Re: [TLS] TLS Provfiles (Was: Call for consensus to remove anonymous DH)

On 16/09/15 09:19, Peter Gutmann wrote:
> Jeffrey Walton <noloader@gmail.com> writes:
> 
>> Somewhat off-topic, why does TLS not produce a few profiles. One can be
>> "Opportunistic TLS Profile" with a compatible security posture and include
>> ADH. Another can be a "Standard TLS Profile" and include things like export
>> grade crypto, weak and wounder ciphers SSLv3, etc. Finally, there can be a
>> "TLS Defensive profile" where you get mostly the strong the protocols and
>> ciphers, HTTPS Pinning Overrides are not allowed so the adversary cannot
>> break the secure channel by tricking a user, etc.
> 
> +1.  At the moment you're stuck with everything-all-the-time (or alternatively
> one-size-misfits-all) where you have to support every single mechanism and
> quirk and add-on, when all you want most of the time is to set up a basic
> secure tunnel from A to B.  Having profiles would be a great help, so all the
> other standards groups that build on TLS can refer to, say, the emebedded-
> device profile or the PFS-with-PSK profile rather than having to hack around
> the standard themselves.

We have BCP195 [1] that aims for the "general" case (for
up to TLS1.2) and a draft [2] (current in IESG evaluation)
for the embedded case. Are those the kind of thing you're
after?

If so, and you wanted more, the UTA WG [3] (which produced
BCP195) would maybe be the best place to see if there's
enough interest in doing more. (The embedded one was done
in the DICE WG [4] which was setup mostly for that as it's
to some extent a different set of folks. And that could be
done again if needed.)

Cheers,
S.

[1] https://tools.ietf.org/html/bcp195
[2] https://tools.ietf.org/html/draft-ietf-dice-profile-16
[3] https://tools.ietf.org/wg/uta/
[4] https://tools.ietf.org/wg/dice/

> 
> Peter.
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
> 