Re: [netconf] Paul Wouters' Discuss on draft-ietf-netconf-over-tls13-03: (with DISCUSS and COMMENT)

[Sean Turner <[e-mail]>]

Paul,

Apologies for taking so long to get back to this. More inline.

> On Nov 27, 2023, at 17:22, Paul Wouters via Datatracker <[e-mail]> wrote:
> 
> Paul Wouters has entered the following ballot position for
> draft-ietf-netconf-over-tls13-03: Discuss
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
> for more information about how to handle DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-netconf-over-tls13/
> 
> 
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> Why does Section 4 not simply point to the ciphersuites MTI of the respective TLS versions?
> 
> TLS 1.3 as per RFC8446bis Section 9.1:
> https://datatracker.ietf.org/doc/html/draft-ietf-tls-rfc8446bis-09#name-mandatory-to-implement-ciph
> 
> TLS 1.2 to RFC9325 Section 4.2:
> https://datatracker.ietf.org/doc/html/rfc9325#name-cipher-suites-for-tls-12
> 
> It almost does this but then decides on its own more limited set of
> ciphersuites. Is there a good reason for this why to deviate from the
> TLS 1.2 and 1.3 standards? Or why not to stick to the RECOMMENDED Y
> column in the IANA registry for TLS Ciphersuites ?

For TLS 1.2:

RFC 7589 includes the following text:

 Implementations MUST support TLS 1.2 and are REQUIRED to
 support the mandatory-to-implement cipher suite.

That cipher suite is TLS_RSA_WITH_AES_128_CBC_SHA. RFC 7589 also includes:

Implementations SHOULD follow the recommendations given in [RFC7525].

So what I did was go look at the four algorithms in RFC 9525:
* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

and I (potentially naively) thought RSA AES_128 CDC to RSA AES_128 GCM seemed like an easy enough swap so let’s specify TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. So, I picked one from the list as opposed to pointing at the entire list. The difference is that implementations are required to support only one and not 4 algorithms. But, what I think you are suggesting (and I can live with) is the following ? :

 Implementations MUST support TLS 1.2 [RFC5246] and are REQUIRED to
 support the cipher suites from Section 4.2. [RFC9325].

For TLS 1.3, I think we do exactly as you are proposing because it says:

"Implementations that support TLS 1.3 [I-D.ietf-tls-rfc8446bis] are REQUIRED to support the mandatory-to-implement cipher suites listed in Section 9.1 of [I-D.ietf-tls-rfc8446bis]."

> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
>        Implementations MUST support TLS 1.2 [RFC5246] and are REQUIRED
>        to support the TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 cipher suite
>        [RFC9325].
> 
> Should this say "MUST support mutually authenticatd TLS 1.2" ? Because
> the line below talks about "additional mutually authenticated".

Since this is updating RFC 7589, I did not repeat the following text from that documents introduction:

  Implementations MUST
  support mutual TLS certificate-based authentication [RFC5246].

There’s also this in the security considerations if people missed the text in RFC 7589:

  As specified in [RFC7589], NETCONF over TLS requires mutual
  authentication.

>        NETCONF implementations SHOULD follow the TLS recommendations
>        given in [RFC9325].
> 
> It's kind of weird to have a SHOULD here pointing to a document that has
> MUSTs in it. I would either use a MUST here, or no BCP14 language at all.

I copied this SHOULD from RFC 7589.

> NITS:
> 
> [I-D.ietf-uta-rfc6125bis]  is now RFC9525

Addressed via:
https://github.com/netconf-wg/netconf-over-tls13/pull/22/files

Cheers,
spt