4 from this . Any reason is not called ? Seems arbitrary to drop the end of the word when is even longer. Reviewer: Sean Turner Review result: Has Issues This is an early sector review. Based on the ARTART early reviews of this I-D and the -arch I-D, there is no doubt going to need to be another review after the authors get done restructuring both I-Ds. BTW: Theresa thank you for the heads up about that restructuring. It forced me to read the -arch and -impl I-Ds, but that probably helped me not make silly requests of the authors/WG. tl;dr: I picked "has issues" knowing there is a rewrite on the way and I would like to reserve final judgement until then. I apologize upfront because I am going to ramble a bit before I get to the specifics: The taps I-Ds are about “a protocol-independent Transport Services Application Programming Interface (API).” I took a pretty liberal approach when reviewing this I-D from a security perspective because these I-Ds are somewhat different than the “normal” protocol I-Ds. As noted in the -arch I-D: these I-Ds do not specify “specific protocols or algorithms” … gasp. But, that’s probably okay in this context. I wondered what you would say about an API: Apps need to use the API properly! check: see -arch I-D Implementation/Library needs to be from trust source! check: see -interface I-D - Apps need to use the right keys at the right time! check: see -arch I-D - Avoid fallback/downgrade to insecure protocols! check: see -arch I-D and -impl I-D - Deal with 0-RTT! check: see -impl I-D - Address privacy aspects! check: see -interface I-D I mean maybe you could add something about: randomness for keys - but that better already be in the security protocol specifications so I do not think it is absolutely needed here. following good programming techniques - but I am not sure where you would point nor whether it really makes sense to do so. I think I found what I was looking for is somewhere in the stack of I-Ds. Am I worried somebody can implement this wrong. Sure. But, not any more than I would be for any other protocol. Now on to the specifics: NOTE: I tried not repeat anything from the ARTART review. 0) s6: maybe this wording would be better? For these two sentences are you trying to say that MUST else if? OLD: At least one Local Endpoint MUST be specified if the Preconnection is used to Listen() for incoming Connections, but the list of Local Endpoints MAY be empty if the Preconnection is used to Initiate() connections. NEW: At least one Remote Endpoint MUST be specified if the Preconnection is used to Initiate() Connections, but the list of Remote Endpoints MAY be empty if the Preconnection is used to Listen() for incoming Connections 1) s6.3.1 I know this is an example, but can we replace: SecurityParameters.Set(supported-group, "secp256k1") with SecurityParameters.Set(supported-group, "secp256r1") r1 the current MTI for TLS. k1 is for bitcoin :) Or, is this where I get a bitcoin because I caught the shiny object? :) 2) s6.3.2: Is this like checking the certificate status? 3) s8.1.1- I read this definition a bunch. Are there two special values? The Type line says “Full Coverage” is special, but then the description says “0” is special too. Maybe look at s91.3.6 for inspiration? 4) s8.1.2: Any reason it’s not called connPriority? Seems arbitrary to drop the end of the word when connTimeout is even longer. 5) s8.1.2-should “Type” line also include (non-negative) like s8.1.1 and s9.1.3.2 do? 6) s8.1.3/.4: The Numeric values specifies seconds, minutes, hours, or millennia? 7) s8.1.6: don’t you need to specify the Type? I guess Enumeration is what you’re after? 8) s8.1.11.2/.3/.4: Are these sizes in bytes too like 8.1.11.1? 9) s8.2.1: RFC 5482 allows granularity of minutes or seconds don’t you need to say which it is here? 10) s8.2.2: Is there some reason it’s not called tcp.userTimeoutEnabled? 11) s8.2.3: Is there some reason it’s not called tcp.userTimeoutChangable? 12) s9.1.3.2: Why 100? 13) s9.1.3.2: Why shorten to msrPrio when msgOrdered is almost as long and safelyReplayable is longer? 14) A.1: Could the caution about freeing memory be generalized? 15) What follows are the I-D nits references to check. Some of these might be on purpose: == Outdated reference: A later version (-11) exists of draft-ietf-taps-arch-10 ** Obsolete normative reference: RFC 4941 (Obsoleted by RFC 8981) == Outdated reference: A later version (-06) exists of draft-ietf-httpbis-priority-03 == Outdated reference: A later version (-10) exists of draft-ietf-taps-impl-09 -- Obsolete informational reference (is this intentional?): RFC 5245 (Obsoleted by RFC 8445, RFC 8839) -- Obsolete informational reference (is this intentional?): RFC 5766 (Obsoleted by RFC 8656)

8.1.2.  <ins> connPriority </ins> Integer


5 from this . Slightly modified as a result of . Should “Type” line also include (non-negative) like s9.1.3.2 does? Just trying to be matchy-matchy. Reviewer: Sean Turner Review result: Has Issues This is an early sector review. Based on the ARTART early reviews of this I-D and the -arch I-D, there is no doubt going to need to be another review after the authors get done restructuring both I-Ds. BTW: Theresa thank you for the heads up about that restructuring. It forced me to read the -arch and -impl I-Ds, but that probably helped me not make silly requests of the authors/WG. tl;dr: I picked "has issues" knowing there is a rewrite on the way and I would like to reserve final judgement until then. I apologize upfront because I am going to ramble a bit before I get to the specifics: The taps I-Ds are about “a protocol-independent Transport Services Application Programming Interface (API).” I took a pretty liberal approach when reviewing this I-D from a security perspective because these I-Ds are somewhat different than the “normal” protocol I-Ds. As noted in the -arch I-D: these I-Ds do not specify “specific protocols or algorithms” … gasp. But, that’s probably okay in this context. I wondered what you would say about an API: Apps need to use the API properly! check: see -arch I-D Implementation/Library needs to be from trust source! check: see -interface I-D - Apps need to use the right keys at the right time! check: see -arch I-D - Avoid fallback/downgrade to insecure protocols! check: see -arch I-D and -impl I-D - Deal with 0-RTT! check: see -impl I-D - Address privacy aspects! check: see -interface I-D I mean maybe you could add something about: randomness for keys - but that better already be in the security protocol specifications so I do not think it is absolutely needed here. following good programming techniques - but I am not sure where you would point nor whether it really makes sense to do so. I think I found what I was looking for is somewhere in the stack of I-Ds. Am I worried somebody can implement this wrong. Sure. But, not any more than I would be for any other protocol. Now on to the specifics: NOTE: I tried not repeat anything from the ARTART review. 0) s6: maybe this wording would be better? For these two sentences are you trying to say that MUST else if? OLD: At least one Local Endpoint MUST be specified if the Preconnection is used to Listen() for incoming Connections, but the list of Local Endpoints MAY be empty if the Preconnection is used to Initiate() connections. NEW: At least one Remote Endpoint MUST be specified if the Preconnection is used to Initiate() Connections, but the list of Remote Endpoints MAY be empty if the Preconnection is used to Listen() for incoming Connections 1) s6.3.1 I know this is an example, but can we replace: SecurityParameters.Set(supported-group, "secp256k1") with SecurityParameters.Set(supported-group, "secp256r1") r1 the current MTI for TLS. k1 is for bitcoin :) Or, is this where I get a bitcoin because I caught the shiny object? :) 2) s6.3.2: Is this like checking the certificate status? 3) s8.1.1- I read this definition a bunch. Are there two special values? The Type line says “Full Coverage” is special, but then the description says “0” is special too. Maybe look at s91.3.6 for inspiration? 4) s8.1.2: Any reason it’s not called connPriority? Seems arbitrary to drop the end of the word when connTimeout is even longer. 5) s8.1.2-should “Type” line also include (non-negative) like s8.1.1 and s9.1.3.2 do? 6) s8.1.3/.4: The Numeric values specifies seconds, minutes, hours, or millennia? 7) s8.1.6: don’t you need to specify the Type? I guess Enumeration is what you’re after? 8) s8.1.11.2/.3/.4: Are these sizes in bytes too like 8.1.11.1? 9) s8.2.1: RFC 5482 allows granularity of minutes or seconds don’t you need to say which it is here? 10) s8.2.2: Is there some reason it’s not called tcp.userTimeoutEnabled? 11) s8.2.3: Is there some reason it’s not called tcp.userTimeoutChangable? 12) s9.1.3.2: Why 100? 13) s9.1.3.2: Why shorten to msrPrio when msgOrdered is almost as long and safelyReplayable is longer? 14) A.1: Could the caution about freeing memory be generalized? 15) What follows are the I-D nits references to check. Some of these might be on purpose: == Outdated reference: A later version (-11) exists of draft-ietf-taps-arch-10 ** Obsolete normative reference: RFC 4941 (Obsoleted by RFC 8981) == Outdated reference: A later version (-06) exists of draft-ietf-httpbis-priority-03 == Outdated reference: A later version (-10) exists of draft-ietf-taps-impl-09 -- Obsolete informational reference (is this intentional?): RFC 5245 (Obsoleted by RFC 8445, RFC 8839) -- Obsolete informational reference (is this intentional?): RFC 5766 (Obsoleted by RFC 8656)

connPriority  <ins> Integer (non-negative) </ins> 100


Enumeration <del> Default </del>  This property specifies the desired network treatment for traffic sent by the application and the tradeoffs the application is prepared

