A Posture Transport Protocol over TLS (PT-TLS)
RFC 6876
Document | Type |
RFC - Proposed Standard
(February 2013; No errata)
Was draft-ietf-nea-pt-tls (nea WG)
|
|
---|---|---|---|
Last updated | 2015-10-14 | ||
Replaces | draft-sangster-nea-pt-tls | ||
Stream | IETF | ||
Formats | plain text pdf html bibtex | ||
Reviews | |||
Stream | WG state | WG Document | |
Document shepherd | No shepherd assigned | ||
IESG | IESG state | RFC 6876 (Proposed Standard) | |
Consensus Boilerplate | Unknown | ||
Telechat date | |||
Responsible AD | Stephen Farrell | ||
IESG note | Steve Hanna (shanna@juniper.net) is the document shephrd. | ||
Send notices to | (None) |
Internet Engineering Task Force (IETF) P. Sangster Request for Comments: 6876 Symantec Corporation Category: Standards Track N. Cam-Winget ISSN: 2070-1721 J. Salowey Cisco Systems February 2013 A Posture Transport Protocol over TLS (PT-TLS) Abstract This document specifies PT-TLS, a TLS-based Posture Transport (PT) protocol. The PT-TLS protocol carries the Network Endpoint Assessment (NEA) message exchange under the protection of a Transport Layer Security (TLS) secured tunnel. Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6876. Copyright Notice Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Sangster, et al. Standards Track [Page 1] RFC 6876 PT-TLS February 2013 Table of Contents 1. Introduction ....................................................3 1.1. Prerequisites ..............................................4 1.2. Message Diagram Conventions ................................4 1.3. Conventions Used in This Document ..........................4 1.4. Compatibility with Other Specifications ....................4 2. Design Considerations ...........................................5 2.1. Benefits of TCP/IP Connectivity ............................5 2.2. Leveraging Proven TLS Security .............................6 2.3. TLV-Based Message Encapsulation ............................6 2.4. No Change to Base TLS Protocol .............................6 3. PT-TLS Protocol .................................................7 3.1. Initiating a PT-TLS Session ................................8 3.1.1. Issues with Server-Initiated PT-TLS Sessions ........8 3.1.2. Establish or Re-Use Existing PT-TLS Session .........9 3.2. TCP Port Usage .............................................9 3.3. Preventing MITM Attacks with Channel Bindings ..............9 3.4. PT-TLS Message Flow .......................................10 3.4.1. Assessment Triggers ................................10 3.4.2. PT-TLS Message Exchange Phases .....................11 3.4.2.1. TLS Setup Phase ...........................12 3.4.2.2. PT-TLS Negotiation Phase ..................13 3.4.2.3. PT-TLS Data Transport Phase ...............14 3.4.3. TLS Requirements ...................................14 3.5. PT-TLS Message Format .....................................15 3.6. IETF Namespace PT-TLS Message Types .......................18 3.7. PT-TLS Version Negotiation ................................20 3.7.1. Version Request Message ............................21 3.7.2. Version Response Message ...........................22 3.8. Client Authentication Using SASL ..........................22 3.8.1. SASL Client Authentication Requirements ............23 3.8.2. SASL in PT-TLS Overview ............................24 3.8.3. SASL Authentication Flow ...........................24 3.8.4. Aborting SASL Authentication .......................25 3.8.5. Linkages to SASL Framework .........................25 3.8.5.1. SASL Service Name .........................25 3.8.5.2. SASL Authorization Identity ...............25 3.8.5.3. SASL Security Layer .......................25 3.8.5.4. Multiple Authentications ..................25 3.8.6. SASL Channel Bindings ..............................25Show full document text