Re: [Netconf] Â Â WGLCÂ forÂ draft-ietf-netconf-t ls-04.txt

----- Original Message -----
From: <badra@isima.fr>
To: "DavidÂ BÂ HarringtonÂ" <dbharrington@comcast.net>
Cc: "Â" <netconf@ietf.org>
Sent: Monday, September 29, 2008 11:07 PM
Subject: [Netconf] RE:Â Â WGLCÂ forÂ draft-ietf-netconf-t ls-04.txt

> Here is a tentative to decide what text was needed regarding ciphersuite
> support.
>
> 4. Cipher Suite Requirements
>
>      Implementation of the protocol specified in this document MAY
>      implement any TLS cipher suite that provides mutual authentication.
>
>      Implementations MUST support TLS 1.2 [RFC5246] and are REQUIRED to
>      support the mandatory to implement cipher suite, which is
>      TLS_RSA_WITH_AES_128_CBC_SHA.  This document is assumed to apply to
>      future versions of TLS, in which case the mandatory to implement
>      cipher suite for the implemented version MUST be supported.
>
>      In the case of the pre-shared key authentication (described in
>      Section 3.3), implementations are REQUIRED to support the cipher
>      suite TLS_DHE_PSK_WITH_AES_128_CBC_SHA RFC4279].
>
> Comments?
> Best regards,
> Badra
>

I think that you need more than this, somewhere in the document, giving the
applicability of the two very different suites, when is one appropriate, when
the other.  As it stands, I get the feeling that I am being told that you really
should be using PSK but that someone, perhaps that nasty old security
directorate, has insisted we conform to BCP0061 and so have had to include the
other as well:-)

But as to what that text might look like, I am less clear.

Tom Petch

<snip>

_______________________________________________
Netconf mailing list
Netconf@ietf.org
https://www.ietf.org/mailman/listinfo/netconf