Re: [secdir] MTI ... Re: Security review of draft-ietf-oauth-dyn-reg-management-12

Can't it just say "MUST support version 1.2 or later version of TLS"?

On Thu, Apr 2, 2015 at 1:15 PM, Ben Laurie <benl@google.com> wrote:

> On 1 April 2015 at 18:18, Kathleen Moriarty
> <kathleen.moriarty.ietf@gmail.com> wrote:
> > I agree with Hannes here.  Having MTI for TLS 1.2 is fine for right now,
> it
> > must be supported, but doesn't mean other versions can't be supported
> once
> > libraries are available and it makes sense.  We can't hold this up
> because
> > TLS 1.3 is coming soon and would prefer that folks know they should be
> > implementing at least TLS 1.2.  A reference to the TLS BCP with this is
> fine
> > as well.  But this is one of the many OAuth drafts and not really the
> place
> > to call out specific requirements, like which of the recommended cipher
> > suites int eh BCP should be implemented for Oauth (I don't think that has
> > been done as it has for other protocols), but is not the right place to
> do
> > too much.
>
> Call it out wherever you want. _My_ job is to review this particular
> I-D, and this is an issue with this particular I-D. I don't see how
> the fact it is also an issue with many other I-Ds fixes that problem.
>
> _______________________________________________
> secdir mailing list
> secdir@ietf.org
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview
>