Hi Joe,
Thanks for the quick response.
[Joe] If the server is offering an expired or revoked certificate then that
needs to be remedied on the server.
Where do you believe the value of OCSP comes into the picture for this EAP-TLS
use case and what actions need to be taken when a notification o
consideration is EAP-TLS 1.3. In my opinion any
document that deals with certificates ought to have some discussion on
revocation. In particular, EAP is deployed into an environment where some
revocation mechanisms may not work as expected because there is no network
access available to do out
m>>;
emu@ietf.org<mailto:emu@ietf.org>
Subject: Re: [Emu] draft-ietf-emu-eap-tls13-11: OCSP Stapling
On Thu, Oct 22, 2020 at 8:08 AM Eliot Lear
mailto:40cisco@dmarc.ietf.org>> wrote:
+1. How does anyone even do OCSP without having first gotten onto the network?
[Joe] THat
ther mechanisms?
> Ciao
>
> Hannes
>
>
>
> *From:* Joseph Salowey
> *Sent:* Thursday, October 22, 2020 11:12 PM
> *To:* Eliot Lear
> *Cc:* Hannes Tschofenig ; emu@ietf.org
> *Subject:* Re: [Emu] draft-ietf-emu-eap-tls13-11: OCSP Stapling
>
>
>
>
&g
Hi Alan,
> However, in the absence of another specification, we need to say *something*
> for EAP-TLS.
Why doesn't the group write that other document? There are several other EAP
methods that use certificates as well.
>> Wouldn’t this be a topic to address in ? IMHO
>> this would make more
[Trimming]
> On 26 Oct 2020, at 16:26, Michael Richardson wrote:
>
>
>>> While this degenerate case of Authentication Server + OCSP Signer on the
>>> same
>>> machine is kinda dumb from a overall security point of view, it's still
>>> better than raw public keys.
>
>> Yes. Let’s think about
Michael:
>> I am aware of some places that generate an OCSP response for the entire
>> population of certificates, and those responsed are distributed to many
>> locations. I am not aware of anyone that distributes the OCSP
>> responder signature private key to multiple locations.
>
> Does anyon
Russ Housley wrote:
>>> The second is, I think, that the EAP server (Authentication Server),
would run
>>> an OCSP responder locally so that it can mint it's own staples.
>>> AFAIK, each certificate can point to a different OCSP signer.
>>
>> Does anyone actually do that?
Eliot Lear wrote:
>> No. There are several steps before we get to raw public keys.
>>
>> The first is that the duration of the Staples could be lengthed to
accomodate
>> anticipated down time for the (now) critical OCSP responder.
>> A second part is that perhaps staples cou
>> The second is, I think, that the EAP server (Authentication Server), would
>> run
>> an OCSP responder locally so that it can mint it's own staples.
>> AFAIK, each certificate can point to a different OCSP signer.
>
> Does anyone actually do that?
I am aware of some places that generate an
> On 26 Oct 2020, at 15:19, Michael Richardson wrote:
>
> Signed PGP part
>
> Eliot Lear wrote:
>>> The EAP server is expected to frequently request a OCSP response from
>>> the OCSP responder (a server typically run by the certificate
>>> issuer). The OCSP response is then added to the Serve
Eliot Lear wrote:
>> The EAP server is expected to frequently request a OCSP response from
>>the OCSP responder (a server typically run by the certificate
>>issuer). The OCSP response is then added to the Servers Certificate
>>message as long as it is valid. Before the OCSP respon
John Mattsson wrote:
> 1. Basically all TLS implementations support OSCP, and a majority
> support OSCP stapling (Certificate Status Request). Mbed is an
> exception rather than the rule.
Is this for server and client certificates, or just server certificates?
It seems that getting t
Thanks, John. Please see below:
> On 26 Oct 2020, at 13:58, John Mattsson
> wrote:
>
> Hi Eliot,
>
> The EAP server is expected to frequently request a OCSP response from the
> OCSP responder (a server typically run by the certificate issuer). The OCSP
> response is then added to the Server
to
be real-time you need to make an online OCSP request-response to the OCSP
responder.
