Minutes IETF111: emu
minutes-111-emu-00

Administrivia (5 minutes)

scribe selection / NOTE WELL
Agenda revision
Joe presenting the chair slides
Scribe: Alan & Others

WG draft updates

TLS-based EAP types and TLS 1.3(10 Minutes)

Alan Dekok:

Not a lot of changes. Aligned with TLS 1.3.
Session ticket not valid until inner authentication complete

comment from vendors that we should use anonymous identifiers in the inner tunnel
Joe: what is bad with anonymous id in the inner layer
Alan: real username inside. cannot meaningfully anyone if anonymous identifier is also used in inner authentication
Sean/Mohit: would not work without real identity for inner authentication
Alan: Exactly
Jan-Frederik: some rare cases where outer and inner identities have different realms
Alan: take it to list for technical discussion, it's not clear where the use-cases are for that situation
Joe: couple of things to resolve. How many have read a recent version of the draft?

Sean and Jorge have read

Need a couple of more people to review. Would feel better. Anybody wants to commit to reading/reviewing this draft?

Bernard volunteers
Mohit volunteers

Additional Topics

EAP Usability(20 Min)

Alan Dekok: a bit of a monster draft. Just under 60 pages and getting bigger. 
EAP is hard to use. People make random changes to everything. 
Initial focus is end user devices

NAI from username -> DNS lookup -> verify web cert -> Cert verification -> certs can include SSID

lots of details in the draft about various cases.

may require some limited initial network access. possibility to use unauthenticated EAP-TLS.

works with captive portals

there's running code

no need for trust on first use. seems simple enough.

can be deployed as an extra utility

Dan: Alice doing DNS lookup for Bob's certificate. But doesn't require IP connectivity

Alan: does require some network connectivity. 2 ways to do this: LTE/4G/5G backhaul for lookup. not in document yet: just connect to the SSID with unauthenticated EAP-TLS. EAP server puts in captive portal. Bring it back up with new configuration.

Sean: does this require a web trust anchor, or can anything else be used?
Alan: this is just a trust anchor. key thing is to leverage pre-existing trust and pre-existing connectivity.   Web is just an example

Joe: web pki to authenticate web server. from there you get trust roots for EAP connection?
Alan: Loke EST there is ./well-known/est/ca. If you trust that CA then you trust that server to give you the EAP server cert. lot of discusion in draft.

Alan: no idea whether cer
tificate is okay. user has no way of telling that it is okay to enter username/pass

Mohit: captive portals?

Alan: enter credit card in captive portals. user can avoid web pages. put in walled garden. hope is to take the person out of the process.

EAP-DPP(15 Min)

Dan: Owen and I working on it for a while
Bootstrap client into a Wi-fi network
Base64 encoded ASN.1 seq
right in the middle of psk and full certificate
using the same public key for both device identification and network access
use DPP to authentication a TEAP exchange, and then use that to provision a certificate on the device
minor additions to TLS, no changes to existing RFCs
has been presented to TLS WG.  No comments there for the TLS approach.
Can it be adopted in EMU as a solution to the IoT problem?

Joe: call for who has read it?  (Sean, Alan, Dan)  Will need a few more in order to have enough for reviews

Roman: can we get some volunteers who are interested
Joe: something we need to work on. little more discussion on the list
Jorge will do his best to provide a review

EAP-TLS-IBS(10 Min)

Meiling: Already presented at IETF 109. We just use IBS. have running code. based on eap-tls1.2 and ECCSI. No cross scope with IOT ops

Key distribution is out of scope
Updates made to IANA considerations and abstract

Added a round trip when compared to emu-eap-tls13

get a new EAP type and use it in the key derivation
comments?

Joe: has anyone read the draft. No answers

Sean: I am not a lover of IBS. I am okay with people exploring. WG or AD sponsor is okay for me.

Joe: Need people interested and working on this draft. Possible to take it through individual mechanisms. get some more people interested in this use case. Additional discussion on the list will be useful.

End of session