Re: [Dime] RFC3588bis cipher suite question

Any comments/views on this?

- Jouni

On Jun 21, 2012, at 2:17 PM, jouni korhonen wrote:

> Folks,
> 
> In Section 13.1 we have the following text:
> 
>   Diameter nodes MUST be able to negotiate the following TLS/TCP and
>   DTLS/SCTP cipher suites:
> 
>         TLS_RSA_WITH_RC4_128_MD5
>         TLS_RSA_WITH_RC4_128_SHA
>         TLS_RSA_WITH_3DES_EDE_CBC_SHA
> 
>   Diameter nodes SHOULD be able to negotiate the following TLS/TCP and
>   DTLS/SCTP cipher suite:
> 
>         TLS_RSA_WITH_AES_128_CBC_SHA
> 
>   Note that that it is quite possible that support for the
>   TLS_RSA_WITH_AES_128_CBC_SHA ciphersuite will be REQUIRED at some
>   future date.  Diameter nodes MAY negotiate other TLS/TCP and DTLS/
>   SCTP cipher suites.
> 
> I know this is a bit late in the pipe but.. but RFC6347 (DTLS v1.2) has
> the following statement:
> 
>   The only stream cipher described in TLS 1.2 is RC4, which cannot be
>   randomly accessed.  RC4 MUST NOT be used with DTLS.
> 
> That does not go too well with the RFC3588bis MUST for RC4 stream ciphers.
> 
> Also RFC5246 states:
> 
>   In the absence of an application profile standard specifying
>   otherwise, a TLS-compliant application MUST implement the cipher
>   suite TLS_RSA_WITH_AES_128_CBC_SHA..
> 
> Can we understand that the current text in RFC3588bis serves as the
> profile and the SHOULD there is then OK from the RFC5246 point of
> view?
> 
> - Jouni
> _______________________________________________
> DiME mailing list
> DiME@ietf.org
> https://www.ietf.org/mailman/listinfo/dime