Re: [MMUSIC] Aligning RFC 4572 and draft-dtls-sdp regarding preferred SHA cipher?

Christer Holmberg <christer.holmberg@ericsson.com> Thu, 25 February 2016 20:02 UTC

From: Christer Holmberg <christer.holmberg@ericsson.com>
To: Roman Shpount <roman@telurix.com>
Thread-Topic: Aligning RFC 4572 and draft-dtls-sdp regarding preferred SHA cipher?
Thread-Index: AQHRcAKbCMtOTN/OL0exiSX7tCPD3589Lb7A
Date: Thu, 25 Feb 2016 20:01:16 +0000
Message-ID: <7594FB04B1934943A5C02806D1A2204B37E44499@ESESSMB209.ericsson.se>
References: <7594FB04B1934943A5C02806D1A2204B37E411AC@ESESSMB209.ericsson.se> <CAD5OKxsi_i7xmK1rsEuSNBXi=wa76OY9M_r5+XaSnqV=T4=eWA@mail.gmail.com>
In-Reply-To: <CAD5OKxsi_i7xmK1rsEuSNBXi=wa76OY9M_r5+XaSnqV=T4=eWA@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B37E44499ESESSMB209erics_"
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/mmusic/ahZBFO4GY4GpK_FTFJn1pk8Nc0s>
Cc: "mmusic@ietf.org" <mmusic@ietf.org>, "pkyzivat@alum.mit.edu" <pkyzivat@alum.mit.edu>
Subject: Re: [MMUSIC] Aligning RFC 4572 and draft-dtls-sdp regarding preferred SHA cipher?
Precedence: list

Hi,

If we think the update to 4572 will be more than “a few sentences”, I agree we should probably have a separate draft. We are already updating two RFCs in draft-dtls-sdp, so…

Regards,

Christer

From: Roman Shpount [mailto:roman@telurix.com]
Sent: 25 February 2016 21:28
To: Christer Holmberg <christer.holmberg@ericsson.com>
Cc: mmusic@ietf.org; Martin Thomson (martin.thomson@gmail.com) <martin.thomson@gmail.com>; pkyzivat@alum.mit.edu
Subject: Re: Aligning RFC 4572 and draft-dtls-sdp regarding preferred SHA cipher?

On Thu, Feb 25, 2016 at 4:51 AM, Christer Holmberg <christer.holmberg@ericsson.com<mailto:christer.holmberg@ericsson.com>> wrote:
RFC 4572 (tls-sdp) contains the following text:

“Following RFC 3279 [7] as updated by RFC
              4055 [9], therefore, the defined hash functions are 'SHA-1' [11]
              [19], 'SHA-224' [11], 'SHA-256' [11], 'SHA-384' [11], 'SHA-512' [11],
              'MD5' [12], and 'MD2' [13], with 'SHA-1' preferred.”

Draft-dtls-sdp contains the following text:

“Endpoints MUST support SHA-256 for generating and verifying the fingerprint
               value associated with the DTLS association. The use of SHA-256 is preferred.”

I.e. for TLS SHA-1 is preferred, and for DTLS SHA-256 is preferred.

Martin suggested (I assume) that we should update RFC 4572, to make SHA-256 preferred also for TLS.

Assuming we do the update, I guess the updated 4572 text would say:

“Following RFC 3279 [7] as updated by RFC
              4055 [9], therefore, the defined hash functions are 'SHA-1' [11]
              [19], 'SHA-224' [11], 'SHA-256' [11], 'SHA-384' [11], 'SHA-512' [11],
              'MD5' [12], and 'MD2' [13], with 'SHA-256' preferred.”


Q1:        Do people agree to updating the preferred cipher in 4572?

Q3:        IF(Q1) Should the update be done within draft-dtls-sdp, or should we create a separate draft/milestone for it?


I think the has function preference should be updated in 4572. I would prefer a separate draft for RFC 4572 update. There are enough issues with RFC 4572, including handling of multiple fingerprints, that justify a complete rewrite of TLS SDP negotiation procedures. If it would be decided that RFC 4572 should be updated in draft-dtls-sdp (not my preference), I would prefer to extend the draft to cover SDP for DTLS and TLS, so that it obsoletes RFC 4572 instead of patching it.

Regards,
_____________
Roman Shpount

[MMUSIC] Aligning RFC 4572 and draft-dtls-sdp reg… Christer Holmberg
Re: [MMUSIC] Aligning RFC 4572 and draft-dtls-sdp… Roman Shpount
Re: [MMUSIC] Aligning RFC 4572 and draft-dtls-sdp… Christer Holmberg
Re: [MMUSIC] Aligning RFC 4572 and draft-dtls-sdp… Cullen Jennings