The class is actually called "Default" ... but I wondered if we could call it something like in my order of decreasing preference: Default Profile Best Effort (Default Profile) Default Profile (Best Effort) ... do any of these resonate?
I like "Default Profile (Best Effort)" and "Best Effort (Default Profile)". I just don't like only having "default" or "default profile", as it leads to: the default choice is "default".
let's try: Default Profile (Best Effort)
Fixes default capacity profile
7 from this . And slightly ammended. Don’t you need to specify the Type? I guess Enumeration is what you’re after? Also, is the Enumeration value supposed to be empty or is it ? Assumed the later, because is listed as a value.
Looks good to me. Default: Default looks odd, but seems correct. Reviewer: Sean Turner Review result: Has Issues This is an early sector review. Based on the ARTART early reviews of this I-D and the -arch I-D, there is no doubt going to need to be another review after the authors get done restructuring both I-Ds. BTW: Theresa thank you for the heads up about that restructuring. It forced me to read the -arch and -impl I-Ds, but that probably helped me not make silly requests of the authors/WG. tl;dr: I picked "has issues" knowing there is a rewrite on the way and I would like to reserve final judgement until then. I apologize upfront because I am going to ramble a bit before I get to the specifics: The taps I-Ds are about “a protocol-independent Transport Services Application Programming Interface (API).” I took a pretty liberal approach when reviewing this I-D from a security perspective because these I-Ds are somewhat different than the “normal” protocol I-Ds. As noted in the -arch I-D: these I-Ds do not specify “specific protocols or algorithms” … gasp. But, that’s probably okay in this context. I wondered what you would say about an API: Apps need to use the API properly! check: see -arch I-D Implementation/Library needs to be from trust source! check: see -interface I-D - Apps need to use the right keys at the right time! check: see -arch I-D - Avoid fallback/downgrade to insecure protocols! check: see -arch I-D and -impl I-D - Deal with 0-RTT! check: see -impl I-D - Address privacy aspects! check: see -interface I-D I mean maybe you could add something about: randomness for keys - but that better already be in the security protocol specifications so I do not think it is absolutely needed here. following good programming techniques - but I am not sure where you would point nor whether it really makes sense to do so. I think I found what I was looking for is somewhere in the stack of I-Ds. Am I worried somebody can implement this wrong. Sure. But, not any more than I would be for any other protocol. Now on to the specifics: NOTE: I tried not repeat anything from the ARTART review. 0) s6: maybe this wording would be better? For these two sentences are you trying to say that MUST else if? OLD: At least one Local Endpoint MUST be specified if the Preconnection is used to Listen() for incoming Connections, but the list of Local Endpoints MAY be empty if the Preconnection is used to Initiate() connections. NEW: At least one Remote Endpoint MUST be specified if the Preconnection is used to Initiate() Connections, but the list of Remote Endpoints MAY be empty if the Preconnection is used to Listen() for incoming Connections 1) s6.3.1 I know this is an example, but can we replace: SecurityParameters.Set(supported-group, "secp256k1") with SecurityParameters.Set(supported-group, "secp256r1") r1 the current MTI for TLS. k1 is for bitcoin :) Or, is this where I get a bitcoin because I caught the shiny object? :) 2) s6.3.2: Is this like checking the certificate status? 3) s8.1.1- I read this definition a bunch. Are there two special values? The Type line says “Full Coverage” is special, but then the description says “0” is special too. Maybe look at s91.3.6 for inspiration? 4) s8.1.2: Any reason it’s not called connPriority? Seems arbitrary to drop the end of the word when connTimeout is even longer. 5) s8.1.2-should “Type” line also include (non-negative) like s8.1.1 and s9.1.3.2 do? 6) s8.1.3/.4: The Numeric values specifies seconds, minutes, hours, or millennia? 7) s8.1.6: don’t you need to specify the Type? I guess Enumeration is what you’re after? 8) s8.1.11.2/.3/.4: Are these sizes in bytes too like 8.1.11.1? 9) s8.2.1: RFC 5482 allows granularity of minutes or seconds don’t you need to say which it is here? 10) s8.2.2: Is there some reason it’s not called tcp.userTimeoutEnabled? 11) s8.2.3: Is there some reason it’s not called tcp.userTimeoutChangable? 12) s9.1.3.2: Why 100? 13) s9.1.3.2: Why shorten to msrPrio when msgOrdered is almost as long and safelyReplayable is longer? 14) A.1: Could the caution about freeing memory be generalized? 15) What follows are the I-D nits references to check. Some of these might be on purpose: == Outdated reference: A later version (-11) exists of draft-ietf-taps-arch-10 ** Obsolete normative reference: RFC 4941 (Obsoleted by RFC 8981) == Outdated reference: A later version (-06) exists of draft-ietf-httpbis-priority-03 == Outdated reference: A later version (-10) exists of draft-ietf-taps-impl-09 -- Obsolete informational reference (is this intentional?): RFC 5245 (Obsoleted by RFC 8445, RFC 8839) -- Obsolete informational reference (is this intentional?): RFC 5766 (Obsoleted by RFC 8656)

Enumeration  <ins> Default Profile (Best Effort) </ins> This property specifies the desired network treatment for traffic sent by the application and the tradeoffs the application is prepared


This property represents the maximum Message size that can be sent before or during Connection establishment, see also msg- <del> safelyreplayable.  It is given in Bytes. </del>  8.1.11.2. This property, if applicable, represents the maximum Message size that can be sent without incurring network-layer fragmentation at the <del> sender.  It exposes a value to the application based on the Maximum Packet Size (MPS) as described in Datagram PLPMTUD RFC8899.  This can allow a sending stack to avoid unwanted fragmentation at the network- layer or segmentation by the transport layer. </del>  8.1.11.3. Integer This property represents the maximum Message size that an application <del> can send. </del>  8.1.11.4. Integer This numeric property represents the maximum Message size that an <del> application can receive. </del>  8.2.

I can change that. I was trying to just copy the text from 8.1.11.1. I guess I would change it there too. Stand by.
8 from this . Are these sizes in bytes too like 8.1.11.1?
Could this better worded as "specified as the number of bytes"? Reviewer: Sean Turner Review result: Has Issues This is an early sector review. Based on the ARTART early reviews of this I-D and the -arch I-D, there is no doubt going to need to be another review after the authors get done restructuring both I-Ds. BTW: Theresa thank you for the heads up about that restructuring. It forced me to read the -arch and -impl I-Ds, but that probably helped me not make silly requests of the authors/WG. tl;dr: I picked "has issues" knowing there is a rewrite on the way and I would like to reserve final judgement until then. I apologize upfront because I am going to ramble a bit before I get to the specifics: The taps I-Ds are about “a protocol-independent Transport Services Application Programming Interface (API).” I took a pretty liberal approach when reviewing this I-D from a security perspective because these I-Ds are somewhat different than the “normal” protocol I-Ds. As noted in the -arch I-D: these I-Ds do not specify “specific protocols or algorithms” … gasp. But, that’s probably okay in this context. I wondered what you would say about an API: Apps need to use the API properly! check: see -arch I-D Implementation/Library needs to be from trust source! check: see -interface I-D - Apps need to use the right keys at the right time! check: see -arch I-D - Avoid fallback/downgrade to insecure protocols! check: see -arch I-D and -impl I-D - Deal with 0-RTT! check: see -impl I-D - Address privacy aspects! check: see -interface I-D I mean maybe you could add something about: randomness for keys - but that better already be in the security protocol specifications so I do not think it is absolutely needed here. following good programming techniques - but I am not sure where you would point nor whether it really makes sense to do so. I think I found what I was looking for is somewhere in the stack of I-Ds. Am I worried somebody can implement this wrong. Sure. But, not any more than I would be for any other protocol. Now on to the specifics: NOTE: I tried not repeat anything from the ARTART review. 0) s6: maybe this wording would be better? For these two sentences are you trying to say that MUST else if? OLD: At least one Local Endpoint MUST be specified if the Preconnection is used to Listen() for incoming Connections, but the list of Local Endpoints MAY be empty if the Preconnection is used to Initiate() connections. NEW: At least one Remote Endpoint MUST be specified if the Preconnection is used to Initiate() Connections, but the list of Remote Endpoints MAY be empty if the Preconnection is used to Listen() for incoming Connections 1) s6.3.1 I know this is an example, but can we replace: SecurityParameters.Set(supported-group, "secp256k1") with SecurityParameters.Set(supported-group, "secp256r1") r1 the current MTI for TLS. k1 is for bitcoin :) Or, is this where I get a bitcoin because I caught the shiny object? :) 2) s6.3.2: Is this like checking the certificate status? 3) s8.1.1- I read this definition a bunch. Are there two special values? The Type line says “Full Coverage” is special, but then the description says “0” is special too. Maybe look at s91.3.6 for inspiration? 4) s8.1.2: Any reason it’s not called connPriority? Seems arbitrary to drop the end of the word when connTimeout is even longer. 5) s8.1.2-should “Type” line also include (non-negative) like s8.1.1 and s9.1.3.2 do? 6) s8.1.3/.4: The Numeric values specifies seconds, minutes, hours, or millennia? 7) s8.1.6: don’t you need to specify the Type? I guess Enumeration is what you’re after? 8) s8.1.11.2/.3/.4: Are these sizes in bytes too like 8.1.11.1? 9) s8.2.1: RFC 5482 allows granularity of minutes or seconds don’t you need to say which it is here? 10) s8.2.2: Is there some reason it’s not called tcp.userTimeoutEnabled? 11) s8.2.3: Is there some reason it’s not called tcp.userTimeoutChangable? 12) s9.1.3.2: Why 100? 13) s9.1.3.2: Why shorten to msrPrio when msgOrdered is almost as long and safelyReplayable is longer? 14) A.1: Could the caution about freeing memory be generalized? 15) What follows are the I-D nits references to check. Some of these might be on purpose: == Outdated reference: A later version (-11) exists of draft-ietf-taps-arch-10 ** Obsolete normative reference: RFC 4941 (Obsoleted by RFC 8981) == Outdated reference: A later version (-06) exists of draft-ietf-httpbis-priority-03 == Outdated reference: A later version (-10) exists of draft-ietf-taps-impl-09 -- Obsolete informational reference (is this intentional?): RFC 5245 (Obsoleted by RFC 8445, RFC 8839) -- Obsolete informational reference (is this intentional?): RFC 5766 (Obsoleted by RFC 8656)

This property represents the maximum Message size that can be sent before or during Connection establishment, see also msg-  <ins> safelyreplayable.  It is specified as the number of bytes. </ins> 8.1.11.2. This property, if applicable, represents the maximum Message size that can be sent without incurring network-layer fragmentation at the  <ins> sender.  It is specified as the number of bytes.  It exposes a value to the application based on the Maximum Packet Size (MPS) as described in Datagram PLPMTUD RFC8899.  This can allow a sending stack to avoid unwanted fragmentation at the network-layer or segmentation by the transport layer. </ins> 8.1.11.3. Integer This property represents the maximum Message size that an application  <ins> can send.  It is specified as the nummber of bytes. </ins> 8.1.11.4. Integer This numeric property represents the maximum Message size that an  <ins> application can receive.  It specified as the number of bytes. </ins> 8.2.


