From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>, "noloader@gmail.com"
 <noloader@gmail.com>, Tony Arcieri <bascule@gmail.com>
Thread-Topic: [TLS] TLS Provfiles (Was: Call for consensus to remove
 anonymous DH)
Thread-Index: AQHQ8FFq13KcVZ89fEGkcyYs2GLTPZ4+0CRR//8+EACAAPO8Yw==
Date: Wed, 16 Sep 2015 11:18:56 +0000
Message-ID: <9A043F3CF02CD34C8E74AC1594475C73F4B0723C@uxcn10-tdc05.UoA.auckland.ac.nz>
References: <CAH8yC8=eHzQPL6cROVK4Pm0V2FSYTL7C7csLG7p49W5LEmfo=Q@mail.gmail.com>
 <9A043F3CF02CD34C8E74AC1594475C73F4B070E6@uxcn10-tdc05.UoA.auckland.ac.nz>,
 <55F92C1A.9060703@cs.tcd.ie>
In-Reply-To: <55F92C1A.9060703@cs.tcd.ie>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/F_BEWbWcdvk8t5HQF_5vornOH4w>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] TLS Provfiles (Was: Call for consensus to remove
 anonymous DH)
Precedence: list

Stephen Farrell <stephen.farrell@cs.tcd.ie> writes:=0A=
=0A=
>We have BCP195 [1] that aims for the "general" case (for up to TLS1.2) and=
 a=0A=
>draft [2] (current in IESG evaluation) for the embedded case. Are those th=
e=0A=
>kind of thing you're after?=0A=
=0A=
Sort of, but since they're not part of the TLS spec they essentially don't=
=0A=
exist (I've never seen then quoted, cited, or referenced in any third-party=
=0A=
standard that deals with TLS).=0A=
=0A=
Another problem is that they're defined as a large collection of (often rat=
her=0A=
waffly) "don't do this" comments, so as a somewhat wooly blacklist rather t=
han=0A=
a clear whitelist.  So the BCPs aren't really a profile but more like 20-30=
=0A=
pages of hand-wringing.=0A=
=0A=
An actual profile of TLS would be something like MUST TLS 1.1 or above, MUS=
T=0A=
PFS suites, MUST AES and SHA256, MUST E-then-M (and by implication what isn=
't=0A=
explicitly permitted is denied).=0A=
=0A=
Peter.=