Re: [Teep] Working Group Last Call for HTTP Transport for Trusted Execution Environment Provisioning: Agent-to-TAM Communication

[Benjamin Kaduk <[e-mail]>]

On Fri, Apr 03, 2020 at 12:13:33AM +0000, Dave Thaler wrote:
> For point 4 (TLS considerations), I filed https://github.com/ietf-teep/otrp-over-http/issues/10 and
> my proposal to address it is as follows:
> 
> OLD: When HTTPS is used, TLS certificates MUST be checked according to [RFC2818]. 
> 
> NEW: When HTTPS is used, TLS certificates MUST be checked according to [RFC2818]. 
> NEW: See [RFC7525] for additional TLS recommendations.      
> 
> Rationale is that RFC 7525 (BCP 195) is what contains the answers to questions like Tiru asked in point 4, in a way that is
> not specific to TEEP, and already has IETF consensus.  For example, section 3.1.1 of that RFC deals with TLS versions
> as Tiru asked about in point 4.   My proposed approach also means we don't need to come up with TEEP-specific text,
> since I don't believe there's anything TEEP specific here, given that TEEP messages are secured end-to-end inside so
> anything really TEEP specific to say would be up in the TEEP protocol.

Thanks, Dave, this sounds like a good plan.  I note that we probably do
want to pick up any future changes/updates to BCP 195, so we should
probably cite that and not just RFC 7525.

-Ben