From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: "Salz, Rich" <rsalz@akamai.com>, Stephen Farrell
 <stephen.farrell@cs.tcd.ie>, "noloader@gmail.com" <noloader@gmail.com>,
 "Tony Arcieri" <bascule@gmail.com>
Thread-Topic: [TLS] TLS Provfiles (Was: Call for consensus to remove
 anonymous DH)
Thread-Index: AQHQ8FFq13KcVZ89fEGkcyYs2GLTPZ4+0CRR//8+EACAAPO8Y///an0AgADTscY=
Date: Wed, 16 Sep 2015 15:02:36 +0000
Message-ID: <9A043F3CF02CD34C8E74AC1594475C73F4B08850@uxcn10-tdc05.UoA.auckland.ac.nz>
References: <CAH8yC8=eHzQPL6cROVK4Pm0V2FSYTL7C7csLG7p49W5LEmfo=Q@mail.gmail.com>
 <9A043F3CF02CD34C8E74AC1594475C73F4B070E6@uxcn10-tdc05.UoA.auckland.ac.nz>,
 <55F92C1A.9060703@cs.tcd.ie>
 <9A043F3CF02CD34C8E74AC1594475C73F4B0723C@uxcn10-tdc05.UoA.auckland.ac.nz>,
 <e41c0880f9b541d59372edfd230b20c1@ustx2ex-dag1mb3.msg.corp.akamai.com>
In-Reply-To: <e41c0880f9b541d59372edfd230b20c1@ustx2ex-dag1mb3.msg.corp.akamai.com>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/K6omZpRJT2tL8wOqku5VAzNcpX0>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] TLS Provfiles (Was: Call for consensus to remove
 anonymous DH)
Precedence: list

Salz, Rich <rsalz@akamai.com> writes:=0A=
=0A=
>> An actual profile of TLS would be something like MUST TLS 1.1 or above,=
=0A=
>> MUST PFS suites, MUST AES and SHA256, MUST E-then-M (and by implication=
=0A=
>> what isn't explicitly permitted is denied).=0A=
>=0A=
>HTTP-2 did this kind of thing, and IIRC are the first to do so.=0A=
=0A=
Some PKI standards have done it too, but mostly because the base standard w=
as=0A=
such a mess that you needed a profile just to sort out what needed to be=0A=
implemented for anything to work (for some level of "work").  They're such =
a=0A=
design counterexample that I didn't want to mention them in my original=0A=
message :-).=0A=
=0A=
Peter.=