John
-Original Message-
From: Eliot Lear
Date: Monday, 26 October 2020 at 13:16
To: John Mattsson
Cc: "emu@ietf.org"
Subject: Re: [Emu] draft-ietf-emu-eap-tls13-11: OCSP Stapling
Hi
Hi John,
My question is one of pragmatics. In an offline industrial environment, what
is expected of the server to accomplish the stapling? Especially if the
request is nonced.
Eliot
> On 26 Oct 2020, at 13:08, John Mattsson
> wrote:
>
> Hi,
>
> When this was discussed in the group, it w
Hi,
When this was discussed in the group, it was decided to not only mandate
revocation checking, but to also mandate OCSP stapling as is it often the only
viable solution to let an offline peer check the revocation status of the
server. We had a discussion on must-staple, and the decision was
On Oct 23, 2020, at 3:37 AM, Hannes Tschofenig
wrote:
> I do not understand certificate revocation checking is a topic specific to
> the use of TLS 1.3 in EAP-TLS.
It's not.
However, in the absence of another specification, we need to say *something*
for EAP-TLS.
> If this topic is impor
Tschofenig ; emu@ietf.org
Subject: Re: [Emu] draft-ietf-emu-eap-tls13-11: OCSP Stapling
On Thu, Oct 22, 2020 at 8:08 AM Eliot Lear
mailto:40cisco@dmarc.ietf.org>> wrote:
+1. How does anyone even do OCSP without having first gotten onto the network?
[Joe] THat is what OCSP stapl
So I’m a client and include a certificate status request. The EAP server isn’t
talking to the CA at the moment. Does a nonce have to be used? If so… #fail.
If not, what prevents a replay? And if the answer is nothing, what is the
threat model we are addressing?
_
Joseph Salowey wrote:
> On Thu, Oct 22, 2020 at 8:08 AM Eliot Lear
> wrote:
>> +1. How does anyone even do OCSP without having first gotten onto the
>> network?
> [Joe] THat is what OCSP stapling is supposed to solve since the OCSP
> messages are sent in the TLS hands
On Thu, Oct 22, 2020 at 8:08 AM Eliot Lear
wrote:
> +1. How does anyone even do OCSP without having first gotten onto the
> network?
>
>
[Joe] THat is what OCSP stapling is supposed to solve since the OCSP
messages are sent in the TLS handshake. I believe there are some EAP-TLS
implementations
Hannes Tschofenig wrote:
> Thanks for the question. I am objecting to the mandatory use of OCSP for
TLS 1.3 in EAP-TLS.
> I am fine with having it optional.
okay, so it's not about the stapling, at all for you, it's about the OCSP
itself.
--
Michael Richardson. o O ( IPv6 IøT cons
+1. How does anyone even do OCSP without having first gotten onto the network?
Eliot
> On 21 Oct 2020, at 11:02, Hannes Tschofenig wrote:
>
> Hi all,
>
> this draft mandates OCSCP stapling (for use with TLS 1.3 in EAP-TLS) and I
> believe this is a problem for implementations. This extra b
Hi to all,
as an operator of a EAP-TLS server for eduroam at the University Bremen
I just want to give some of my thoughts here, feel free to read or
ignore them ;)
The eduroam environment is heavily used for BYOD, so we don't have any
opportunity to change certificates via a Device Management.
O
methods rely on OCSP?
Ciao
Hannes
-Original Message-
From: Michael Richardson
Sent: Wednesday, October 21, 2020 6:46 PM
To: Hannes Tschofenig ; emu@ietf.org
Subject: Re: [Emu] draft-ietf-emu-eap-tls13-11: OCSP Stapling
Hannes Tschofenig wrote:
> this draft mandates OCSCP stapling (
Hannes Tschofenig wrote:
> this draft mandates OCSCP stapling (for use with TLS 1.3 in EAP-TLS)
> and I believe this is a problem for implementations. This extra burden
> is IMHO unjustified. For the type of deployments where EAP is used
> there is no need for a mandatory certific
On Oct 21, 2020, at 5:02 AM, Hannes Tschofenig
wrote:
> this draft mandates OCSCP stapling (for use with TLS 1.3 in EAP-TLS) and I
> believe this is a problem for implementations. This extra burden is IMHO
> unjustified. For the type of deployments where EAP is used there is no need
> for a ma
28 matches
Mail list logo
