Re: [OAUTH-WG] TLS question from token revocation draft iesg evaluation

["Donald F Coffin" <[e-mail]>]

Stephen,

I feel it should be MANDATORY to implement TLS1.2, especially since NIST is
in the process of deprecating TLS1.0 as a supported version.

Best regards,
Don
Donald F. Coffin
Founder/CTO

REMI Networks
22751 El Prado Suite 6216
Rancho Santa Margarita, CA  92688-3836

Phone:      [phone]
Email:       [e-mail]

-----Original Message-----
From: Stephen Farrell [mailto:[e-mail]] 
Sent: Sunday, June 02, 2013 12:53 PM
To: [e-mail]
Subject: [OAUTH-WG] TLS question from token revocation draft iesg evaluation


Hiya,

This draft has a couple of minor changes needed as a result of IESG review
(see [1]) but one question came up that I wanted to bring back to the WG to
see what you think. Any good answer should be fine btw, this isn't a case of
the insisting on stuff.

The question is whether the WG think that the situation related to the
mandatory-to-implement TLS version has changed since that was last discussed
a couple of years ago. There have been changes in the implementation status
of TLS1.2 since then, mainly driven by the discovery of weaknesses with some
deployment choices for TLS1.0.

So - should we stick with the TLS1.0 as MTI and TLS1.2 as a SHOULD implement
or can we now safely bump up to
TLS1.2 as MTI?

And since its been a source of confusion here before, we're discussing
what's mandatory to *implement* not what's mandatory to *use*.

Thanks,
S.

PS: the other changes are mechanical so don't need to take up WG time but
feel free to comment to the list, chairs, authors, me, ... whatever.

[1] https://datatracker.ietf.org/doc/draft-ietf-oauth-revocation/ballot/