Re: [secdir] MTI ... Re: Security review of draft-ietf-oauth-dyn-reg-management-12

[Kathleen Moriarty <[e-mail]>]

On Wed, Apr 1, 2015 at 1:05 PM, Hannes Tschofenig <[e-mail]
> wrote:

> Ben, Stephen,
>
> I believe that this would be a good idea although it does not really
> solve the underlying problem. Why? If we put a reference to the UTA BCP
> in there then we end up in the need to update our documents in the not
> too distance future to point to a new UTA BCP that talks about TLS 1.3.
>

I agree with Hannes here.  Having MTI for TLS 1.2 is fine for right now, it
must be supported, but doesn't mean other versions can't be supported once
libraries are available and it makes sense.  We can't hold this up because
TLS 1.3 is coming soon and would prefer that folks know they should be
implementing at least TLS 1.2.  A reference to the TLS BCP with this is
fine as well.  But this is one of the many OAuth drafts and not really the
place to call out specific requirements, like which of the recommended
cipher suites int eh BCP should be implemented for Oauth (I don't think
that has been done as it has for other protocols), but is not the right
place to do too much.

The web page/registry idea is a good one, so we can state current
recommendations.

Thanks,
Kathleen

>
> Ciao
> Hannes
>
>
> On 04/01/2015 06:14 PM, Stephen Farrell wrote:
> >
> >
> > On 01/04/15 17:11, Benjamin Kaduk wrote:
> >> On Wed, 1 Apr 2015, Hannes Tschofenig wrote:
> >>
> >>> I personally would like to replace these types of recommendations with
> >>> references to a page on the IETF website that talks about the most
> >>> recent TLS & ciphersuite recommendations. I am aware that this might
> >>> create problems with claiming interoperability with a specific RFC...
> >>
> >> Why not a BCP document for TLS usage?  It seems to be a charter item for
> >> the uta WG already...
> >
> > Well, initially OAuth wanted some specifics that matched the
> > deployments then seen, but yeah, I think the world may have
> > moved on sufficiently that a simple reference to the UTA BCP
> > (which is in the RFC editor queue) [1] might be fine. I'd
> > say it's defo worth asking the wg if they'd have a problem
> > with that now.
> >
> > S.
> >
> > [1] https://www.rfc-editor.org/queue2.html#draft-ietf-uta-tls-bcp
> >
> >
> >>
> >> -Ben
> >>
>
>


-- 

Best regards,
Kathleen