Re: [secdir] Secdir review of draft-ietf-ecrit-additional-data

Randall Gellens <> Wed, 16 September 2015 17:58 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 2E2FE1A7014 for <>; Wed, 16 Sep 2015 10:58:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -5.986
X-Spam-Status: No, score=-5.986 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, MIME_HTML_ONLY=0.723, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id Zx9ATeVvgkVd for <>; Wed, 16 Sep 2015 10:58:04 -0700 (PDT)
Received: from ( []) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id BF24B1A6FFE for <>; Wed, 16 Sep 2015 10:58:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;;; q=dns/txt; s=qcdkim; t=1442426284; x=1473962284; h=message-id:in-reply-to:references:date:to:from:subject: cc:mime-version:content-transfer-encoding; bh=n4b4XZHQOvSaA15lJxspBMv6Z07zvbkhdgiIpEJNRiE=; b=uLtfeES28TE5ElLvFOtpCjUXLEpQe6v36MNmzZzkWUcz69nFkGklGz0C nk2SAuVDnx8wjcf2JRieqslmi7oFvQfdWK4XrF3kwkw1ZVk6yYEpqoulg LkgQfl47pD81fWmK2eWhxnW/6gSx+BsSDYKcdqqzYhDtCWe3rozuDVcUH U=;
X-IronPort-AV: E=McAfee;i="5700,7163,7926"; a="97979683"
Received: from ([]) by with ESMTP/TLS/DHE-RSA-AES256-SHA; 16 Sep 2015 10:58:04 -0700
X-IronPort-AV: E=Sophos;i="5.17,540,1437462000"; d="scan'208,217";a="1002870692"
Received: from ([]) by with ESMTP/TLS/RC4-SHA; 16 Sep 2015 10:58:04 -0700
Received: from [] ( by ( with Microsoft SMTP Server (TLS) id 15.0.1076.9; Wed, 16 Sep 2015 10:58:03 -0700
Message-ID: <p06240619d21f5df7de24@[]>
In-Reply-To: <>
References: <> <p06240610d21e68de6c17@> <> <p06240612d21e7dc050f6@> <> <> <p06240616d21f443ed6d5@> <>
X-Mailer: Eudora for Mac OS X
Date: Wed, 16 Sep 2015 10:57:59 -0700
To: Magnus =?iso-8859-1?Q?Nystr=F6m?= <>
From: Randall Gellens <>
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Random-Sig-Tag: 1.0b28
X-Random-Sig-Tag: 1.0b28
X-Originating-IP: []
X-ClientProxiedBy: ( To (
Archived-At: <>
Cc: "" <>,
Subject: Re: [secdir] Secdir review of draft-ietf-ecrit-additional-data
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Security Area Directorate <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 16 Sep 2015 17:58:06 -0000

Re: [secdir] Secdir review of draft-ietf-ecrit-additional-
At 10:31 AM -0700 9/16/15, Magnus Nyström wrote:

Just a personal remark: BCP 195 still allows earlier versions of TLS, even TLS 1.0. I felt that for a new application like this, one could go stronger. Maybe  a combo - where you rely on BCP 195 but mandate TLS 1.2 (or later)?

And not mention CBC?

On Wed, Sep 16, 2015 at 9:14 AM, Randall Gellens <> wrote:
At 7:38 AM +0000 9/16/15, wrote:
 On Wed Sep 16 04:09:03 2015 GMT+0100, Magnus Nyström wrote:
 Yes, at least mandating TLS 1.2 or higher and recommending as per above
 seems reasonable.
 The references for the GCM suites would be RFC 5288 and RFC 5289.

 BCP195 has recent recommendations for most TLS options. I'd say it'd be best to use those or if not figure out why they're not correct for this context.

Just to be clear: are you suggesting that we replace text suggested by Magnus:

   TLS MUST be version 1.2 or later.  It is RECOMMENDED to use only
   cypher suites that offer Perfect Forward Secrecy (PFS) and avoid
   Cipher Block Chaining (CBC), for example,
   TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 [RFC5288] [RFC5289].

With this:

   TLS MUST be version 1.2 or later.  It is RECOMMENDED follow

Note that BCP 195 does not address CBC (but does discuss PFS).  I just want to be clear before making the change, so please confirm that this works.

Randall Gellens
Opinions are personal;    facts are suspect;    I speak for myself only
-------------- Randomly selected tag: ---------------
If the odds are a million to one against something occurring, chances
are 50-50 it will.

-- Magnus

Randall Gellens
Opinions are personal;    facts are suspect;    I speak for myself only
-------------- Randomly selected tag: ---------------
Between two evils, I always pick the one I never tried before.
                                                  --Mae West.