8.2.2. <del> tcp.userTimeout </del>  Boolean

10 from this . Is there some reason it’s not called tcp.userTimeoutEnabled? Reviewer: Sean Turner Review result: Has Issues This is an early sector review. Based on the ARTART early reviews of this I-D and the -arch I-D, there is no doubt going to need to be another review after the authors get done restructuring both I-Ds. BTW: Theresa thank you for the heads up about that restructuring. It forced me to read the -arch and -impl I-Ds, but that probably helped me not make silly requests of the authors/WG. tl;dr: I picked "has issues" knowing there is a rewrite on the way and I would like to reserve final judgement until then. I apologize upfront because I am going to ramble a bit before I get to the specifics: The taps I-Ds are about “a protocol-independent Transport Services Application Programming Interface (API).” I took a pretty liberal approach when reviewing this I-D from a security perspective because these I-Ds are somewhat different than the “normal” protocol I-Ds. As noted in the -arch I-D: these I-Ds do not specify “specific protocols or algorithms” … gasp. But, that’s probably okay in this context. I wondered what you would say about an API: Apps need to use the API properly! check: see -arch I-D Implementation/Library needs to be from trust source! check: see -interface I-D - Apps need to use the right keys at the right time! check: see -arch I-D - Avoid fallback/downgrade to insecure protocols! check: see -arch I-D and -impl I-D - Deal with 0-RTT! check: see -impl I-D - Address privacy aspects! check: see -interface I-D I mean maybe you could add something about: randomness for keys - but that better already be in the security protocol specifications so I do not think it is absolutely needed here. following good programming techniques - but I am not sure where you would point nor whether it really makes sense to do so. I think I found what I was looking for is somewhere in the stack of I-Ds. Am I worried somebody can implement this wrong. Sure. But, not any more than I would be for any other protocol. Now on to the specifics: NOTE: I tried not repeat anything from the ARTART review. 0) s6: maybe this wording would be better? For these two sentences are you trying to say that MUST else if? OLD: At least one Local Endpoint MUST be specified if the Preconnection is used to Listen() for incoming Connections, but the list of Local Endpoints MAY be empty if the Preconnection is used to Initiate() connections. NEW: At least one Remote Endpoint MUST be specified if the Preconnection is used to Initiate() Connections, but the list of Remote Endpoints MAY be empty if the Preconnection is used to Listen() for incoming Connections 1) s6.3.1 I know this is an example, but can we replace: SecurityParameters.Set(supported-group, "secp256k1") with SecurityParameters.Set(supported-group, "secp256r1") r1 the current MTI for TLS. k1 is for bitcoin :) Or, is this where I get a bitcoin because I caught the shiny object? :) 2) s6.3.2: Is this like checking the certificate status? 3) s8.1.1- I read this definition a bunch. Are there two special values? The Type line says “Full Coverage” is special, but then the description says “0” is special too. Maybe look at s91.3.6 for inspiration? 4) s8.1.2: Any reason it’s not called connPriority? Seems arbitrary to drop the end of the word when connTimeout is even longer. 5) s8.1.2-should “Type” line also include (non-negative) like s8.1.1 and s9.1.3.2 do? 6) s8.1.3/.4: The Numeric values specifies seconds, minutes, hours, or millennia? 7) s8.1.6: don’t you need to specify the Type? I guess Enumeration is what you’re after? 8) s8.1.11.2/.3/.4: Are these sizes in bytes too like 8.1.11.1? 9) s8.2.1: RFC 5482 allows granularity of minutes or seconds don’t you need to say which it is here? 10) s8.2.2: Is there some reason it’s not called tcp.userTimeoutEnabled? 11) s8.2.3: Is there some reason it’s not called tcp.userTimeoutChangable? 12) s9.1.3.2: Why 100? 13) s9.1.3.2: Why shorten to msrPrio when msgOrdered is almost as long and safelyReplayable is longer? 14) A.1: Could the caution about freeing memory be generalized? 15) What follows are the I-D nits references to check. Some of these might be on purpose: == Outdated reference: A later version (-11) exists of draft-ietf-taps-arch-10 ** Obsolete normative reference: RFC 4941 (Obsoleted by RFC 8981) == Outdated reference: A later version (-06) exists of draft-ietf-httpbis-priority-03 == Outdated reference: A later version (-10) exists of draft-ietf-taps-impl-09 -- Obsolete informational reference (is this intentional?): RFC 5245 (Obsoleted by RFC 8445, RFC 8839) -- Obsolete informational reference (is this intentional?): RFC 5766 (Obsoleted by RFC 8656)

8.2.2.  <ins> tcp.userTimeoutEnabled </ins> Boolean


8.2.3. <del> tcp.userTimeoutRecv </del>  Boolean

11 from this . Is there some reason it’s not called tcp.userTimeoutChangable? Reviewer: Sean Turner Review result: Has Issues This is an early sector review. Based on the ARTART early reviews of this I-D and the -arch I-D, there is no doubt going to need to be another review after the authors get done restructuring both I-Ds. BTW: Theresa thank you for the heads up about that restructuring. It forced me to read the -arch and -impl I-Ds, but that probably helped me not make silly requests of the authors/WG. tl;dr: I picked "has issues" knowing there is a rewrite on the way and I would like to reserve final judgement until then. I apologize upfront because I am going to ramble a bit before I get to the specifics: The taps I-Ds are about “a protocol-independent Transport Services Application Programming Interface (API).” I took a pretty liberal approach when reviewing this I-D from a security perspective because these I-Ds are somewhat different than the “normal” protocol I-Ds. As noted in the -arch I-D: these I-Ds do not specify “specific protocols or algorithms” … gasp. But, that’s probably okay in this context. I wondered what you would say about an API: Apps need to use the API properly! check: see -arch I-D Implementation/Library needs to be from trust source! check: see -interface I-D - Apps need to use the right keys at the right time! check: see -arch I-D - Avoid fallback/downgrade to insecure protocols! check: see -arch I-D and -impl I-D - Deal with 0-RTT! check: see -impl I-D - Address privacy aspects! check: see -interface I-D I mean maybe you could add something about: randomness for keys - but that better already be in the security protocol specifications so I do not think it is absolutely needed here. following good programming techniques - but I am not sure where you would point nor whether it really makes sense to do so. I think I found what I was looking for is somewhere in the stack of I-Ds. Am I worried somebody can implement this wrong. Sure. But, not any more than I would be for any other protocol. Now on to the specifics: NOTE: I tried not repeat anything from the ARTART review. 0) s6: maybe this wording would be better? For these two sentences are you trying to say that MUST else if? OLD: At least one Local Endpoint MUST be specified if the Preconnection is used to Listen() for incoming Connections, but the list of Local Endpoints MAY be empty if the Preconnection is used to Initiate() connections. NEW: At least one Remote Endpoint MUST be specified if the Preconnection is used to Initiate() Connections, but the list of Remote Endpoints MAY be empty if the Preconnection is used to Listen() for incoming Connections 1) s6.3.1 I know this is an example, but can we replace: SecurityParameters.Set(supported-group, "secp256k1") with SecurityParameters.Set(supported-group, "secp256r1") r1 the current MTI for TLS. k1 is for bitcoin :) Or, is this where I get a bitcoin because I caught the shiny object? :) 2) s6.3.2: Is this like checking the certificate status? 3) s8.1.1- I read this definition a bunch. Are there two special values? The Type line says “Full Coverage” is special, but then the description says “0” is special too. Maybe look at s91.3.6 for inspiration? 4) s8.1.2: Any reason it’s not called connPriority? Seems arbitrary to drop the end of the word when connTimeout is even longer. 5) s8.1.2-should “Type” line also include (non-negative) like s8.1.1 and s9.1.3.2 do? 6) s8.1.3/.4: The Numeric values specifies seconds, minutes, hours, or millennia? 7) s8.1.6: don’t you need to specify the Type? I guess Enumeration is what you’re after? 8) s8.1.11.2/.3/.4: Are these sizes in bytes too like 8.1.11.1? 9) s8.2.1: RFC 5482 allows granularity of minutes or seconds don’t you need to say which it is here? 10) s8.2.2: Is there some reason it’s not called tcp.userTimeoutEnabled? 11) s8.2.3: Is there some reason it’s not called tcp.userTimeoutChangable? 12) s9.1.3.2: Why 100? 13) s9.1.3.2: Why shorten to msrPrio when msgOrdered is almost as long and safelyReplayable is longer? 14) A.1: Could the caution about freeing memory be generalized? 15) What follows are the I-D nits references to check. Some of these might be on purpose: == Outdated reference: A later version (-11) exists of draft-ietf-taps-arch-10 ** Obsolete normative reference: RFC 4941 (Obsoleted by RFC 8981) == Outdated reference: A later version (-06) exists of draft-ietf-httpbis-priority-03 == Outdated reference: A later version (-10) exists of draft-ietf-taps-impl-09 -- Obsolete informational reference (is this intentional?): RFC 5245 (Obsoleted by RFC 8445, RFC 8839) -- Obsolete informational reference (is this intentional?): RFC 5766 (Obsoleted by RFC 8656)

8.2.3.  <ins> tcp.userTimeoutChangeable </ins> Boolean


9.1.3.2. <del> msgPrio </del>  Integer (non-negative)

11 from this . Why shorten to msrPrio when msgOrdered is almost as long and safelyReplayable is longer?
Looks fine to me. Reviewer: Sean Turner Review result: Has Issues This is an early sector review. Based on the ARTART early reviews of this I-D and the -arch I-D, there is no doubt going to need to be another review after the authors get done restructuring both I-Ds. BTW: Theresa thank you for the heads up about that restructuring. It forced me to read the -arch and -impl I-Ds, but that probably helped me not make silly requests of the authors/WG. tl;dr: I picked "has issues" knowing there is a rewrite on the way and I would like to reserve final judgement until then. I apologize upfront because I am going to ramble a bit before I get to the specifics: The taps I-Ds are about “a protocol-independent Transport Services Application Programming Interface (API).” I took a pretty liberal approach when reviewing this I-D from a security perspective because these I-Ds are somewhat different than the “normal” protocol I-Ds. As noted in the -arch I-D: these I-Ds do not specify “specific protocols or algorithms” … gasp. But, that’s probably okay in this context. I wondered what you would say about an API: Apps need to use the API properly! check: see -arch I-D Implementation/Library needs to be from trust source! check: see -interface I-D - Apps need to use the right keys at the right time! check: see -arch I-D - Avoid fallback/downgrade to insecure protocols! check: see -arch I-D and -impl I-D - Deal with 0-RTT! check: see -impl I-D - Address privacy aspects! check: see -interface I-D I mean maybe you could add something about: randomness for keys - but that better already be in the security protocol specifications so I do not think it is absolutely needed here. following good programming techniques - but I am not sure where you would point nor whether it really makes sense to do so. I think I found what I was looking for is somewhere in the stack of I-Ds. Am I worried somebody can implement this wrong. Sure. But, not any more than I would be for any other protocol. Now on to the specifics: NOTE: I tried not repeat anything from the ARTART review. 0) s6: maybe this wording would be better? For these two sentences are you trying to say that MUST else if? OLD: At least one Local Endpoint MUST be specified if the Preconnection is used to Listen() for incoming Connections, but the list of Local Endpoints MAY be empty if the Preconnection is used to Initiate() connections. NEW: At least one Remote Endpoint MUST be specified if the Preconnection is used to Initiate() Connections, but the list of Remote Endpoints MAY be empty if the Preconnection is used to Listen() for incoming Connections 1) s6.3.1 I know this is an example, but can we replace: SecurityParameters.Set(supported-group, "secp256k1") with SecurityParameters.Set(supported-group, "secp256r1") r1 the current MTI for TLS. k1 is for bitcoin :) Or, is this where I get a bitcoin because I caught the shiny object? :) 2) s6.3.2: Is this like checking the certificate status? 3) s8.1.1- I read this definition a bunch. Are there two special values? The Type line says “Full Coverage” is special, but then the description says “0” is special too. Maybe look at s91.3.6 for inspiration? 4) s8.1.2: Any reason it’s not called connPriority? Seems arbitrary to drop the end of the word when connTimeout is even longer. 5) s8.1.2-should “Type” line also include (non-negative) like s8.1.1 and s9.1.3.2 do? 6) s8.1.3/.4: The Numeric values specifies seconds, minutes, hours, or millennia? 7) s8.1.6: don’t you need to specify the Type? I guess Enumeration is what you’re after? 8) s8.1.11.2/.3/.4: Are these sizes in bytes too like 8.1.11.1? 9) s8.2.1: RFC 5482 allows granularity of minutes or seconds don’t you need to say which it is here? 10) s8.2.2: Is there some reason it’s not called tcp.userTimeoutEnabled? 11) s8.2.3: Is there some reason it’s not called tcp.userTimeoutChangable? 12) s9.1.3.2: Why 100? 13) s9.1.3.2: Why shorten to msrPrio when msgOrdered is almost as long and safelyReplayable is longer? 14) A.1: Could the caution about freeing memory be generalized? 15) What follows are the I-D nits references to check. Some of these might be on purpose: == Outdated reference: A later version (-11) exists of draft-ietf-taps-arch-10 ** Obsolete normative reference: RFC 4941 (Obsoleted by RFC 8981) == Outdated reference: A later version (-06) exists of draft-ietf-httpbis-priority-03 == Outdated reference: A later version (-10) exists of draft-ietf-taps-impl-09 -- Obsolete informational reference (is this intentional?): RFC 5245 (Obsoleted by RFC 8445, RFC 8839) -- Obsolete informational reference (is this intentional?): RFC 5766 (Obsoleted by RFC 8656)

