[Netconf] RE: WGLC for draft-ietf-netconf-t ls-04.txt

[[e-mail]]

Dear David,

> In syslog WG, we worked with the AD to decide what text was needed
> regarding ciphersuite support. We removed ciphersuite text that was
> redundant with TLS specs, and simplified ciphersuite support to this:
>
>    TLS typically uses certificates [RFC5280] to authenticate peers.
>    Implementations MUST support TLS 1.2 [RFC5246] and are REQUIRED to
>    support the mandatory to implement cipher suite, which is
>    TLS_RSA_WITH_AES_128_CBC_SHA.  This document is assumed to apply to
>    future versions of TLS, in which case the mandatory to implement
>    cipher suite for the implemented version MUST be supported.


Thank you for this better text. I will certainly integrate it entirely.
However, there is still a need to add a simple sentence on the PSK
authentication (the document optionally enable PSK authentication):

     For authentication based on PSKs, a compliant implementation MUST
     implement the cipher suite TLS_DHE_PSK_WITH_AES_128_CBC_SHA.

Best regards,
Badra
_______________________________________________
Netconf mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/netconf