Re: Fwd: NEA requirements (was Re: Fwd: [Nea] Re: use of a design team to develop requirements)

[Keith Moore <moore at cs.utk.edu>]

-------- Original Message --------

> Keith Moore wrote:
> > not clear.  at least the format of the profiles needs to be
> > standardized, IMHO, otherwise there's no capability for interoperation
> > and no point to having an NEA standard.
>
>   Yes.
>
> > ...  that
> > implies to me that the profile downloading should be able to happen via
> > NEA, rather than introduce a situation where NEA can't tell whether a
> > client is trustworthy or not because the client doesn't have a current
> > profile.
>
>   My main concern with this is that NEA is *before* the machine obtains
> full network access.  So... how does it download potentially megabytes
> of updates?  IP tunneling inside of NEA?  Yuck...

I assume the network supports IP to the extent that it needs to 
implement NEA.  It doesn't have to route IP packets anywhere other than 
between the host and the NEA server(s), but it does have to do that much.

> > what do you mean by "real networks"?  do you assume that NEA will
> > operate over something besides TCP/IP? TCP seems perfectly capable of
> > carrying enough data to transmit an NEA profile.
>
>   No, I mean TCP/IP shouldn't operate over NEA.  That way lies madness.

perhaps, but nobody has suggested doing that.

>   Remediation must use TCP/IP to download updates, but it can't use a
>  public/open network (otherwise you wouldn't be using NEA).  

I'm not talking about remediation, I'm only talking about downloading 
the information that the NEA client needs to make the checks.  This 
should be a list of generic tests, NOT arbitrary code.

Keith


_______________________________________________
Nea mailing list
Nea at ietf.org
https://www1.ietf.org/mailman/listinfo/nea