9.1.3.2.  <ins> msgPriority </ins> Integer (non-negative)


This property allows the application to express a preference for the use of temporary local addresses, sometimes called "privacy" <del> addresses RFC4941.  Temporary addresses are generally used to prevent </del>  linking connections over time when a stable address, sometimes called "permanent" address, is not needed.  There are some caveats to note when specifying this property.  First, if an application Requires the If there are multiple Local Endpoints or Remote Endpoints configured, then initiating a Rendezvous() action will systematically probe the reachability of those endpoint candidates following an approach such <del> as that used in Interactive Connectivity Establishment (ICE) RFC5245. </del>  If the endpoints are suspected to be behind a NAT, Rendezvous() can be initiated using Local Endpoints that support a method of discovering NAT bindings such as Session Traversal Utilities for NAT <del> (STUN) RFC8489 or Traversal Using Relays around NAT (TURN) RFC5766. </del>  In this case, the Local Endpoint will resolve to a mixture of local and server reflexive addresses.  The Resolve() action on the Preconnection can be used to discover these bindings:

As noted in the issue unsure if you also want to add a reference to for ICE.
15 from this . Trimmed to only outdated references because the outdated ones will be auto-fixed with a new version of -implementation. What follows are the I-D nits references to check. Some of these might be on purpose: ** Obsolete normative reference: RFC 4941 (Obsoleted by RFC 8981) -- Obsolete informational reference (is this intentional?): RFC 5245 (Obsoleted by RFC 8445, RFC 8839) NOTE: The PR only replaced 5245 with 8445. Unsure if you should also want to add a reference to 8839. -- Obsolete informational reference (is this intentional?): RFC 5766 (Obsoleted by RFC 8656) Reviewer: Sean Turner Review result: Has Issues This is an early sector review. Based on the ARTART early reviews of this I-D and the -arch I-D, there is no doubt going to need to be another review after the authors get done restructuring both I-Ds. BTW: Theresa thank you for the heads up about that restructuring. It forced me to read the -arch and -impl I-Ds, but that probably helped me not make silly requests of the authors/WG. tl;dr: I picked "has issues" knowing there is a rewrite on the way and I would like to reserve final judgement until then. I apologize upfront because I am going to ramble a bit before I get to the specifics: The taps I-Ds are about “a protocol-independent Transport Services Application Programming Interface (API).” I took a pretty liberal approach when reviewing this I-D from a security perspective because these I-Ds are somewhat different than the “normal” protocol I-Ds. As noted in the -arch I-D: these I-Ds do not specify “specific protocols or algorithms” … gasp. But, that’s probably okay in this context. I wondered what you would say about an API: Apps need to use the API properly! check: see -arch I-D Implementation/Library needs to be from trust source! check: see -interface I-D - Apps need to use the right keys at the right time! check: see -arch I-D - Avoid fallback/downgrade to insecure protocols! check: see -arch I-D and -impl I-D - Deal with 0-RTT! check: see -impl I-D - Address privacy aspects! check: see -interface I-D I mean maybe you could add something about: randomness for keys - but that better already be in the security protocol specifications so I do not think it is absolutely needed here. following good programming techniques - but I am not sure where you would point nor whether it really makes sense to do so. I think I found what I was looking for is somewhere in the stack of I-Ds. Am I worried somebody can implement this wrong. Sure. But, not any more than I would be for any other protocol. Now on to the specifics: NOTE: I tried not repeat anything from the ARTART review. 0) s6: maybe this wording would be better? For these two sentences are you trying to say that MUST else if? OLD: At least one Local Endpoint MUST be specified if the Preconnection is used to Listen() for incoming Connections, but the list of Local Endpoints MAY be empty if the Preconnection is used to Initiate() connections. NEW: At least one Remote Endpoint MUST be specified if the Preconnection is used to Initiate() Connections, but the list of Remote Endpoints MAY be empty if the Preconnection is used to Listen() for incoming Connections 1) s6.3.1 I know this is an example, but can we replace: SecurityParameters.Set(supported-group, "secp256k1") with SecurityParameters.Set(supported-group, "secp256r1") r1 the current MTI for TLS. k1 is for bitcoin :) Or, is this where I get a bitcoin because I caught the shiny object? :) 2) s6.3.2: Is this like checking the certificate status? 3) s8.1.1- I read this definition a bunch. Are there two special values? The Type line says “Full Coverage” is special, but then the description says “0” is special too. Maybe look at s91.3.6 for inspiration? 4) s8.1.2: Any reason it’s not called connPriority? Seems arbitrary to drop the end of the word when connTimeout is even longer. 5) s8.1.2-should “Type” line also include (non-negative) like s8.1.1 and s9.1.3.2 do? 6) s8.1.3/.4: The Numeric values specifies seconds, minutes, hours, or millennia? 7) s8.1.6: don’t you need to specify the Type? I guess Enumeration is what you’re after? 8) s8.1.11.2/.3/.4: Are these sizes in bytes too like 8.1.11.1? 9) s8.2.1: RFC 5482 allows granularity of minutes or seconds don’t you need to say which it is here? 10) s8.2.2: Is there some reason it’s not called tcp.userTimeoutEnabled? 11) s8.2.3: Is there some reason it’s not called tcp.userTimeoutChangable? 12) s9.1.3.2: Why 100? 13) s9.1.3.2: Why shorten to msrPrio when msgOrdered is almost as long and safelyReplayable is longer? 14) A.1: Could the caution about freeing memory be generalized? 15) What follows are the I-D nits references to check. Some of these might be on purpose: == Outdated reference: A later version (-11) exists of draft-ietf-taps-arch-10 ** Obsolete normative reference: RFC 4941 (Obsoleted by RFC 8981) == Outdated reference: A later version (-06) exists of draft-ietf-httpbis-priority-03 == Outdated reference: A later version (-10) exists of draft-ietf-taps-impl-09 -- Obsolete informational reference (is this intentional?): RFC 5245 (Obsoleted by RFC 8445, RFC 8839) -- Obsolete informational reference (is this intentional?): RFC 5766 (Obsoleted by RFC 8656)

This property allows the application to express a preference for the use of temporary local addresses, sometimes called "privacy"  <ins> addresses RFC8981.  Temporary addresses are generally used to prevent </ins> linking connections over time when a stable address, sometimes called "permanent" address, is not needed.  There are some caveats to note when specifying this property.  First, if an application Requires the If there are multiple Local Endpoints or Remote Endpoints configured, then initiating a Rendezvous() action will systematically probe the reachability of those endpoint candidates following an approach such  <ins> as that used in Interactive Connectivity Establishment (ICE) RFC8445. </ins> If the endpoints are suspected to be behind a NAT, Rendezvous() can be initiated using Local Endpoints that support a method of discovering NAT bindings such as Session Traversal Utilities for NAT  <ins> (STUN) RFC8489 or Traversal Using Relays around NAT (TURN) RFC8656. </ins> In this case, the Local Endpoint will resolve to a mixture of local and server reflexive addresses.  The Resolve() action on the Preconnection can be used to discover these bindings:


3.2. The Captive Portal API data structures are specified in JavaScript <del> Object Notation (JSON) RFC7159. </del>  The following keys are defined at the top-level of the JSON structure returned by the API server: 5. <del> TBD: None </del>  6.

Satisfied
application/json is fine in the general sense, but if you want to ever do things like versioning, then a media type is important. Crib from if you want a recent example.
Discussed in London, consensus to use a new media type.
I am ok with the added text.

3.2. The Captive Portal API data structures are specified in JavaScript  <ins> Object Notation (JSON) RFC7159.  Requests and responses for the Captive Portal API use the "application/captive+json" media type. Clients SHOULD include this media type as an Accept header in their GET requests, and servers MUST mark this media type as their Content- Type header in responses. </ins> The following keys are defined at the top-level of the JSON structure returned by the API server: 5.  <ins> This document registers the media type for Captive Portal API JSON text, "application/captive+json". application captive+json None None Encoding considerations are identical to those specified for the "application/json" media type. See This document specifies format of conforming messages and the interpretation thereof. This document This media type is intended to be used by servers presenting the Captive Portal API, and clients connecting to such captive networks. None See Authors' Addresses section. COMMON None CAPPORT IETF WG IETF </ins> 6.


"https://example.org/captive-portal/api/X54PD"  3.2. The Captive Portal API data structures are specified in JavaScript

Addresses , with the decisions made at the last IETF meeting
Added text based on Martin's suggestions
As David Bird pointed out, we should describe the model we assume for API server authentication. Then we need to describe the requirements on this. An important point here is that CRL or OCSP checking are likely to fail for a captive UE. A recommendation for servers to use OCSP stapling is likely necessary (whitelisting CRL or OCSP servers is probably workable, but OCSP stapling is a far superior solution).
This needs to mention AIA chasing as well. Some client implementations do that (others think that it's a crazy idea, but that's not a debate we need to enter into here).looks good.

"https://example.org/captive-portal/api/X54PD" <ins> 3.1.1. The purpose of accessing the Captive Portal API over an HTTPS connection is twofold: first, the encrypted connection protects the integrity and confidentiality of the API exhange from other parties on the local network; and second, it provides the client of the API an opportunity to authenticate the server that is hosting the API. This authentication is aimed at allowing a user to be reasonably confident that the entity providing the Captive Portal API has a valid certificate for the hostname in the URI (such as "example.com").  The hostname of the API SHOULD be displayed to the user in order to indicate the entity which is providing the API service. Clients performing revocation checking will need some means of accessing revocation information for certificates presented by the API server.  Online Certificate Status Protocol RFC6960 (OCSP) stapling, using the TLS Certificate Status Request extension RFC6066 SHOULD be used.  OCSP stapling allows a client to perform revocation checks without initiating new connections.  To allow for other forms of revocation checking, a captive network could permit connections to OCSP responders or Certificate Revocation Lists (CRLs) that are referenced by certificates provided by the API server. Certificates with missing intermediate certificates that rely on clients validating the certificate chain using the URI specified in the Authority Information Access (AIA) extension RFC5280 SHOULD NOT be used by the Captive Portal API server.  If the certificates do require the use of AIA, the captive network will need to allow client access to the host specified in the URI. If the client is unable to validate the certificate presented by the API server, it MUST NOT proceed with any of the behavior for API interaction described in this document.  The client will proceed to interact with the captive network as if the API capabilities were not present.  It may still be possible for the user to access the network by being redirected to a web portal. </ins> 3.2. The Captive Portal API data structures are specified in JavaScript


captive=true), it can still be allowed enough access for it to perform server authentication server-auth. <del> "user-portal-url" (required, string): provides the URL of a web </del>  portal with which a user can interact. "vendor-info-url" (optional, string): provides the URL of a webpage or site on which the operator of the network has <del> information that it wishes to share with the user (e.g. store </del>  info, maps, flight status, or entertainment). "expire-date" (optional, string formatted as RFC3339 datetime): portal systems might not count traffic to whitelisted servers, such as the API server, but clients cannot rely on such behavior.  4.3. A client connected to a captive network upon discovering the URI of 6.  This document registers the media type for Captive Portal API JSON text, "application/captive+json". IETF  7. This work in this document was started by Mark Donnelly and Margaret

