Re: [rtcweb] DTLS version

I was thinking the baseline cipher suite would be
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (note RSA instead of ECDSA), as the best
choice that maintains 1.0 compatibility.

I think we could also have a SHOULD for
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 as the preferred TLS 1.2 ciphersuite.

On Mon, Jul 7, 2014 at 5:29 PM, Shijun Sun <shijuns@microsoft.com> wrote:

> There seems a preference on supporting DTLS 1.0 due to the widespread
> adoption.  There is also a desire of supporting ECDHE when ECC is on a
> Standards Track.  Hope we could reach a consensus in Toronto.
>
> To keep the discussions going, here is a proposal with a specific cipher
> suite based on DTLS 1.0.
>
>     All implementations MUST implement the cipher suite
> TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
>     based on DTLS 1.0 with P256 as the curve to be used with ECDHE and
> ECDSA.  The Implementations
>     MAY advertise additional cipher suites based on DTLS 1.0 and/or DTLS
> 1.2 definitions, for example,
>     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA with P256.
>
> We could keep DTLS 1.2 as an optional implementation decision for now and
> make that (and some corresponding new cipher suites) as required in the
> future.
>
> Thoughts?
>
> Best, Shijun
>
> -----Original Message-----
> From: rtcweb [mailto:rtcweb-bounces@ietf.org] On Behalf Of Michael Tuexen
> Sent: Friday, July 4, 2014 2:28 PM
> To: Eric Rescorla
> Cc: rtcweb@ietf.org
> Subject: Re: [rtcweb] DTLS version
>
> On 04 Jul 2014, at 23:19, Eric Rescorla <ekr@rtfm.com> wrote:
>
> >
> >
> >
> > On Fri, Jul 4, 2014 at 2:11 PM, Michael Tuexen <
> Michael.Tuexen@lurchi.franken.de> wrote:
> > On 04 Jul 2014, at 21:48, Eric Rescorla <ekr@rtfm.com> wrote:
> >
> > > I made this change in the current draft at:
> > >
> > > https://github.com/rtcweb-wg/security-arch/commit/c2af2bf7fd032abd36
> > > 7dff8d4d16f7ec435fa663
> > If implementations MUST implement both DTLS 1.0 and 1.2, when will
> > they use 1.0? Wouldn't they always use DTLS 1.2?
> >
> > There are non-RTCWEB implementations of these protocols.
> OK. Any suggested test for the SCTP over DTLS spec? It currently says MUST
> be based on DTLS 1.0 (as you suggested).
>
> Best regards
> Michael
> >
> > -Ekr
> >
> > Best regards
> > Michael
> > >
> > > Note that the TLS WG is currently discussing whether to bring ECC onto
> Standards Track.
> > > If they do, we probably want ot require support of ECDHE. We should
> discuss in YYZ.
> > >
> > >
> > >
> > > On Fri, Jul 4, 2014 at 3:23 AM, DRAGE, Keith (Keith) <
> keith.drage@alcatel-lucent.com> wrote:
> > > This is the direction I am tending in as well.
> > >
> > > Although what or if the second statement needs from RFC 2119 language
> would need to be debated.
> > >
> > > Obviously, new versions are not being put out there just to make it
> look like the WG is performing. In any referencing (not just this issue), I
> would need a good technical reason why the latest version cannot be made
> the normative reference. I am not seeing that at the moment.
> > >
> > > There is always be non-conforming equipment on the market (as an
> example look at the number of SIP implementations that still use UDP for
> large messages, or that can at least be configured that way). Just because
> we mandate 1.2 does not mean that everyone will conform from day 1, but at
> least a marker is established for what should be addressed if
> interoperability issues are identified.
> > >
> > > Keith
> > >
> > > > -----Original Message-----
> > > > From: rtcweb [mailto:rtcweb-bounces@ietf.org] On Behalf Of Harald
> > > > Alvestrand
> > > > Sent: 04 July 2014 09:07
> > > > To: rtcweb@ietf.org
> > > > Subject: Re: [rtcweb] DTLS version
> > > >
> > > > On 07/03/2014 07:58 PM, Martin Thomson wrote:
> > > > > On 3 July 2014 01:39, DRAGE, Keith (Keith)
> > > > > <keith.drage@alcatel-lucent.com> wrote:
> > > > >> Can someone elaborate what this massive apparent step
> > > > change is from 1.0 to 1.2?
> > > > > Actually, it's not a massive step.  TLS 1.2 (DTLS 1.2
> > > > depends on this,
> > > > > DTLS 1.0 depends on TLS 1.1) adds AEAD modes, but doesn't
> > > > > require their use, so you can pretty much just bump the version
> > > > > number and advertise 1.2.  That's exactly what we did with NSS,
> > > > > though NSS already supports TLS 1.2.
> > > > >
> > > > > That said, I agree with Jim about 1.0.  There's enough 1.0
> > > > out there
> > > > > now to make mandating 1.2 - as much as I might prefer that
> > > > - a little
> > > > > too aggressive.
> > > > >
> > > > >> Will those implementations that choose to stay with 1.0
> > > > still interwork with 1.2?
> > > > > That depends.  We could say "MUST NOT negotiate 1.0", which
> > > > > would prevent that.  I don't think that we're there.
> > > >
> > > > Sounds to me like MUST implement 1.2 (in order to move forward),
> > > > MUST accept 1.0 (in order to not lose the long tail).
> > > >
> > > > >
> > > > > _______________________________________________
> > > > > rtcweb mailing list
> > > > > rtcweb@ietf.org
> > > > > https://www.ietf.org/mailman/listinfo/rtcweb
> > > >
> > > > _______________________________________________
> > > > rtcweb mailing list
> > > > rtcweb@ietf.org
> > > > https://www.ietf.org/mailman/listinfo/rtcweb
> > > >
> > > _______________________________________________
> > > rtcweb mailing list
> > > rtcweb@ietf.org
> > > https://www.ietf.org/mailman/listinfo/rtcweb
> > >
> > > _______________________________________________
> > > rtcweb mailing list
> > > rtcweb@ietf.org
> > > https://www.ietf.org/mailman/listinfo/rtcweb
> >
> >
>
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb
>
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb
>