Re: [TLS] Consensus Call on MTI Algorithms

[Dave Garrett <[e-mail]>]

On Thursday, April 02, 2015 04:34:14 pm Nico Williams wrote:
> On Thu, Apr 02, 2015 at 04:12:35PM -0400, Dave Garrett wrote:
> > Fortunately for you, the IETF police are only armed with water
> > balloons made out of an over-engineered rubber that doesn't break on
> > impact, and whilst the IETF jail was agreed to be on an island in the
> 
> [Not to be a total nitpicker or anything, but a water balloon that
>  doesn't break probably hurts a lot more than one that does!]

Nah, very stretchy. Just mildly annoying. But they're too expensive anyway, so it's not like you'll ever see one.

> > middle of nowhere that nobody can really get to, it has never been
> > constructed because they've been arguing over the color to paint the
> > roof for the past 30 years. :p
> 
> Also: it's just a bikeshed.  Amnesty International would have one out in
> a heartbeat.

Also, there's no enforcement. It's basically just an island vacation.

</joke>

> > Serious answer: Just write a separate IoT TLS spec that just contains
> > modifications for whatever isn't viable because you're creating a
> > system not designed to necessarily interoperate with the general
> > Internet. General TLS implementations could implement it as well, or
> > not, depending on needs.
> 
> Sure, that'd be nice (because different manufacturers of IoT devices
> will want to know what to implement as a common denominator).

On Thursday, April 02, 2015 04:34:55 pm Eric Rescorla wrote:
> Indeed:
> https://tools.ietf.org/html/draft-ietf-dice-profile-10

The existing TLS 1.3 spec already says:
"In the absence of an application profile standard specifying otherwise, a TLS-compliant application MUST implement the cipher suite [...]"

Maybe just describe the issue in more detail, possibly even cite some profile(s) that could be considered? I don't think there's really any disagreement here on what MTI means in this scenario, but a more thorough explanation that this section is over-ridable for specialized cases wouldn't hurt.


Dave