As discussed in , define an IANA registry for extending JSON keys use for Captive Portal API.
NAME NAME thanks for the comments. Please take another pass!
Should we define an IANA registry for adding new keys?
Yes, yes we should.
and i already commented in the PR, but if possible it would be beneficial to have some distinction between IETF or a relevant organization (like WFA, WBA) requested keys vs from some individual organization
Would we want to suggest having a nested dictionary format for organization-specific extensions? Like "wba" as a key to a dictionary; or a sub-dictionary indicating that there are WISPr-related settings to be aware of?
i think it would be a good idea. We have seen WBA start to take active interest in the documents. Also there's work happening in WFA that could benefit from having an extension point
RFC 6648 might suggest otherwise. If there are things that a group wants to add that are truly unique to that group, this is probably fine.
Yes, I think that more than having per-group keys (with almost certain overlap), I'd imagine that compatibility with certain technologies would be handled via these sub-dictionaries, such as what I mentioned for WISPr. Not sure how critical mentioning this is in the document though.
Can we call this one done?
I'm assuming we will go down the path of defining an IANA registry with access technology specific extension ?
The description in "Captive Portal API Keys Registry" gives some guidance for prefixes, etc. I assume the experts once designated can work with WFA/WBA to define proper entries.

captive=true), it can still be allowed enough access for it to perform server authentication server-auth.  <ins> "user-portal-url" (optional, string): provides the URL of a web </ins> portal with which a user can interact. "vendor-info-url" (optional, string): provides the URL of a webpage or site on which the operator of the network has  <ins> information that it wishes to share with the user (e.g., store </ins> info, maps, flight status, or entertainment). "expire-date" (optional, string formatted as RFC3339 datetime): portal systems might not count traffic to whitelisted servers, such as the API server, but clients cannot rely on such behavior. <ins> The valid JSON keys can be extended by adding entries to the Captive Portal API Keys Registry iana-section.  If a client receives a key that it does not recognize, it MUST ignore the key and any associated values.  All keys other than the ones defined in this document as "required" will be considered optional. </ins> 4.3. A client connected to a captive network upon discovering the URI of 6. <ins> IANA is requested to create a registration for an "application/ captive+json" media type (iana-json) and a registry for fields in that format (iana-field-reg). 6.1. </ins> This document registers the media type for Captive Portal API JSON text, "application/captive+json". IETF <ins> 6.2. IANA is asked to create and maintain a new registry called "Captive Portal API Keys", which will reserve JSON keys for use in Captive Portal API data structures.  The initial contents of this registry are provided in json-keys. Each entry in the registry contains the following fields: The JSON key being registered, in string format. The type of the JSON value to be stored, as one of the value types defined in RFC8259. A brief description explaining the meaning of the value, how it might be used, and/or how it should be interpreted by clients. New assignments for Captive Portal API Keys Registry will be administered by IANA through Expert Review RFC8126.  The Designated Expert is expected to validate the existence of documentation describing new keys in a permanent publicly available specification. The expert is expected to validate that new keys have a clear meaning and do not create unnecessary confusion or overlap with existing keys.  Keys that are specific to non-generic use cases, particularly ones that are not specified as part of an IETF document, are encouraged to use a domain-specific prefix. </ins> 7. This work in this document was started by Mark Donnelly and Margaret


5. <del> TBD: Provide complete security requirements and analysis. </del>  5.1.

Adding a security considerations section to describe the security benefits that are added, along with the concern about trusting any hostnames even after authentication. I'd like to get some form of this in soon, and then rev the document before the IETF 105 cutoff.
thanks for starting this. looks like a good text to start with. Should we also propose something to the privacy section ?
We have a bit in the privacy section already, so I was going to leave it for now. If you have suggested text, let me know and I’ll add it!

5.  <ins> One of the goals of this protocol is to improve the security of the communication between client hosts and Captive Portal systems. Client traffic is protected from passive listeners on the local network by requiring TLS-encrypted connections between the client and the Captive Portal API server, as described in api-details.  All communication between the clients and the API server MUST be encrypted. In addition to encrypting communications between clients and Captive Portal systems, this protocol requires a basic level of authentication from the API server, as described in server-auth. Specifically, the API server MUST present a valid certificate on which the client can perform revocation checks.  This allows the client to ensure that the API server has authority for a hostname that can be presented to a user. It is important to note that while the server authentication checks can validate a specific hostname, it is certainly possible for the API server to present a valid certificate for a hostname that uses non-standard characters or is otherwise designed to trick the user into believing that its hostname is some other, more trustworthy, name.  This is a danger of any scenario in which a hostname is not typed in by a user. </ins> 5.1.


it wishes to share with the user (e.g., store info, maps, flight status, or entertainment). <del> "expire-date" (optional, string formatted as RFC3339 datetime): indicates the date and time after which the client will be in a </del>  captive state.  The API server SHOULD include this value if the client is not captive (i.e. captive=false) and SHOULD omit this value for captive clients.

Completes
As discussed in the IETF hackathon/informal meeting, the consensus is to change expire-date (an absolute iso datetime) to seconds-remaining integer (named after bytes-remaining)
This was already done!
thanks, missed that
The draft currently specifies a deadline as an absolute time. Experience with implementation showed that time remaining (in seconds) was easier to implement and less subject to the vagaries of clock differences.

it wishes to share with the user (e.g., store info, maps, flight status, or entertainment).  <ins> "seconds-remaining" (optional, integer): indicates the number of seconds remaining, after which the client will be placed into a </ins> captive state.  The API server SHOULD include this value if the client is not captive (i.e. captive=false) and SHOULD omit this value for captive clients.


Abstract This document describes an HTTP API that allows hosts to interact <del> with a Captive Portal system on a local network. </del>  1. This document describes a HyperText Transfer Protocol (HTTP) Application Program Interface (API) that allows hosts to interact <del> with a Captive Portal system on a local network.  The API defined in this document has been designed to meet the requirements in the Captive Portal Architecture I-D.larose-capport-architecture. Specifically, the API provides: </del>  The state of captivity (whether or not the host has access to the Internet) are blocked by the captive portal This document is focused on the second step.  It is assumed that the <del> location of the Captive Portal API server has been provisioned as part of the first step.  The mechanism for discovering this value not covered by this document. </del>  3. 3.1. <del> In order to communicate with the captive portal API server, the URI provisioned to the host SHOULD use the form of a well-known URI RFC5785 ending with the string ".well-known/captive-portal.json".  If this suffix is not included in the URI already provisioned, a host SHOULD append the suffix when communicating to the server. The Captive Portal API MUST be accessed using HTTP over TLS on TCP port 443 (HTTPS) RFC2818. </del>  For example, if the Captive Portal API server is hosted at <del> example.org, the URI of the API would be: "https://example.org/.well- known/captive-portal.json". </del>  3.2. server "user-portal-url" (required, string): provides the URL of a web <del> portal that can be presented a user to authenticate </del>  <del> "expire-date" (optional, datetime): indicates the time at which the Captive Portal is expected to close </del>  "bytes-remaining" (optional, integer): indicates the number of <del> bytes left, after which the Captive Portal is expected to close </del>  Note that the use of the hmac-key is not defined in this document, but is intended for use in the enforcement step of the Captive Portal 5. <del> This document defines one ".well-known" URIs using the registration procedure and template from Section 5.1 of RFC5785. 5.1. URI suffix: captive-portal.json Change controller: IETF Specification document(s): This RFC Related information: None </del>  6.

Removed language for /.well-known URI. Made serving over port 443 a SHOULD requirement. Other editorial changes
Added your updated language, should be good to go.
I don't think that we need this. 7710 gives us an entire URI, as can PvD.
I agree that we can use the URI from the DHCP option or from PvD. The reason I went this route was to avoid the scheme that was in the API draft to start with, which seemed to be: If you access the 7710 URI with a GET, you'll receive the HTTP for the user interactive portal If you access the 7710 URI with a POST, you'll get the JSON API That seemed problematic (a) because it implies the user portal and API are co-located and (b) it seemed overly complex. Do you have a preference for what methods are valid to access the JSON API, and whether we should specify that the URI needs to be JSON? My concern was that if the DHCP option or whatever pointed to something that was clearly .html, something's wrong, and using a well-known JSON URI to compare against would be a way to detect that.
NAME Thoughts on the method for fetching the JSON API, or if that's a non-issue?
Let's take this to the list.
PR fixes the well-known URI language. For now there is indication of Accept and Conent-Type header usage but we haven't explicitly called it out until we get a final decision. We can close this issue though.

Abstract This document describes an HTTP API that allows hosts to interact  <ins> with a Captive Portal system. </ins> 1. This document describes a HyperText Transfer Protocol (HTTP) Application Program Interface (API) that allows hosts to interact  <ins> with a Captive Portal system.  The API defined in this document has been designed to meet the requirements in the Captive Portal Architecture I-D.ietf-capport-architecture.  Specifically, the API provides: </ins> The state of captivity (whether or not the host has access to the Internet) are blocked by the captive portal This document is focused on the second step.  It is assumed that the  <ins> location of the Captive Portal API server has been discovered by the host as part of the first step.  The mechanism for discovering the API Server endpoint is not covered by this document. </ins> 3. 3.1.  <ins> The URI of the API endpoint MUST be accessed using HTTP over TLS (HTTPS) and SHOULD be served on port 443 RFC2818.  The host SHOULD NOT assume that the URI for a given network attachment will stay the same, and SHOULD rely on the discovery or provisioning process each time it joins the network.  Depending on how the Captive Portal system is configured, the URI may be unique for each host and between sessions for the same host. </ins> For example, if the Captive Portal API server is hosted at  <ins> example.org, the URI's of the API could be: "https://example.org/captive-portal/api" "https://example.org/captive-portal/api/X54PD" </ins> 3.2. server "user-portal-url" (required, string): provides the URL of a web  <ins> portal that can be presented to a user to interact with </ins>  <ins> "expire-date" (optional, string formatted as RFC3339 datetime): indicates the date and time after which the host will be in a captive state </ins> "bytes-remaining" (optional, integer): indicates the number of  <ins> bytes left, after which the host will be in a captive state </ins> Note that the use of the hmac-key is not defined in this document, but is intended for use in the enforcement step of the Captive Portal 5.  <ins> TBD: None </ins> 6.


