[OAUTH-WG] TLS 1.2

Rob Richards <rrichards@cdatazone.org> Fri, 12 August 2011 19:55 UTC

Message-ID: <4E458571.1070500@cdatazone.org>
Date: Fri, 12 Aug 2011 15:56:33 -0400
From: Rob Richards <rrichards@cdatazone.org>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0) Gecko/20110624 Thunderbird/5.0
MIME-Version: 1.0
To: "OAuth WG (oauth@ietf.org)" <oauth@ietf.org>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Subject: [OAUTH-WG] TLS 1.2
Precedence: list

The latest draft shows TLS 1.2 as a MUST (sections 3.1 and 3.2). Based 
on a thread about this from last year I was under the impression that it 
was going to be relaxed to a SHOULD with most likely TLS 1.0 (or 
posssibly SSLv3) as a MUST. I think it's a bit unrealistic to require 
1.2 when many systems out there can't support it. IMO this is going to 
be a big stumbling block for people to implement a compliant OAuth 
system. Even PCI doesn't require 1.2.

Rob

[OAUTH-WG] TLS 1.2 Rob Richards
Re: [OAUTH-WG] TLS 1.2 Rob Richards
Re: [OAUTH-WG] TLS 1.2 Justin Richer
Re: [OAUTH-WG] TLS 1.2 Eran Hammer-Lahav
Re: [OAUTH-WG] TLS 1.2 Peter Saint-Andre
Re: [OAUTH-WG] TLS 1.2 Phillip Hunt
Re: [OAUTH-WG] TLS 1.2 Rob Richards
Re: [OAUTH-WG] TLS 1.2 Eran Hammer-Lahav
Re: [OAUTH-WG] TLS 1.2 Rob Richards
Re: [OAUTH-WG] TLS 1.2 Lu, Hui-Lan (Huilan)