Re: [Dime] Obsolete TLS wording in Diameter protocol

Hi Julien,

The first point on cipher suites has been already raised. The prohibition of the use of the RC4-based cipher suites (RFC7465) came after the publication of the RFC6733. But the RFC7465 is anyway an update of the RFC5246 that is a normative reference in the RFC6733. So anyone implementing TLS should be aware of this update. There is no need of an errata report but it will be covered in a future update of the RFC6733 if any.

For the RFC6125, it should be first worthwhile to mention that the RFC6733 indicates that, for the time being, there is no Diameter server Certification Authorities. However, the RFC5280 is given as normative reference and this one is not superseded by RFC6125 so far. And RFC6125 could be also seen as orthogonal to the implementation of the Diameter base protocol. It could be part of an update if there would be a real need to clarify something left outside of RFC5280.

At least, it is my current understanding.
I hope that it clarifies your concerns.

Regards,

Lionel    

> -----Message d'origine-----
> De : DiME [mailto:dime-bounces@ietf.org] De la part de Julien ÉLIE
> Envoyé : lundi 9 janvier 2017 14:47
> À : dime@ietf.org
> Objet : [Dime] Obsolete TLS wording in Diameter protocol
> 
> Hi all,
> 
> The Diameter specification (RFC 6733) mentions in Section 13.1 that the
> TLS_RSA_WITH_RC4_128_MD5 and TLS_RSA_WITH_RC4_128_SHA cipher suites
> are required ("Diameter nodes MUST be able to negotiate [them]"), and Section
> 5.2 does not give latest recommendations for certificate validation.
> 
> Shouldn't it be updated in favour of following RFC 7525 (BCP for TLS) and RFC
> 6125 (guideline for certificate validation)?
> 
> --
> Julien ÉLIE
> 
> « The following two statements are usually both true:
>    There's not enough documentation.
>    There's too much documentation. » (Larry Wall)
> 
> _______________________________________________
> DiME mailing list
> DiME@ietf.org
> https://www.ietf.org/mailman/listinfo/dime

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.