ACP domain certificates MUST be RFC5280 compliant X.509 certificates. ACP nodes MUST support RSA and Elliptic Curve (ECC) public keys in <del> ACP certificates.  ACP certificates wth ECC keys MUST indicate to be </del>  Elliptic Curve Diffie-Hellman capable (ECDH) if X.509 v3 keyUsage and extendedKeyUsage are included in the certificate. 6.7.1.1.1. <del> ACP IPsec implementations MUST comply with RFC8221 (and its updates), with the following modifications to simplify hardware accelerated ACP IPsec implementation requirements by eliminating requirements for legacy or cryptographically weak options. ACP MUST NOT use any NULL encryption option due to the confidentiality of ACP payload that may not be encrypted by itself when carrying legacy management protocol traffics as well as hop-by- hop GRASP, which is designed to rely on the ACP for confidentiality of hop-by-hop distributed information.  Therefore, IPsec MUST support ESP and MUST NOT use AH.  For ESP, ENCR_NULL MUST NOT be used for ACP secure channels. </del>  <del> Only ENCR_AES_GCM_16 is REQUIRED as an encryption algorithm for ACP secure channels with ESP. If an ACP node can perform ENCR_AES_CBC, ENCR_AES_CCM_8 at higher performance than ENCR_AES_GCM_16 or ENCR_CHACHA20_POLY1305 at equal or higher performance than ENCR_AES_GCM_16 then that ACP node SHOULD support such an encryption algorithm and prefer it in the IKEv2 negotiation if its performance is higher than that of ENCR_AES_GCM_16.  Otherwise there are no normative requirements against either of these options.  These requirements are overriding the MUST/SHOULD/SHOULD requirements of RFC8221 for these three algorithms for the following reasons: There is no unconditional requirement against ENCR_AES_CBC because ENCR_AES_GCM_16 is assumed to be feasible with less cost/higher higher performance in modern devices hardware accelerated implementations compared to ENCR-AES_CBC. AES-GCM is an authenticated encryption with associated data (AEAD) cipher mode, so no ESP authentication algorithm requirement is needed (unless further encryption algorithms are supported), further simplifying ACP IPsec implementations. there is no requirement to interoperate with legacy equipment in ACP secure channels, so a single MTI encryption algorithm for IPsec in ACP secure channels is sufficient for interoperability. There is no unconditional requirement against ENCR_AES_CCM_8 because it is currently not likely that it would be preferrable in ACP secure channels for more constrained IoT devices over options such as DTLS.  In RFC8221 this algorithm is more desirable, because of solutions relying only on IPsec without such non-IPsec alternatives. There is no unconditional requirement against ENCR_CHACHA20_POLY1305 because there is currently no mechanism in the ACP to migrate all secure channels in an ACP domain to a different preferred encryption algorithm in the case of future discovered crypto weaknesses of AES.  Once such mechanisms are defined, ENCR_CHACHA20_POLY1305 would be a good encryption algorithm, but due to the transitive traffic through ACP secure channels only when this does not result in an unexpected drop in performance. When using AES for encryption, keys less than 256 bits MUST NOT be used, and 256-bit keys MUST be supported. Once there are updates to RFC8221, these should accordingly be reflected in updates to these ACP requirements, for example if ENCR_AES_GCM_16 was to be superceeded in the future. </del>  6.7.1.1.2. <del> IKEv2 for ACP secure channels MUST support the requirements of RFC8247 (as necessary to support the above described modified RFC8221 requirements for IPsec via ESP).  Because IKEv2 for ACP secure channels is sufficient to be implemented in control plane software as opposed to ESP (which may need to be implemented in accelerated forwarding plane for sufficient performance), there are no restrictions on the requirements of RFC8247 for ACP secure channels. Instead, the following paragraphs describe additional or stricter requirements necessary for the authentication of ACP secure channels in IKEv2 via ACP domain certificates. IKEv2 Diffie-Hellman key exchange group 19 (256-bit random ECP) MUST be supported (in addition to 2048-bit MODP).  ECC provides a similar security level to finite-field (MODP) key exchange with a shorter key length, so is generally preferred absent other considerations. </del>  IKEv2 authentication MUST use the ACP domain certificates.  The Certificate Encoding "PKCS #7 wrapped X.509 certificate" (1) MUST be supported (see IKEV2IANA for this and other IANA IKEv2 parameter names used in this text).  If certificate chains are used, all <del> intermediate certificates up to, but not including the locally provisioned trust anchor certificate must be signaled. </del>  A certificate payload with the ACP certificate MUST be included during IKEv2 authentication to support the ACP domain membership

I've done some slight editing of your text for readability. I have removed text that is repeating RFC8247 and RFC8221 poorly, leveraging those documents better. I have made a change to say that trust anchor certificates should be sent. (Believe me, without that, it makes debugging really difficult)

ACP domain certificates MUST be RFC5280 compliant X.509 certificates. ACP nodes MUST support RSA and Elliptic Curve (ECC) public keys in  <ins> ACP certificates.  ACP certificates with ECC keys MUST indicate to be </ins> Elliptic Curve Diffie-Hellman capable (ECDH) if X.509 v3 keyUsage and extendedKeyUsage are included in the certificate. 6.7.1.1.1.  <ins> ACP IPsec implementations MUST comply with RFC8221 (and its updates). The following additional guidance is provided The ACP MUST NOT use any NULL encryption option due to the confidentiality of ACP payload.  All other MUST and SHOULD algorithms specified by RFC8221 (and replacement documents) are to be supported. The order of the proposals is not specified by RFC8221.  The first protocol offered which is supported by both ends is generally chosen, and so this document recommends listing the higher performance protocols first. The ENCR_AES_GCM_16 is listed as a MUST in RFC8221 and is often the faster protocol, so it is to be listed first. If an ACP node can perform ENCR_AES_CBC, or ENCR_AES_CCM_8 at higher performance than ENCR_AES_GCM_16 or ENCR_CHACHA20_POLY1305, then those should be listed first in the policy. ENCR_AES_GCM_16 is preferred, but: There is no unconditional requirement against ENCR_AES_CBC use. </ins>  <ins> ENCR_AES_GCM_16 is assumed to be feasible with less cost/higher higher performance in modern devices hardware accelerated implementations compared to ENCR-AES_CBC. AES-GCM is an authenticated encryption with associated data (AEAD) cipher mode, so no ESP authentication algorithm requirement is needed (unless further encryption algorithms are supported), further simplifying ACP IPsec implementations. there is no requirement to interoperate with legacy equipment in ACP secure channels, so a single MTI encryption algorithm for IPsec in ACP secure channels is sufficient for interoperability. RFC8221 allows for 128-bit or 256-bit AES keys.  This document mandates that only 256-bit AES keys MUST be supported. When RFC8221 is updated, ACP implementations will need to consider legacy interoperability, and the IPsec WG has generally done a very good job of taking that into account in its recommendations. </ins> 6.7.1.1.2.  <ins> RFC8247 provides a baseline recommendation for mandatory to implement ciphers, integrity checks, pseudo-random-functions and Diffie-Hellman mechanisms.  Those recommendations, and the recommendations of subsequent documents apply well to the ACP.  Because IKEv2 for ACP secure channels is sufficient to be implemented in control plane software, rather than in ASIC hardware, this documents makes no changes to the recommendations. This document does establish a policy statement as permitted by RFC8247 for the specific case of ACP traffic. The IKEv2 Diffie-Hellman key exchange group 19 (256-bit random ECP), listed as a SHOULD, is to be configured, as long as with the 2048-bit MODP (group 14).  The ECC provides a similar security level to finite-field (MODP) key exchange with a shorter key length, so is generally preferred absent other considerations. </ins> IKEv2 authentication MUST use the ACP domain certificates.  The Certificate Encoding "PKCS #7 wrapped X.509 certificate" (1) MUST be supported (see IKEV2IANA for this and other IANA IKEv2 parameter names used in this text).  If certificate chains are used, all  <ins> intermediate certificates up to, and including the locally provisioned trust anchor certificate must be signaled.  While the top-trust anchor will never be used by a properly configured peer, it can provide a significant amount of useful information to debug an ACP network.  There is some small concern that it might provide useful information to an attacker about who the network is, the other certificates that are sent already clearly indicate this information. </ins> A certificate payload with the ACP certificate MUST be included during IKEv2 authentication to support the ACP domain membership


and 'ietf-tcg-algs.yang' ref-ietf-tcg-algs with prefix 'taa'. Additionally, references are made to RFC8032, RFC8017, RFC6933, TPM1.2-Commands, TPM2.0-Arch, TPM2.0-Structures, TPM2.0-Key, <del> TPM1.2-Structures, bios-log, ima-log, BIOS-Log-Event-Type and netequip-boot-log. </del>  2.1.1.1. UEFI event logs. 'ima': Indicates that the device supports the retrieval of event <del> logs from the Linux Integrity Measurement Architecture (IMA). </del>  'netequip_boot': Indicates that the device supports the retrieval <del> of netequip boot event logs. </del>  2.1.1.2. 10118-3, ISO-IEC-14888-3, ISO-IEC-15946-1, ISO-IEC-18033-3, IEEE-Std- 1363-2000, IEEE-Std-1363a-2004, NIST-PUB-FIPS-202, NIST-SP800-38C, NIST-SP800-38D, NIST-SP800-38F, NIST-SP800-56A, NIST-SP800-108, bios- <del> log, ima-log, and netequip-boot-log exist within the YANG Model. </del>  2.1.2.1.

Self-approved
Thanks, this does a good job bridging the gap between what we say in the body of the document and what is available in external references.

and 'ietf-tcg-algs.yang' ref-ietf-tcg-algs with prefix 'taa'. Additionally, references are made to RFC8032, RFC8017, RFC6933, TPM1.2-Commands, TPM2.0-Arch, TPM2.0-Structures, TPM2.0-Key,  <ins> TPM1.2-Structures, bios-log, ima-log, BIOS-Log-Event-Type, as well as ima and netequip-boot-log. </ins> 2.1.1.1. UEFI event logs. 'ima': Indicates that the device supports the retrieval of event  <ins> logs from the Linux Integrity Measurement Architecture (IMA ima- log).  Also see ima. </ins> 'netequip_boot': Indicates that the device supports the retrieval  <ins> of netequip boot event logs.  See ima and netequip-boot-log. </ins> 2.1.1.2. 10118-3, ISO-IEC-14888-3, ISO-IEC-15946-1, ISO-IEC-18033-3, IEEE-Std- 1363-2000, IEEE-Std-1363a-2004, NIST-PUB-FIPS-202, NIST-SP800-38C, NIST-SP800-38D, NIST-SP800-38F, NIST-SP800-56A, NIST-SP800-108, bios-  <ins> log, ima-log, as well as ima and netequip-boot-log exist within the YANG Model. </ins> 2.1.2.1.


store system security measurement Evidence.  And each TPM is used as a root of trust for reporting (RTR) in order to retrieve attestation Evidence.  This is done by using a YANG RPC to request a quote which <del> exposes a rolling hash the security measurements held internally </del>  within the TPM. Specific terms imported from I-D.ietf-rats-architecture and used in and 'ietf-tcg-algs.yang' ref-ietf-tcg-algs with prefix 'taa'. Additionally, references are made to RFC8032, RFC8017, RFC6933, TPM1.2-Commands, TPM2.0-Arch, TPM2.0-Structures, TPM2.0-Key, <del> TPM1.2-Structures, bios-log, ima-log, BIOS-Log-Event-Type, as well as ima and netequip-boot-log. </del>  2.1.1.1. UEFI event logs. 'ima': Indicates that the device supports the retrieval of event <del> logs from the Linux Integrity Measurement Architecture (IMA ima- log).  Also see ima. </del>  'netequip_boot': Indicates that the device supports the retrieval of netequip boot event logs.  See ima and netequip-boot-log. 10118-3, ISO-IEC-14888-3, ISO-IEC-15946-1, ISO-IEC-18033-3, IEEE-Std- 1363-2000, IEEE-Std-1363a-2004, NIST-PUB-FIPS-202, NIST-SP800-38C, NIST-SP800-38D, NIST-SP800-38F, NIST-SP800-56A, NIST-SP800-108, bios- <del> log, ima-log, as well as ima and netequip-boot-log exist within the YANG Model. </del>  2.1.2.1.

