Re: [Ntp] BCP 195

[Marcus Dansarie <[e-mail]>]

Good observation on BCP 195! I'm in favor of this.

The second paragraph is particularly diplomatic in view of the slightly
differing views on whether we should require TLS 1.2 or 1.3. My only
objection is that "when possible" is redundant in view of the RFC 2119
definition of SHOULD.

Kind regards,
Marcus Dansarie

On 2018-08-28 20:06, Daniel Franke wrote:
> How's this?
> 
>     <section title="TLS profile for Network Time Security" anchor="tls-profile">
>       <t>
>         Network Time Security makes use of TLS for NTS key establishment.
>       </t>
>       <t>
>         Since securing time protocols is (as of 2018) a novel
>         application of TLS, no backward-compatibility concerns exist
>         to justify using obsolete, insecure, or otherwise broken TLS
>         features or versions. Implementations MUST conform with <xref
>         target="RFC7525"/> or with a later revision of BCP
>         195. Furthermore:
>       </t>
>       <t>
>         Implementations MUST NOT negotiate TLS versions earlier than
>         1.2, SHOULD negotiate TLS 1.3 <xref target="RFC8446"/> or
>         later when possible, and MAY refuse to negotiate any TLS
>         version which has been superseded by a later supported
>         version.
>       </t>
>       <t>
>         Use of the <xref target="RFC7301">Application-Layer Protocol
>         Negotiation Extension</xref> is integral to NTS and support for
>         it is REQUIRED for interoperability.
>       </t>
>     </section>
> On Tue, Aug 28, 2018 at 1:46 PM Daniel Franke <[e-mail]> wrote:
>>
>> I just learned (by reading draft-moriarty-tls-oldversions-diediedie)
>> that BCP 195 exists, which gives best current practices for secure use
>> of TLS. I'm going to rewrite the "TLS Profile for Network Time
>> Security" as primarily a mandate to comply with that BCP. It'll go on
>> to turn a couple of its SHOULDs into MUSTs where the BCP makes more
>> allowances for legacy compatibility than we need to.
> 
> _______________________________________________
> ntp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/ntp
>