Re: [Dime] RFC3588bis cipher suite question

On Fri, 2012-07-20 at 16:11 +0300, jouni korhonen wrote:

> Any comments/views on this?

Yes.

> 
> - Jouni
> 
> 
> On Jun 21, 2012, at 2:17 PM, jouni korhonen wrote:
> 
> > Folks,
> > 
> > In Section 13.1 we have the following text:
> > 
> >   Diameter nodes MUST be able to negotiate the following TLS/TCP and
> >   DTLS/SCTP cipher suites:
> > 
> >         TLS_RSA_WITH_RC4_128_MD5
> >         TLS_RSA_WITH_RC4_128_SHA
> >         TLS_RSA_WITH_3DES_EDE_CBC_SHA
> > 
> >   Diameter nodes SHOULD be able to negotiate the following TLS/TCP and
> >   DTLS/SCTP cipher suite:
> > 
> >         TLS_RSA_WITH_AES_128_CBC_SHA
> > 
> >   Note that that it is quite possible that support for the
> >   TLS_RSA_WITH_AES_128_CBC_SHA ciphersuite will be REQUIRED at some
> >   future date.  Diameter nodes MAY negotiate other TLS/TCP and DTLS/
> >   SCTP cipher suites.
> > 
> > I know this is a bit late in the pipe but.. but RFC6347 (DTLS v1.2) has
> > the following statement:
> > 
> >   The only stream cipher described in TLS 1.2 is RC4, which cannot be
> >   randomly accessed.  RC4 MUST NOT be used with DTLS.
> > 
> > That does not go too well with the RFC3588bis MUST for RC4 stream ciphers.
> > 
> > Also RFC5246 states:
> > 
> >   In the absence of an application profile standard specifying
> >   otherwise, a TLS-compliant application MUST implement the cipher
> >   suite TLS_RSA_WITH_AES_128_CBC_SHA..
> > 
> > Can we understand that the current text in RFC3588bis serves as the
> > profile and the SHOULD there is then OK from the RFC5246 point of
> > view?

Yes.

> > 
> > - Jouni
> > _______________________________________________
> > DiME mailing list
> > DiME@ietf.org
> > https://www.ietf.org/mailman/listinfo/dime
> 
> _______________________________________________
> DiME mailing list
> DiME@ietf.org
> https://www.ietf.org/mailman/listinfo/dime