Re: [secdir] MTI ... Re: Security review of draft-ietf-oauth-dyn-reg-management-12

[Kathleen Moriarty <[e-mail]>]

Sorry, I was at a conference yesterday and not able to respond.

Sent from my iPhone

> On Apr 2, 2015, at 1:15 PM, Ben Laurie <[e-mail]> wrote:
> 
> On 1 April 2015 at 18:18, Kathleen Moriarty
> <[e-mail]> wrote:
>> I agree with Hannes here.  Having MTI for TLS 1.2 is fine for right now, it
>> must be supported, but doesn't mean other versions can't be supported once
>> libraries are available and it makes sense.  We can't hold this up because
>> TLS 1.3 is coming soon and would prefer that folks know they should be
>> implementing at least TLS 1.2.  A reference to the TLS BCP with this is fine
>> as well.  But this is one of the many OAuth drafts and not really the place
>> to call out specific requirements, like which of the recommended cipher
>> suites int eh BCP should be implemented for Oauth (I don't think that has
>> been done as it has for other protocols), but is not the right place to do
>> too much.
> 
> Call it out wherever you want. _My_ job is to review this particular
> I-D, and this is an issue with this particular I-D. I don't see how
> the fact it is also an issue with many other I-Ds fixes that problem.

Yes and your review is very much appreciated.  We need to discuss the review to figure out what changes and doesn't in a draft.  Ideally, all of the security needs would have been clear in a foundational document, but as Hannes pointed out, requirements evolved as OAuth developed.

At this point in time, TLS 1.2 is the base requirement, which is appropriate.  As is a reference to the BCP that explains security for that version.  When support for 1.3 makes that feasible, an 'updates' draft can fix that.  If the BCP for 1.3 updates the current one for 1.2 (maybe there will be enough of a difference to make a new #), then the BCP number will already be in this draft.  We can't predict the future, but we can go off of what we know now and just move into the other questions raised in this review.

Thank you,
Kathleen