Re: [OAUTH-WG] TLS question from token revocation draft iesg evaluation

This question will come up on other drafts as well, like Dynamic 
Registration and Introspection that I've been working on, so we should 
really decide what the language is going to be in order to be 
consistent. Would this be also filed as an errata or something on 
RFC6749/6750? (Honestly not sure what/if the process is.)

I will say from the average app developer's perspective, though, that 
most people are just going to look to see if there's an "https" in the 
URL and call it done, so I'm personally not sure what a practical 
difference it will make how we specify things here. The people that care 
about TLS versions will already know to use 1.2 or whatever's the latest 
and greatest, and everyone else isn't going to check the version. 
However, I made this same argument back when this first came up in OAuth 
core and we still ended up having the TLS version language in there in 
the end.

  -- Justin

On 06/03/2013 03:26 PM, Donald F Coffin wrote:
> Stephen,
>
> I feel it should be MANDATORY to implement TLS1.2, especially since NIST is
> in the process of deprecating TLS1.0 as a supported version.
>
> Best regards,
> Don
> Donald F. Coffin
> Founder/CTO
>
> REMI Networks
> 22751 El Prado Suite 6216
> Rancho Santa Margarita, CA  92688-3836
>
> Phone:      (949) 636-8571
> Email:       donald.coffin@reminetworks.com
>
> -----Original Message-----
> From: Stephen Farrell [mailto:stephen.farrell@cs.tcd.ie]
> Sent: Sunday, June 02, 2013 12:53 PM
> To: oauth@ietf.org
> Subject: [OAUTH-WG] TLS question from token revocation draft iesg evaluation
>
>
> Hiya,
>
> This draft has a couple of minor changes needed as a result of IESG review
> (see [1]) but one question came up that I wanted to bring back to the WG to
> see what you think. Any good answer should be fine btw, this isn't a case of
> the insisting on stuff.
>
> The question is whether the WG think that the situation related to the
> mandatory-to-implement TLS version has changed since that was last discussed
> a couple of years ago. There have been changes in the implementation status
> of TLS1.2 since then, mainly driven by the discovery of weaknesses with some
> deployment choices for TLS1.0.
>
> So - should we stick with the TLS1.0 as MTI and TLS1.2 as a SHOULD implement
> or can we now safely bump up to
> TLS1.2 as MTI?
>
> And since its been a source of confusion here before, we're discussing
> what's mandatory to *implement* not what's mandatory to *use*.
>
> Thanks,
> S.
>
> PS: the other changes are mechanical so don't need to take up WG time but
> feel free to comment to the list, chairs, authors, me, ... whatever.
>
> [1] https://datatracker.ietf.org/doc/draft-ietf-oauth-revocation/ballot/
>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth