WG Action: Formed Using TLS in Applications (uta)

The IESG <iesg-secretary@ietf.org> Wed, 11 December 2013 18:33 UTC

Return-Path: <iesg-secretary@ietf.org>
X-Original-To: ietf-announce@ietfa.amsl.com
Delivered-To: ietf-announce@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com []) by ietfa.amsl.com (Postfix) with ESMTP id 722B01AE0B8; Wed, 11 Dec 2013 10:33:17 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id RBTFGzUogs3p; Wed, 11 Dec 2013 10:33:15 -0800 (PST)
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 710531AE0C5; Wed, 11 Dec 2013 10:33:14 -0800 (PST)
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: The IESG <iesg-secretary@ietf.org>
To: IETF-Announce <ietf-announce@ietf.org>
Subject: WG Action: Formed Using TLS in Applications (uta)
X-Test-IDTracker: no
X-IETF-IDTracker: 4.83.p1
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <20131211183314.30249.81745.idtracker@ietfa.amsl.com>
Date: Wed, 11 Dec 2013 10:33:14 -0800
Cc: uta WG <uta@ietf.org>
X-BeenThere: ietf-announce@ietf.org
X-Mailman-Version: 2.1.15
Reply-To: ietf@ietf.org
List-Id: "IETF announcement list. No discussions." <ietf-announce.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf-announce>, <mailto:ietf-announce-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf-announce/>
List-Post: <mailto:ietf-announce@ietf.org>
List-Help: <mailto:ietf-announce-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf-announce>, <mailto:ietf-announce-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 11 Dec 2013 18:33:17 -0000

A new IETF working group has been formed in the Applications Area. For
additional information please contact the Area Directors or the WG

Using TLS in Applications (uta)
Current Status: Proposed WG

  Leif Johansson <leifj@sunet.se>
  Orit Levin <oritl@microsoft.com>

Assigned Area Director:
  Pete Resnick <presnick@qti.qualcomm.com>

Mailing list
  Address: uta@ietf.org
  To Subscribe: https://www.ietf.org/mailman/listinfo/uta
  Archive: http://www.ietf.org/mail-archive/web/uta/


There is a renewed and urgent interest in the IETF to increase the
security of transmissions over the Internet. Many application protocols
have defined methods for using TLS to authenticate the server (and
sometimes the client), and to encrypt the connection between the client
and server. However, there is a diversity of definitions and
requirements, and that diversity has caused confusion for application
developers and also has led to lack of interoperability or lack of
deployment. Implementers and deployers are faced with multiple security
issues in real-world usage of TLS, which currently does not preclude
insecure ciphers and modes of operation.

This WG has the following tasks:

- Update the definitions for using TLS over a set of representative
application protocols.  This includes communication with proxies, between
servers, and between peers, where appropriate, in addition to
client/server communication.

- Specify a set of best practices for TLS clients and servers, including
but not limited to recommended versions of TLS, using forward secrecy,
and one or more ciphersuites and extensions that are mandatory to

- Consider, and possibly define, a standard way for an application client
and server to use unauthenticated encryption through TLS when server
and/or client authentication cannot be achieved.

- Create a document that helps application protocol developers use TLS in
future application definitions.

The initial set of representative application protocols is SMTP, POP,
IMAP, XMPP, and HTTP 1.1. It is expected that other protocols that use
TLS might later be updated using the guidelines from this WG, and that
those updates will happen through other WGs or through individual

The WG will make the fewest changes needed to achieve good interoperable
security for the applications using TLS.  No changes to TLS itself will
be made in this WG, and the WG will ensure that changes to current
versions of popular TLS libaries will not be required to conform to the
WG's specifications.

This WG will collaborate with other IETF WGs, in particular with the TLS
and DANE WGs.