Re: [TLS] WG adoption: draft-nir-tls-rfc4492bis

[Sean Turner <[e-mail]>]

On Nov 10, 2014, at 23:58, Yoav Nir <[e-mail]> wrote:

>> 
>> On Nov 10, 2014, at 11:00 PM, Nikos Mavrogiannopoulos <[e-mail]> wrote:
>> 
>> On Mon, 2014-11-10 at 17:17 -1000, Sean Turner wrote:
>>> All,
>>> 
>>> This message is confirming the WG consensus we reached in Toronto about producing an updated RFC4492 that is bound for standard track.* Yoav has produced an individual draft that can be found here:
>>> 
>>> http://datatracker.ietf.org/doc/draft-nir-tls-rfc4492bis/
>>> 
>>> that we would like the WG to consider adopting.  Please let us know by November 18th whether you object to adopting Yoav’s draft (and why).
>> 
>> Two points:
>> 1. This document includes fixed ECDH ciphersuites (ECDH_RSA,
>> ECDH_ECDSA). Given they have 0 deployment on the internet, the question
>> is why? What are the practical use cases of these ciphersuites and why
>> should they be defined in a standards track document.
>> 
>> 2. This document includes arbitrary curve support. What is the rationale
>> for including that as no implementations support that [0], and even for
>> DH we are switching from arbitrary to named groups as well (I also
>> ignore the known attacks for this option).
>> 
>> Unless there is sufficient argumentation and applicability for the
>> above, I support the document only with the above removed.
> 
> Hi, Nikos
> 
> The current draft is pretty much a copy of RFC 4492. The intent is to match whatever decision the WG will make for TLS 1.3.
> 
> So the changes that you suggest will be made after the document is adopted (either in the -00 or -01 version, whichever way the chairs prefer it). 
> 
> Following Sunday’s interim, we’re also likely to remove all the defined curves weaker than P-256 (or maybe P-224 to match the strength of 3DES, although I’m not in favor)
> 
> We are also likely to deprecate point format negotiation. We won’t remove it for TLS 1.2, just mandate non-compressed format for existing curves)
> 
> And when CFRG recommends a new curve, we will add it to this one.
> 
> So this document is in no way in its final form.
> 
> The question before the working group now is whether we want such a document that obsolete 4492 and aligns EC for TLS 1.2 with what we want for 1.3, or if we don’t.
> 
> Hope this clarifies the situation
> 
> Yoav

The idea is that the -00 version is pretty much 4492 so that every change we make will be easily tracked in the diffs.

spt (as chair)