Re: [secdir] MTI ... Re: Security review of draft-ietf-oauth-dyn-reg-management-12

[Hannes Tschofenig <[e-mail]>]

Radia,

this is what we wrote in RFC 6749:

----


1.6.  TLS Version

   Whenever Transport Layer Security (TLS) is used by this
   specification, the appropriate version (or versions) of TLS will vary
   over time, based on the widespread deployment and known security
   vulnerabilities.  At the time of this writing, TLS version 1.2
   [RFC5246] is the most recent version, but has a very limited
   deployment base and might not be readily available for
   implementation.  TLS version 1.0 [RFC2246] is the most widely
   deployed version and will provide the broadest interoperability.

----

We then moved on to something shorter in RFC 7009:

----

The authorization
   server MUST use Transport Layer Security (TLS) [RFC5246] in a version
   compliant with [RFC6749], Section 1.6.  Implementations MAY also
   support additional transport-layer security mechanisms that meet
   their security requirements.

----

and now we are at:


----

   the server MUST support TLS 1.2 RFC 5246 [RFC5246] and MAY
   support additional transport-layer mechanisms meeting its security
   requirements.

----

I personally don't care too much what we are saying since folks in the
OAuth group would like to say the right thing anyway: we want to use the
most recent version of TLS. Unfortunately that is not specific enough.

If the trick Stephen suggested with referencing BCP numbers (instead of
RFCs) helps then I would go for that.

On 04/02/2015 07:25 PM, Radia Perlman wrote:
> Can't it just say "MUST support version 1.2 or later version of TLS"?

Ciao
Hannes