Re: [netconf] WGLC on draft-ietf-netconf-over-tls13

[Sean Turner <[e-mail]>]

Jürgen,

Thanks for your review. Responses below.

I’ll let these and the other PRs settle for a week before merging.

spt

> On Jan 25, 2023, at 09:32, Jürgen Schönwälder <[e-mail]> wrote:
> 
> On Mon, Jan 09, 2023 at 09:54:28PM +0000, Kent Watsen wrote:
>> We are starting a 2 week WGLC on:
>> 	- draft-ietf-netconf-over-tls13-01. 
>> 
>> The document can be found here:
>> 	https://datatracker.ietf.org/doc/draft-ietf-netconf-over-tls13
>> 
>> Please respond on this thread indicating your support or concerns about why this document should/should not be adopted.
>> 
>> We are particularly interested in statement of the form:
>> 	- I have reviewed the draft and found no issues. 
>> 	- I have reviewed the draft and found the following issues …
>> 
>> This WGLC will conclude on Monday, January 23.   
> 
> I have reviewed the document and I believe that what it is technically
> aims to achieve is OK and on track but the document itself is not ready.
> 
> - Does this document formally update RFC 7589? I am aware that updates
>  means many different things (extending, depending-on, rewriting
>  parts) so I should probably not even ask this question. ;-) But my
>  gut feeling is that you really want a formal Updates: RFC 7589 here.

We were purposely trying to avoid updating RFC 7589, because we were trying to stay out of picking the MTI protocol. But based on a suggestion in UTA about how to deal with a similar update for syslog, I think we could follow the recommendations in RFC 9325 and not have to get embroiled in a lengthy debate because RFC 9235 is BCP 195:

*  Implementations MUST support TLS 1.2 [RFC5246].
*  Implementations SHOULD support TLS 1.3 [RFC8446] and, if
  implemented, MUST prefer to negotiate TLS 1.3 over earlier
  versions of TLS.

The following PR includes the proposed changes:
https://github.com/netconf-wg/netconf-over-tls13/pull/11

The change of course opens a can worms. Do we change the TLS1.2 MTI cipher suite? The MTI cipher suites based on this RFC 7589 (and this PR) is TLS_RSA_WITH_AES_128_CBC_SHA. There is no chance that cipher suites makes it through the IESG at this point. We could change it to what’s in RFC 9325. I understand why RFC 7589 did not make the 7525 recommendations a MUST; when RFC 7589 was published, RFC 7525 was pretty new. However, it’s been almost 8 years since then so I am hoping some of the recommendations, 2 of the four recommended in 2015 are still there, are widely supported. If that’s the case then maybe the 1st para should be:

Implementations MUST support TLS 1.2 {{RFC5246}}. The mandatory-to-implement
cipher suite is TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. Implementations
SHOULD follow the recommendations given in [RFC9325].

> - As already noted by others, there is colloquial discussion around
>  Section 9.1 of I-D.ietf-tls-rfc8446bis in the document that one
>  would not expect in a WG last call document.

Yep deleting it. The section kind of did it’s job, i.e., “made you look” :)
The following PR removes it:
https://github.com/netconf-wg/netconf-over-tls13/pull/7

> - In the Security Considerations, what does 'please review" really
>  mean? Is it required or expected to do what the referenced documents
>  say or are these just some reading suggestions that can be ignored?
>  I would prefer to see much clearer guidelines, in particular since
>  we talk about security.

I guess this didn’t bother me as much as some, when I read “the security considerations of RFCxyz apply” that’s pretty much the same thing as "Please review  RFCxyz”. But, I can swap it out for the more common language. Note that because it’s an update, the security considerations actually got a lot shorter because we copied a lot them over. Here’s a PR to address this:
https://github.com/netconf-wg/netconf-over-tls13/pull/10

> - Editorial: Fix the following "describes defines" double verb.

Please see:
https://github.com/netconf-wg/netconf-over-tls13/pull/9

> /js
> 
> -- 
> Jürgen Schönwälder              Constructor University Bremen gGmbH
> Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
> Fax:   [phone]         <https://www.jacobs-university.de/>
> 
> _______________________________________________
> netconf mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/netconf