IETF Logo Mail Archive

Re: [TLS] TLS 1.3 draft-07 sneak peek

Dave Garrett <davemgarrett@gmail.com> Fri, 03 July 2015 23:07 UTC

Return-Path: <davemgarrett@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6C7B1A902D for <tls@ietfa.amsl.com>; Fri, 3 Jul 2015 16:07:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jfjxSj8ypJPV for <tls@ietfa.amsl.com>; Fri, 3 Jul 2015 16:07:16 -0700 (PDT)
Received: from mail-yk0-x231.google.com (mail-yk0-x231.google.com [IPv6:2607:f8b0:4002:c07::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B6B01A9029 for <tls@ietf.org>; Fri, 3 Jul 2015 16:07:16 -0700 (PDT)
Received: by ykfs198 with SMTP id s198so1121399ykf.2 for <tls@ietf.org>; Fri, 03 Jul 2015 16:07:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:subject:date:user-agent:cc:references:in-reply-to :mime-version:content-type:content-transfer-encoding:message-id; bh=q4kBqDfyjbzrhsdEfc+9tC44Lwibm2+N5e8gloyE+tQ=; b=PLvJE3IfMwxpFHRdpaISl/Q//7K1s/NJYNK0/JhOvGAGna4VEiIZdixzq11OVY83+l Dsq/rYNN91m/rHTNq4czYF80eO9C+xrSkDOwPQtoWx3X1ofcXr5Y2yWe5yTx/1FmPsnC JdWztDW+2iMebYBN8sKJIsAVvMFWZw06j6dvcmDieTUsB7MJ5QCEfaeNQQKJwZe6VZSe HM55GEE938FbdDBGiJkAZir4yF8TNKgFJtPrNeZ/C77f+9E32AIChJu8xq5Ny0zdGHXz HqkjehynFtYclI1PYkpZT66rwUUPJ9Qfp9WEANW9iq5/Sue4tUbaoN9zJQ5b5ONuKt4+ fCtg==
X-Received: by 10.170.54.203 with SMTP id 194mr46843511ykw.42.1435964835642; Fri, 03 Jul 2015 16:07:15 -0700 (PDT)
Received: from dave-laptop.localnet (pool-96-245-254-195.phlapa.fios.verizon.net. [96.245.254.195]) by mx.google.com with ESMTPSA id h7sm10557456ywb.10.2015.07.03.16.07.15 (version=TLSv1 cipher=RC4-SHA bits=128/128); Fri, 03 Jul 2015 16:07:15 -0700 (PDT)
From: Dave Garrett <davemgarrett@gmail.com>
To: tls@ietf.org, Hubert Kario <hkario@redhat.com>
Date: Fri, 03 Jul 2015 19:07:13 -0400
User-Agent: KMail/1.13.5 (Linux/2.6.32-74-generic-pae; KDE/4.4.5; i686; ; )
References: <CABcZeBOWK_WnHAefsZUBr4UyEkyiZqi1mhoZH8ZeGFftdOqTTw@mail.gmail.com> <CABkgnnWS0acYzZmbPekp=5Z-KVpd5zFLQh7Kw75rtWqNOkuW0w@mail.gmail.com> <2729812.2vdokAE54M@pintsize.usersys.redhat.com>
In-Reply-To: <2729812.2vdokAE54M@pintsize.usersys.redhat.com>
MIME-Version: 1.0
Content-Type: Text/Plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Message-Id: <201507031907.13872.davemgarrett@gmail.com>
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/g5bbcRqSkFPdQkLUGOYperrIaQA>
Subject: Re: [TLS] TLS 1.3 draft-07 sneak peek
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 03 Jul 2015 23:07:17 -0000

On Friday, July 03, 2015 06:29:28 pm Hubert Kario wrote:
> And while we're at it, maybe a security recommendation stating that 
> advertising support for sha-1 and md-5 is not recommended?

I'm already handling some of this topic over here:
https://github.com/tlswg/tls13-spec/pull/188/files
see also:
https://github.com/tlswg/tls13-spec/issues/186

That deals with MD5 but I don't have anything for SHA1 being not recommended, yet. I was thinking that we should probably come up with a deprecation timeline to write in the spec that lines up with what vendors are already doing. That PR was just for completely removed capabilities, though. Eric said he'd have review of this PR on his todo list soon, so a new PR for the SHA1 stuff is probably best. I might work on writing up something for that next.


Dave

v2.23.0 | Report a Bug | By Email