Re: [rtcweb] DTLS version

There seems a preference on supporting DTLS 1.0 due to the widespread adoption.  There is also a desire of supporting ECDHE when ECC is on a Standards Track.  Hope we could reach a consensus in Toronto.  

To keep the discussions going, here is a proposal with a specific cipher suite based on DTLS 1.0.  

    All implementations MUST implement the cipher suite TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 
    based on DTLS 1.0 with P256 as the curve to be used with ECDHE and ECDSA.  The Implementations 
    MAY advertise additional cipher suites based on DTLS 1.0 and/or DTLS 1.2 definitions, for example, 
    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA with P256.

We could keep DTLS 1.2 as an optional implementation decision for now and make that (and some corresponding new cipher suites) as required in the future.

Thoughts?

Best, Shijun 

-----Original Message-----
From: rtcweb [mailto:rtcweb-bounces@ietf.org] On Behalf Of Michael Tuexen
Sent: Friday, July 4, 2014 2:28 PM
To: Eric Rescorla
Cc: rtcweb@ietf.org
Subject: Re: [rtcweb] DTLS version

On 04 Jul 2014, at 23:19, Eric Rescorla <ekr@rtfm.com> wrote:

> 
> 
> 
> On Fri, Jul 4, 2014 at 2:11 PM, Michael Tuexen <Michael.Tuexen@lurchi.franken.de> wrote:
> On 04 Jul 2014, at 21:48, Eric Rescorla <ekr@rtfm.com> wrote:
> 
> > I made this change in the current draft at:
> >
> > https://github.com/rtcweb-wg/security-arch/commit/c2af2bf7fd032abd36
> > 7dff8d4d16f7ec435fa663
> If implementations MUST implement both DTLS 1.0 and 1.2, when will 
> they use 1.0? Wouldn't they always use DTLS 1.2?
> 
> There are non-RTCWEB implementations of these protocols.
OK. Any suggested test for the SCTP over DTLS spec? It currently says MUST be based on DTLS 1.0 (as you suggested).

Best regards
Michael
> 
> -Ekr
>  
> Best regards
> Michael
> >
> > Note that the TLS WG is currently discussing whether to bring ECC onto Standards Track.
> > If they do, we probably want ot require support of ECDHE. We should discuss in YYZ.
> >
> >
> >
> > On Fri, Jul 4, 2014 at 3:23 AM, DRAGE, Keith (Keith) <keith.drage@alcatel-lucent.com> wrote:
> > This is the direction I am tending in as well.
> >
> > Although what or if the second statement needs from RFC 2119 language would need to be debated.
> >
> > Obviously, new versions are not being put out there just to make it look like the WG is performing. In any referencing (not just this issue), I would need a good technical reason why the latest version cannot be made the normative reference. I am not seeing that at the moment.
> >
> > There is always be non-conforming equipment on the market (as an example look at the number of SIP implementations that still use UDP for large messages, or that can at least be configured that way). Just because we mandate 1.2 does not mean that everyone will conform from day 1, but at least a marker is established for what should be addressed if interoperability issues are identified.
> >
> > Keith
> >
> > > -----Original Message-----
> > > From: rtcweb [mailto:rtcweb-bounces@ietf.org] On Behalf Of Harald 
> > > Alvestrand
> > > Sent: 04 July 2014 09:07
> > > To: rtcweb@ietf.org
> > > Subject: Re: [rtcweb] DTLS version
> > >
> > > On 07/03/2014 07:58 PM, Martin Thomson wrote:
> > > > On 3 July 2014 01:39, DRAGE, Keith (Keith) 
> > > > <keith.drage@alcatel-lucent.com> wrote:
> > > >> Can someone elaborate what this massive apparent step
> > > change is from 1.0 to 1.2?
> > > > Actually, it's not a massive step.  TLS 1.2 (DTLS 1.2
> > > depends on this,
> > > > DTLS 1.0 depends on TLS 1.1) adds AEAD modes, but doesn't 
> > > > require their use, so you can pretty much just bump the version 
> > > > number and advertise 1.2.  That's exactly what we did with NSS, 
> > > > though NSS already supports TLS 1.2.
> > > >
> > > > That said, I agree with Jim about 1.0.  There's enough 1.0
> > > out there
> > > > now to make mandating 1.2 - as much as I might prefer that
> > > - a little
> > > > too aggressive.
> > > >
> > > >> Will those implementations that choose to stay with 1.0
> > > still interwork with 1.2?
> > > > That depends.  We could say "MUST NOT negotiate 1.0", which 
> > > > would prevent that.  I don't think that we're there.
> > >
> > > Sounds to me like MUST implement 1.2 (in order to move forward), 
> > > MUST accept 1.0 (in order to not lose the long tail).
> > >
> > > >
> > > > _______________________________________________
> > > > rtcweb mailing list
> > > > rtcweb@ietf.org
> > > > https://www.ietf.org/mailman/listinfo/rtcweb
> > >
> > > _______________________________________________
> > > rtcweb mailing list
> > > rtcweb@ietf.org
> > > https://www.ietf.org/mailman/listinfo/rtcweb
> > >
> > _______________________________________________
> > rtcweb mailing list
> > rtcweb@ietf.org
> > https://www.ietf.org/mailman/listinfo/rtcweb
> >
> > _______________________________________________
> > rtcweb mailing list
> > rtcweb@ietf.org
> > https://www.ietf.org/mailman/listinfo/rtcweb
> 
> 

_______________________________________________
rtcweb mailing list
rtcweb@ietf.org
https://www.ietf.org/mailman/listinfo/rtcweb