Re: [netconf] netconf-tls wasRe: Summary of updates

[tom petch <[e-mail]>]

From: netconf <[e-mail]> on behalf of tom petch <[e-mail]>
Sent: 26 May 2021 16:45

From: Juergen Schoenwaelder <[e-mail]>
Sent: 26 May 2021 12:53

This sounds like 'lets wait and see what comes out of the RFC 6125
revision' is the best approach for now.

<tp>
Oh dear; I got the wrong WG.  The 6125 update I-D exists and is in the UTA WG (which I am not subscribed to but saw a cross post thereof). It is quite short and is very much an updates, requiring the use of SAN, prohibiting CN-ID.   It was published on April 1st, 2021:-)

Tom Petch

<tp>
WFM

I do have an element of FUD about this (as I have about TLS1.3) which hopefully will diminish with time.

Tom Petch

/js

On Wed, May 26, 2021 at 09:23:17AM +0000, tom petch wrote:
> From: Juergen Schoenwaelder <[e-mail]>
> Sent: 25 May 2021 17:29
>
> On Tue, May 25, 2021 at 03:58:10PM +0000, tom petch wrote:
> >
> > I guess someone (Tom?) should review RFC 5539 from the TLS 1.3
> > perspective to tell the WG if any changes are needed so that the WG
> > can take an informed decision whether an update of RFC 5539 is
> > necessary or whether what we have is good enough.
> >
> > <tp>
> > Well, I tend to forget that RFC5539 is obsolete, obsoleted by RFC7589 which is X.509 certificate only; no PSK, no naked public keys.  My concerns with TLS1.3 mostly relate to PSK which allows data to flow before the handshake is complete, before authentication is complete, which is a problem for some applications as I mentioned before; but staying with X.509 authentication only for Netconf makes life simpler for a 7589bis, replace 1.2 by 1.3 and think about the extensions to see what may be needed.
> >
>
> So regarding a possible update of RFC 7589, what is needed?
>
> + Require TLS 1.3 (update section 8)
>
> Which extensions should one think about? Do you mean RFC 8773 or
> something else?
>
> <tp>
> It is more a question of going through 8446 s.4.2 s.9.2 to see what we want by way of an Application Profile.  Thus I would like to prohibit PSK but that prohibits session resumption which is fine by me but I have limited exposure to what the world is doing so may be it is not that simple.
>
> There is another problem which I see as larger and that is that the TAPS WG is revising RFC6125 and this leans heavily on that RFC and that might take a year or two to get revised.  I don't have a sense of where a 6125bis is going.
>
> Tom Petch
>
> /js
>
> --
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
> Fax:   [phone]         <https://www.jacobs-university.de/>

--
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
Fax:   [phone]         <https://www.jacobs-university.de/>

_______________________________________________
netconf mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/netconf