NAME I did what I could in the time remaining. Please check and I think there are only two comments left unaddressed.

store system security measurement Evidence.  And each TPM is used as a root of trust for reporting (RTR) in order to retrieve attestation Evidence.  This is done by using a YANG RPC to request a quote which  <ins> exposes a rolling hash of the security measurements held internally </ins> within the TPM. Specific terms imported from I-D.ietf-rats-architecture and used in and 'ietf-tcg-algs.yang' ref-ietf-tcg-algs with prefix 'taa'. Additionally, references are made to RFC8032, RFC8017, RFC6933, TPM1.2-Commands, TPM2.0-Arch, TPM2.0-Structures, TPM2.0-Key,  <ins> TPM1.2-Structures, bios-log, BIOS-Log-Event-Type, as well as ima and netequip-boot-log. </ins> 2.1.1.1. UEFI event logs. 'ima': Indicates that the device supports the retrieval of event  <ins> logs from the Linux Integrity Measurement Architecture (IMA, see ima). </ins> 'netequip_boot': Indicates that the device supports the retrieval of netequip boot event logs.  See ima and netequip-boot-log. 10118-3, ISO-IEC-14888-3, ISO-IEC-15946-1, ISO-IEC-18033-3, IEEE-Std- 1363-2000, IEEE-Std-1363a-2004, NIST-PUB-FIPS-202, NIST-SP800-38C, NIST-SP800-38D, NIST-SP800-38F, NIST-SP800-56A, NIST-SP800-108, bios-  <ins> log, as well as ima and netequip-boot-log exist within the YANG Model. </ins> 2.1.2.1.


composite device (quote primitive operation).  Additionally, it is used as a root of trust for storage (RTS) in order to retain shielded secrets and store system measurements using a folding hash function <del> (extent primitive operation). </del>  1.1.

extent -> extend thx! I would have never catched that, I htink.

composite device (quote primitive operation).  Additionally, it is used as a root of trust for storage (RTS) in order to retain shielded secrets and store system measurements using a folding hash function  <ins> (extend primitive operation). </ins> 1.1.


Abstract <del> This document defines a YANG RPC and a minimal datastore required to retrieve attestation evidence about integrity measurements from a device following the operational context defined in TPM-based Network Device Remote Integrity Verification.  Complementary measurement logs are also provided by the YANG RPC originating from one or more roots of trust of measurement.  The module defined requires at least one TPM 1.2 or TPM 2.0 and corresponding Trusted Software Stack included in the device components of the composite device the YANG server is running on. </del>  1.

Per Jeurgen's comment that we are not building a new datastore (type)

Abstract  <ins> This document defines a YANG RPC and a small number of configuration node required to retrieve attestation evidence about integrity measurements from a device following the operational context defined in TPM-based Network Device Remote Integrity Verification. Complementary measurement logs are also provided by the YANG RPC originating from one or more roots of trust of measurement.  The module defined requires at least one TPM 1.2 or TPM 2.0 and corresponding Trusted Software Stack included in the device components of the composite device the YANG server is running on. </ins> 1.


Abstract <del> This document defines a YANG RPC and a small number of configuration node required to retrieve attestation evidence about integrity measurements from a device following the operational context defined </del>  in TPM-based Network Device Remote Integrity Verification. <del> Complementary measurement logs are also provided by the YANG RPC originating from one or more roots of trust of measurement.  The module defined requires at least one TPM 1.2 or TPM 2.0 and corresponding Trusted Software Stack included in the device </del>  components of the composite device the YANG server is running on. 1. I-D.ietf-rats-tpm-based-network-device-attest as well as the interaction model and information elements defined in I-D.ietf-rats- reference-interaction-models.  The currently supported hardware <del> security modules are the Trusted Platform Module (TPM) TPM1.2 and TPM2.0 specified by the Trusted Computing Group (TCG).  One or more TPMs embedded in the components of a Composite Device are required in order to use the YANG module defined in this document.  A TPM is used as a root of trust for reporting in order to retrieve attestation Evidence from a composite device (quote primitive operation). Additionally, it is used as a root of trust for storage (RTS) in order to retain shielded secrets and store system measurements using a folding hash function (extend primitive operation). </del>  Specific terms imported from I-D.ietf-rats-architecture and used in this document include: Attester, Composite Device, Evidence. Specific terms imported from TPM2.0-Key and used in this document <del> include: Endorsement Key (EK), Initial Attestation key (IAK), Local </del>  Attestation Key (LAK). 1.1. 2. <del> One or more TPMs MUST be embedded in the composite device that is providing attestation evidence via the YANG module defined in this document.  The ietf-basic-remote-attestation YANG module enables a composite device to take on the role of Claimant and Attester in accordance with the Remote Attestation Procedures (RATS) architecture I-D.ietf-rats-architecture and the corresponding challenge-response interaction model defined in the I-D.ietf-rats-reference-interaction- models document.  A fresh nonce with an appropriate amount of entropy MUST be supplied by the YANG client in order to enable a proof-of- freshness with respect to the attestation evidence provided by the attester running the YANG datastore.  The functions of this YANG module are restricted to 0-1 TPMs per hardware component. </del>  2.1.  2.1.1. This YANG module imports modules from RFC6991, RFC8348, I-D.ietf- <del> netconf-keystore, ietf-tcg-algs.yang ref-ietf-tcg-algs. </del>  2.1.1.1. This module supports the following features: <del> 'TPMs' - Indicates that multiple TPMs on the device can support remote attestation, This feature is applicable in cases where multiple line cards, each with its own TPM. </del>  <del> 'bios' - Indicates the device supports the retrieval of bios event logs. </del>  <del> 'ima' - Indicates the device supports the retrieval of Integrity Measurement Architecture event logs. </del>  <del> 'netequip_boot' - Indicates the device supports the retrieval of netequip boot event logs. </del>  2.1.1.2. This module supports the following types of attestation event logs: <del> 'ima', 'bios', and 'netequip_boot'. </del>  2.1.1.3.  2.1.1.3.1. <del> This RPC allows a Verifier to request a quote of PCRs from a TPM2.0 compliant cryptoprocessor.  Where the feature 'TPMs' is active, and one or more 'certificate-name' is not provided, all TPM2.0 compliant cryptoprocessors will respond.  A YANG tree diagram of this RPC is as follows: </del>  <del> An example of an RPC challenge requesting PCRs 0-7 from a SHA256 bank could look like the following: </del>  <del> and a successful response might be formated as follows: </del>  <del> 2.1.1.4. </del>  <del> This RPC allows a Verifier to request a quote of PCRs from a TPM1.2 compliant cryptoprocessor.  Where the feature 'TPMs' is active, and one or more 'certificate-name' is not provided, all TPM1.2 compliant cryptoprocessors will respond.  A YANG tree diagram of this RPC is as follows: </del>  <del> 2.1.1.5. </del>  This RPC allows a Verifier to acquire the evidence which was extended <del> into specific PCRs.  A YANG tree diagram of this RPC is as follows: </del>  <del> 2.1.1.6. </del>  This section provides a high level description of the data nodes containing the configuration and operational objects with the YANG model.  For more details, please see the YANG model itself in ref- ietf-tpm-remote-attestation. <del> container 'rats-support-structures' - This houses the set of information relating to a device's TPM(s). </del>  <del> container 'tpms' - Provides configuration and operational details for each supported TPM, including the tpm-firmware-version, PCRs which may be quoted, certificates which are associated with that TPM, and the current operational status.  Of note is the certificates which are associated with that TPM.  As a certificate is associated with a single Attestation key, knowledge of the certificate allows a specific TPM to be identified. </del>  <del> container 'attester-supported-algos' - Identifies which TCG algorithms are available for use the Attesting platform.  This allows an operator to limit algorithms available for use by RPCs to just a desired set from the universe of all allowed by TCG. </del>  container 'compute-nodes' - When there is more than one TPM supported, this container maintains the set of information related to <del> the compute associated with a specific TPM.  This allows each specific TPM to identify on which 'compute-node' it belongs. </del>  <del> 2.1.1.7. </del>  2.1.2. Cryptographic algorithm types were initially included within -v14 <del> NETCONF's iana-crypto-types.yang.  Unfortunately all this content </del>  including the algorithms needed here failed to make the -v15 used <del> WGLC.  As a result this document has encoded the TCG Algorithm </del>  definitions of TCG-Algos, revision 1.32.  By including this full table as a separate YANG file within this document, it is possible for other YANG models to leverage the contents of this model. 2.1.2.1. <del> There are two types of features supported 'TPM12' and 'TPM20'. </del>  Support for either of these features indicates that a cryptoprocessor <del> supporting the corresponding type of TCG API is present on an </del>  Attester.  Most commonly, only one type of cryptoprocessor will be available on an Attester. 2.1.2.2. <del> There are three types of identities in this model. </del>  <del> The first are the cryptographic functions supportable by a TPM algorithm, these include: 'asymmetric', 'symmetric', 'hash', 'signing', 'anonymous_signing', 'encryption_mode', 'method', and 'object_type'.  The definitions of each of these are in Table 2 of TCG-Algos. </del>  <del> The second are API specifications for tpms: 'tpm12' and 'tpm2'. </del>  <del> The third are specific algorithm types.  Each algorithm type defines what cryptographic functions may be supported, and on which type of API specification.  It is not required that an implementation of a specific TPM will support all algorithm types.  The contents of each specific algorithm mirrors what is in Table 3 of TCG-Algos. </del>  2.1.2.3. Note that not all cryptographic functions are required for use by <del> ietf-tpm-remote-attestation.yang.  However the full definition of </del>  Table 3 of TCG-Algos will allow use by additional YANG specifications. This document will include requests to IANA: <del> To be defined yet.  But keeping up with changes to ietf-tcg-algs.yang will be necessary. </del>  4. RFC8446. There are a number of data nodes defined in this YANG module that are <del> writable/creatable/deletable (i.e., config true, which is the </del>  default).  These data nodes may be considered sensitive or vulnerable <del> in some network environments.  Write operations (e.g., edit-config) </del>  to these data nodes without proper protection can have a negative effect on network operations.  These are the subtrees and data nodes <del> and their sensitivity/vulnerability: Container: '/rats-support-structures/attester-supported-algos' </del>  'tpm12-asymmetric-signing', 'tpm12-hash', 'tpm20-asymmetric- <del> signing', and 'tpm20-hash' all could be populated with algorithms which are not supported by the underlying physical TPM installed by the equipment vendor. Container: '/rats-support-structures/tpms' </del>  <del> 'name' - Although shown as 'rw', it is system generated. Therefore it should not be possible for an operator to add or remove a TPM from the configuration. </del>  <del> 'tpm20-pcr-bank' - It is possible to configure PCRs for extraction </del>  which are not being extended by system software.  This could unnecessarily use TPM resources. <del> 'certificates' - It is possible to provision a certificate which does not correspond to a Attestation Identity Key (AIK) within the TPM. </del>  <del> RPC: 'tpm12-challenge-response-attestation' - Need to verify that the certificate is provided is able to support Attestation on the targeted TPM. </del>  <del> RPC: 'tpm20-challenge-response-attestation' - Need to verify that the certificate is provided is able to support Attestation on the targeted TPM. </del>  <del> RPC: 'log-retrieval' - Pulling lots of logs can chew up system resources. </del>  5.

