Internet Engineering Task Force (IETF) P. Sangster
Request for Comments: 6876 Symantec Corporation
Category: Standards Track N. Cam-Winget
ISSN: 2070-1721 J. Salowey
Cisco Systems
February 2013
A Posture Transport Protocol over TLS (PT-TLS)
Abstract
This document specifies PT-TLS, a TLS-based Posture Transport (PT)
protocol. The PT-TLS protocol carries the Network Endpoint
Assessment (NEA) message exchange under the protection of a Transport
Layer Security (TLS) secured tunnel.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc6876.
Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Sangster, et al. Standards Track [Page 1]RFC 6876 PT-TLS February 2013Table of Contents
1. Introduction ....................................................3
1.1. Prerequisites ..............................................4
1.2. Message Diagram Conventions ................................4
1.3. Conventions Used in This Document ..........................4
1.4. Compatibility with Other Specifications ....................4
2. Design Considerations ...........................................5
2.1. Benefits of TCP/IP Connectivity ............................5
2.2. Leveraging Proven TLS Security .............................6
2.3. TLV-Based Message Encapsulation ............................6
2.4. No Change to Base TLS Protocol .............................6
3. PT-TLS Protocol .................................................7
3.1. Initiating a PT-TLS Session ................................8
3.1.1. Issues with Server-Initiated PT-TLS Sessions ........8
3.1.2. Establish or Re-Use Existing PT-TLS Session .........9
3.2. TCP Port Usage .............................................9
3.3. Preventing MITM Attacks with Channel Bindings ..............9
3.4. PT-TLS Message Flow .......................................10
3.4.1. Assessment Triggers ................................10
3.4.2. PT-TLS Message Exchange Phases .....................11
3.4.2.1. TLS Setup Phase ...........................12
3.4.2.2. PT-TLS Negotiation Phase ..................13
3.4.2.3. PT-TLS Data Transport Phase ...............14
3.4.3. TLS Requirements ...................................14
3.5. PT-TLS Message Format .....................................15
3.6. IETF Namespace PT-TLS Message Types .......................18
3.7. PT-TLS Version Negotiation ................................20
3.7.1. Version Request Message ............................21
3.7.2. Version Response Message ...........................22
3.8. Client Authentication Using SASL ..........................22
3.8.1. SASL Client Authentication Requirements ............23
3.8.2. SASL in PT-TLS Overview ............................24
3.8.3. SASL Authentication Flow ...........................24
3.8.4. Aborting SASL Authentication .......................25
3.8.5. Linkages to SASL Framework .........................25
3.8.5.1. SASL Service Name .........................25
3.8.5.2. SASL Authorization Identity ...............25
3.8.5.3. SASL Security Layer .......................25
datatracker.ietf.org