Re: [OAUTH-WG] TLS 1.2

After dealing with a few companies' security teams over the spec, I 
don't think it should be allowed too much room for interpretation and 
needs to be spelled out clearly. They would most likely interpret that 
as requiring the latest version of TLS at the time of implementation.

Maybe something more along the lines of:

The authorization server SHOULD support TLS 1.2 as defined in [RFC5246] 
but at a minimum MUST support TLS 1.0 as defined in [RFC2246], and MAY 
support additional transport-layer mechanisms meeting its security 
requirements.

On 8/16/11 4:04 PM, Peter Saint-Andre wrote:
> How's this?
>
>     The authorization server MUST support Transport Layer Security
>     (at the time of this writing, the latest version is specified in
>     [RFC5246]). It MAY support additional transport-layer mechanisms
>     meeting its security requirements.
>
> On 8/16/11 1:55 PM, Eran Hammer-Lahav wrote:
>> We should relax it. Just need someone to propose new language.
>>
>> EHL
>>
>>> -----Original Message-----
>>> From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf
>>> Of Justin Richer
>>> Sent: Tuesday, August 16, 2011 12:49 PM
>>> To: Rob Richards
>>> Cc: oauth@ietf.org
>>> Subject: Re: [OAUTH-WG] TLS 1.2
>>>
>>> As I recall, the logic of the group here was something like:
>>>
>>> "We want transport-layer encryption, so let's grab the latest version of that
>>> around, which looks to be TLS 1.2"
>>>
>>> With that logic in mind, this relaxation makes sense to me. Does anyone
>>> remember this requirement differently?
>>>
>>>   -- Justin
>>>      (who admittedly couldn't tell the difference between SSL and TLS)
>>>
>>> On Tue, 2011-08-16 at 15:36 -0400, Rob Richards wrote:
>>>> I wanted to follow up on this and see if there was any consideration
>>>> to relaxing this requirement. Can someone actually point me to a
>>>> compliant implementation using TLS 1.2 because after looking at a
>>>> number of them, I have yet to find one that does.
>>>>
>>>> Rob
>>>>
>>>> On 8/12/11 3:56 PM, Rob Richards wrote:
>>>>> The latest draft shows TLS 1.2 as a MUST (sections 3.1 and 3.2).
>>>>> Based on a thread about this from last year I was under the
>>>>> impression that it was going to be relaxed to a SHOULD with most
>>>>> likely TLS 1.0 (or posssibly SSLv3) as a MUST. I think it's a bit
>>>>> unrealistic to require
>>>>> 1.2 when many systems out there can't support it. IMO this is going
>>>>> to be a big stumbling block for people to implement a compliant
>>>>> OAuth system. Even PCI doesn't require 1.2.
>>>>>
>>>>> Rob
>>>>> _______________________________________________
>>>>> OAuth mailing list
>>>>> OAuth@ietf.org
>>>>> https://www.ietf.org/mailman/listinfo/oauth
>>>>>
>>>> _______________________________________________
>>>> OAuth mailing list
>>>> OAuth@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/oauth
>>>
>>> _______________________________________________
>>> OAuth mailing list
>>> OAuth@ietf.org
>>> https://www.ietf.org/mailman/listinfo/oauth
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
>