[Ntp] Antw: Re: BCP 195

>>> Daniel Franke <dfoxfranke@gmail.com> schrieb am 28.08.2018 um 20:06 in
Nachricht
<CAJm83bAS2_m=wLsCw1kss9+Dck7fXtZZE15wAhy_88D2w-HxGA@mail.gmail.com>:
> How's this?
> 
>     <section title="TLS profile for Network Time Security" 
> anchor="tls‑profile">
>       <t>
>         Network Time Security makes use of TLS for NTS key establishment.
>       </t>
>       <t>
>         Since securing time protocols is (as of 2018) a novel
>         application of TLS, no backward‑compatibility concerns exist
>         to justify using obsolete, insecure, or otherwise broken TLS
>         features or versions. Implementations MUST conform with <xref
>         target="RFC7525"/> or with a later revision of BCP
>         195. Furthermore:
>       </t>
>       <t>
>         Implementations MUST NOT negotiate TLS versions earlier than
>         1.2, SHOULD negotiate TLS 1.3 <xref target="RFC8446"/> or
>         later when possible, and MAY refuse to negotiate any TLS
>         version which has been superseded by a later supported
>         version.

Isn't that too much words? "MUST negotiate TLS 1.3 or later" should say all of
the above. Specifically the "MAY refuse" is redundant, because the protocol is
"negotiated" already.
Making specificatiions about future protocols is not really helpful IMHO.

Regards,
Ulrich

>       </t>
>       <t>
>         Use of the <xref target="RFC7301">Application‑Layer Protocol
>         Negotiation Extension</xref> is integral to NTS and support for
>         it is REQUIRED for interoperability.
>       </t>
>     </section>
> On Tue, Aug 28, 2018 at 1:46 PM Daniel Franke <dfoxfranke@gmail.com> wrote:
>>
>> I just learned (by reading draft‑moriarty‑tls‑oldversions‑diediedie)
>> that BCP 195 exists, which gives best current practices for secure use
>> of TLS. I'm going to rewrite the "TLS Profile for Network Time
>> Security" as primarily a mandate to comply with that BCP. It'll go on
>> to turn a couple of its SHOULDs into MUSTs where the BCP makes more
>> allowances for legacy compatibility than we need to.
> 
> _______________________________________________
> ntp mailing list
> ntp@ietf.org 
> https://www.ietf.org/mailman/listinfo/ntp 