IETF Logo Mail Archive

Re: [secdir] MTI ... Re: Security review of draft-ietf-oauth-dyn-reg-management-12

Ben Laurie <benl@google.com> Thu, 02 April 2015 17:15 UTC

Return-Path: <benl@google.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 320DC1ACEE1 for <secdir@ietfa.amsl.com>; Thu, 2 Apr 2015 10:15:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.389
X-Spam-Level:
X-Spam-Status: No, score=-1.389 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5m43GHM_FMR0 for <secdir@ietfa.amsl.com>; Thu, 2 Apr 2015 10:15:53 -0700 (PDT)
Received: from mail-qc0-x236.google.com (mail-qc0-x236.google.com [IPv6:2607:f8b0:400d:c01::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4084B1A888E for <secdir@ietf.org>; Thu, 2 Apr 2015 10:15:53 -0700 (PDT)
Received: by qcbii10 with SMTP id ii10so49645919qcb.2 for <secdir@ietf.org>; Thu, 02 Apr 2015 10:15:52 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=OFqirxW2ZBm90ExnOUmIfyCFTDPcBvh4Hqz7E+g+UiA=; b=O+Klzyknrm40AZ7rkKbumqEsIozSDXRMqhSx1J6UbglzmSt6ffaJFjvN1fsVOO8TVw 003QnrM/D7YpagLVGOUq4XEXiv+kqujexcOTgrbKgLLXLhwBT3Ydmy2DybRJDxfmpQ78 1tO1YHKkoVGdWzNG6xKgZM3alwHEqBpC9MQkWMe/y6i6KdSNGAVwRPFZUy52XqI3ZPJq pufx2Vl3JHyv5K0NPoa0CA07XUBZpma6GxJufWor5OfPVqFefP/RzqiZwxEHEYhwh9KD J1jJScvSkweLoLCv4wWQKYWhn2RwHbNExH8sD6FyBziyTM4JLK0imbbeaUMG2bThxoZa Xfgw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=OFqirxW2ZBm90ExnOUmIfyCFTDPcBvh4Hqz7E+g+UiA=; b=Cr6MXPJ91uxG1fED0Yp4DP4+hai/HCZcD0gwRxZ/QLm9/T0FZtvFfORdU4lF9t11FO +l1poeRckMmnNaTi7j+IyA9gpvbrOJ0uCyG9RLcT69vykpBSp5B141XPRaX3V9hTDD7T 064vjxgJVY+yh5eTGoX6MAa6BhdunTsobTf00+OxI6hVdOSDleT0e9lH4W2/VyyQSHSr DAnMNDEGvuxMIBPdarr4fMX5aL2HDLMmCYJxEyFWVbfm8WUzfsrleB9/U+uXg1ExFZrd ctGfEVLlqVuJfW7wu0Ap6v/upN7wYgTZsB2abhFKpVFem8rogXZ3tMoFWAZNIFQkPM3e 7j4A==
X-Gm-Message-State: ALoCoQlkGtYYik3gQqpxQ2LcFwBuKKNvO9vw7/7jFWOghFi49MlEne7k+5ER47aQR6JDvcqYSiPO
MIME-Version: 1.0
X-Received: by 10.55.49.138 with SMTP id x132mr60917188qkx.19.1427994952526; Thu, 02 Apr 2015 10:15:52 -0700 (PDT)
Received: by 10.229.178.135 with HTTP; Thu, 2 Apr 2015 10:15:52 -0700 (PDT)
In-Reply-To: <CAHbuEH65fyKWZpVRxst=-6arapic4vK-K3A38EuLv0f70gDDCg@mail.gmail.com>
References: <CABrd9STmvLWy_Bz7e+pN_0vANxajtD+fMzVM+trwn6+k50Mifw@mail.gmail.com> <551C0005.2000309@gmx.net> <alpine.GSO.1.10.1504011209550.22210@multics.mit.edu> <551C1970.4050600@cs.tcd.ie> <551C2568.3050301@gmx.net> <CAHbuEH65fyKWZpVRxst=-6arapic4vK-K3A38EuLv0f70gDDCg@mail.gmail.com>
Date: Thu, 02 Apr 2015 18:15:52 +0100
Message-ID: <CABrd9STN4sp3GYwXT20CsDJQ4DJMrN-zajjxypkZWSpEUi4BTA@mail.gmail.com>
From: Ben Laurie <benl@google.com>
To: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <http://mailarchive.ietf.org/arch/msg/secdir/ZjKc-FqzjptLLxjYZ0yjWmHFtHg>
Cc: "secdir@ietf.org" <secdir@ietf.org>, The IESG <iesg@ietf.org>, draft-ietf-oauth-dyn-reg-management.all@tools.ietf.org
Subject: Re: [secdir] MTI ... Re: Security review of draft-ietf-oauth-dyn-reg-management-12
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 02 Apr 2015 17:15:54 -0000

On 1 April 2015 at 18:18, Kathleen Moriarty
<kathleen.moriarty.ietf@gmail.com> wrote:
> I agree with Hannes here.  Having MTI for TLS 1.2 is fine for right now, it
> must be supported, but doesn't mean other versions can't be supported once
> libraries are available and it makes sense.  We can't hold this up because
> TLS 1.3 is coming soon and would prefer that folks know they should be
> implementing at least TLS 1.2.  A reference to the TLS BCP with this is fine
> as well.  But this is one of the many OAuth drafts and not really the place
> to call out specific requirements, like which of the recommended cipher
> suites int eh BCP should be implemented for Oauth (I don't think that has
> been done as it has for other protocols), but is not the right place to do
> too much.

Call it out wherever you want. _My_ job is to review this particular
I-D, and this is an issue with this particular I-D. I don't see how
the fact it is also an issue with many other I-Ds fixes that problem.

v2.23.0 | Report a Bug | By Email