Basically, this fixes typos, grammar, and consistency. And, all above, the TPM 2.0 quote information, which was set to TPMSQUOTEINFO. Actually it is TPM2B_ATTEST. Further Issues to be created.
TPM 2.0 quote information (attestation data) is of type TPM2BATTEST, not TPMSQUOTEINFO. TPMSQUOTEINFO is a sub element of the TPM2BATTEST. In a TPM2Quote operation, the TPM signs a hash of the TPM2BATTEST structure. The signature is of type TPMT_SIGNATURE (just FYI).

Abstract  <ins> This document defines YANG RPCs and a small number of configuration nodes required to retrieve attestation evidence about integrity measurements from a device, following the operational context defined </ins> in TPM-based Network Device Remote Integrity Verification.  <ins> Complementary measurement logs are also provided by the YANG RPCs, originating from one or more roots of trust for measurement (RTMs). The module defined requires at least one TPM 1.2 or TPM 2.0 as well as a corresponding TPM Software Stack (TSS), included in the device </ins> components of the composite device the YANG server is running on. 1. I-D.ietf-rats-tpm-based-network-device-attest as well as the interaction model and information elements defined in I-D.ietf-rats- reference-interaction-models.  The currently supported hardware  <ins> security modules (HSMs) are the Trusted Platform Modules (TPMs) TPM1.2 and TPM2.0 as specified by the Trusted Computing Group (TCG). One or more TPMs embedded in the components of a Composite Device are required in order to use the YANG module defined in this document.  A TPM is used as a root of trust for reporting (RTR) in order to retrieve attestation Evidence from a composite device (_TPM Quote_ primitive operation).  Additionally, it is used as a root of trust for storage (RTS) in order to retain shielded secrets and store system measurements using a folding hash function (_TPM PCR Extend_ primitive operation). </ins> Specific terms imported from I-D.ietf-rats-architecture and used in this document include: Attester, Composite Device, Evidence. Specific terms imported from TPM2.0-Key and used in this document  <ins> include: Endorsement Key (EK), Initial Attestation Key (IAK), Local </ins> Attestation Key (LAK). 1.1. 2.  <ins> One or more TPMs MUST be embedded in a Composite Device that provides attestation evidence via the YANG module defined in this document. The ietf-basic-remote-attestation YANG module enables a composite device to take on the role of an Attester, in accordance with the Remote Attestation Procedures (RATS) architecture I-D.ietf-rats- architecture, and the corresponding challenge-response interaction model defined in the I-D.ietf-rats-reference-interaction-models document.  A fresh nonce with an appropriate amount of entropy MUST be supplied by the YANG client in order to enable a proof-of- freshness with respect to the attestation Evidence provided by the Attester running the YANG datastore.  Further, this nonce is used to prevent replay attacks.  The functions of this YANG module are restricted to 0-1 TPMs per hardware component. </ins> 2.1. <ins> In this section the several YANG modules are defined. </ins> 2.1.1. This YANG module imports modules from RFC6991, RFC8348, I-D.ietf-  <ins> netconf-keystore, and "ietf-tcg-algs.yang" ref-ietf-tcg-algs. </ins> 2.1.1.1. This module supports the following features:  <ins> 'TPMs': Indicates that multiple TPMs on the device can support remote attestation.  This feature is applicable in cases where multiple line cards are present, each with its own TPM. </ins>  <ins> 'bios': Indicates that the device supports the retrieval of BIOS/ UEFI event logs. </ins>  <ins> 'ima': Indicates that the device supports the retrieval of event logs from the Linux Integrity Measurement Architecture (IMA). </ins>  <ins> 'netequip_boot': Indicates that the device supports the retrieval of netequip boot event logs. </ins> 2.1.1.2. This module supports the following types of attestation event logs:  <ins> 'bios', 'ima', and 'netequip_boot'. </ins> 2.1.1.3. <ins> In the following, RPCs for both TPM 1.2 and TPM 2.0 attestation procedures are defined. </ins> 2.1.1.3.1.  <ins> This RPC allows a Verifier to request signed TPM PCRs (_TPM Quote_ operation) from a TPM 1.2 compliant cryptoprocessor.  Where the feature 'TPMs' is active, and one or more 'certificate-name' is not provided, all TPM 1.2 compliant cryptoprocessors will respond.  A YANG tree diagram of this RPC is as follows: </ins>  <ins> 2.1.1.3.2. </ins>  <ins> This RPC allows a Verifier to request signed TPM PCRs (_TPM Quote_ operation) from a TPM 2.0 compliant cryptoprocessor.  Where the feature 'TPMs' is active, and one or more 'certificate-name' is not provided, all TPM 2.0 compliant cryptoprocessors will respond.  A YANG tree diagram of this RPC is as follows: </ins>  <ins> An example of an RPC challenge requesting PCRs 0-7 from a SHA-256 bank could look like the following: </ins>  <ins> A successful response could be formatted as follows: </ins>  <ins> 2.1.1.4. </ins> This RPC allows a Verifier to acquire the evidence which was extended  <ins> into specific TPM PCRs.  A YANG tree diagram of this RPC is as follows: </ins>  <ins> 2.1.1.5. </ins> This section provides a high level description of the data nodes containing the configuration and operational objects with the YANG model.  For more details, please see the YANG model itself in ref- ietf-tpm-remote-attestation.  <ins> This houses the set of information relating to a device's TPM(s). </ins>  <ins> Provides configuration and operational details for each supported TPM, including the tpm-firmware-version, PCRs which may be quoted, certificates which are associated with that TPM, and the current operational status.  Of note are the certificates which are associated with that TPM.  As a certificate is associated with a particular TPM attestation key, knowledge of the certificate allows a specific TPM to be identified. </ins>  <ins> container 'attester-supported-algos' - Identifies which TCG hash algorithms are available for use on the Attesting platform.  This allows an operator to limit algorithms available for use by RPCs to just a desired set from the universe of all allowed hash algorithms by the TCG. </ins> container 'compute-nodes' - When there is more than one TPM supported, this container maintains the set of information related to  <ins> the compute node associated with a specific TPM.  This allows each specific TPM to identify to which 'compute-node' it belongs. </ins>  <ins> 2.1.1.6. </ins> 2.1.2. Cryptographic algorithm types were initially included within -v14  <ins> NETCONF's iana-crypto-types.yang.  Unfortunately, all this content </ins> including the algorithms needed here failed to make the -v15 used  <ins> WGLC.  As a result, this document has encoded the TCG Algorithm </ins> definitions of TCG-Algos, revision 1.32.  By including this full table as a separate YANG file within this document, it is possible for other YANG models to leverage the contents of this model. 2.1.2.1.  <ins> There are two types of features supported: 'TPM12' and 'TPM20'. </ins> Support for either of these features indicates that a cryptoprocessor  <ins> supporting the corresponding type of TCG TPM API is present on an </ins> Attester.  Most commonly, only one type of cryptoprocessor will be available on an Attester. 2.1.2.2.  <ins> There are three types of identities in this model: </ins>  <ins> *Cryptographic functions* supported by a TPM algorithm; these include: 'asymmetric', 'symmetric', 'hash', 'signing', 'anonymous_signing', 'encryption_mode', 'method', and 'object_type'.  The definitions of each of these are in Table 2 of TCG-Algos. </ins>  <ins> *API specifications* for TPMs: 'tpm12' and 'tpm20' </ins>  <ins> *Specific algorithm types*: Each algorithm type defines what cryptographic functions may be supported, and on which type of API specification.  It is not required that an implementation of a specific TPM will support all algorithm types.  The contents of each specific algorithm mirrors what is in Table 3 of TCG-Algos. </ins> 2.1.2.3. Note that not all cryptographic functions are required for use by  <ins> "ietf-tpm-remote-attestation.yang".  However the full definition of </ins> Table 3 of TCG-Algos will allow use by additional YANG specifications. This document will include requests to IANA:  <ins> To be defined yet.  But keeping up with changes to "ietf-tcg- algs.yang" will be necessary. </ins> 4. RFC8446. There are a number of data nodes defined in this YANG module that are  <ins> writable/creatable/deletable (i.e., _config true_, which is the </ins> default).  These data nodes may be considered sensitive or vulnerable  <ins> in some network environments.  Write operations (e.g., _edit-config_) </ins> to these data nodes without proper protection can have a negative effect on network operations.  These are the subtrees and data nodes  <ins> as well as their sensitivity/vulnerability: </ins> 'tpm12-asymmetric-signing', 'tpm12-hash', 'tpm20-asymmetric-  <ins> signing', and 'tpm20-hash'.  All could be populated with algorithms that are not supported by the underlying physical TPM installed by the equipment vendor. </ins>  <ins> 'name': Although shown as 'rw', it is system generated.  Therefore it should not be possible for an operator to add or remove a TPM from the configuration. </ins>  <ins> 'tpm20-pcr-bank': It is possible to configure PCRs for extraction </ins> which are not being extended by system software.  This could unnecessarily use TPM resources.  <ins> 'certificates': It is possible to provision a certificate which does not correspond to an Attestation Identity Key (AIK) within the TPM 1.2, or an Attestation Key (AK) within the TPM 2.0 respectively. </ins>  <ins> It must be verified that the certificate is for an active AIK, i. e. the certificate provided is able to support Attestation on the targeted TPM 1.2. </ins>  <ins> It must be verified that the certificate is for an active AK, i. e. the certificate provided is able to support Attestation on the targeted TPM 2.0. </ins>  <ins> Pulling lots of logs can chew up system resources. </ins> 5.


netconf-keystore, and "ietf-tcg-algs.yang" ref-ietf-tcg-algs. Additionally references are made to RFC8032, RFC8017, RFC6933, TPM1.2-Commands, TPM2.0-Arch, TPM2.0-Structures, TPM2.0-Key, <del> TPM1.2-Structures, PC-Client-EFI-TPM-1.2, ima-log, and netequip-boot- log. </del>  2.1.1.1.

NAME - if spaces are allowed in kramdown references, then this should work. AFAIK, this is ready to post to IETF.

netconf-keystore, and "ietf-tcg-algs.yang" ref-ietf-tcg-algs. Additionally references are made to RFC8032, RFC8017, RFC6933, TPM1.2-Commands, TPM2.0-Arch, TPM2.0-Structures, TPM2.0-Key,  <ins> TPM1.2-Structures, PC-Client-EFI-TPM-1.2, ima-log, BIOS Log Event Type and netequip-boot-log. </ins> 2.1.1.1.