think it means that when TLS-unique channel binding values are used, it's kind of OK for one TLS endpoint to be in sole control of the TLS pre-master secret. Whether I got it right or not, please consider rephrasing.

I hope that helps.

Thanks for this important work.
                                                Clifford Kahn

Clifford Kahn
Pulse BU
1-978-589-0252    (or x20252)