Re: [TLS] EXTERNAL: Re: integrity only ciphersuites

So rather than upgrading to TLS 1.3, why not just upgrade to IPsec?
 You're going to have to change what you do anyway—rather than arguing with
us why not bypass us entirely?

On Tue, Aug 21, 2018 at 1:06 PM, Jack Visoky <jmvisoky@ra.rockwell.com>
wrote:

> Just to pile on what Steffen is saying, the motivation for this is mainly
> around device communication that happens at high speeds (sub millisecond is
> not uncommon for an update rate).  The communications is generally not
> HTTP, but rather industrial protocols built on TCP and UDP.
>
>
>
> Thanks and Best Regards,
>
>
>
> --Jack
>
>
>
> *From:* TLS [mailto:tls-bounces@ietf.org] *On Behalf Of *Fries, Steffen
> *Sent:* Tuesday, August 21, 2018 12:54 PM
> *To:* Salz, Rich <rsalz@akamai.com>
> *Cc:* ncamwing=40cisco.com@dmarc.ietf.org; tls@ietf.org
> *Subject:* EXTERNAL: Re: [TLS] integrity only ciphersuites
>
>
>
> [Use caution with links & attachments]
>
>
>
>
>
> On 21. Aug 2018, at 18:13, Salz, Rich <rsalz@akamai.com> wrote:
>
> ?  If there would be support for integrity ciphers in TLS 1.3 it would
> enable the straight forward switch from TLS 1.2 also in these environments
> by keeping existing monitoring options.
>
>
>
> Why do you want to move to TLS 1.3?  Why isn’t your existing solution good
> enough?
>
>
>
> ?  [stf] Currently it is sufficient to use TLS 1.2- For certain use cases
> the utilized components have a rather long lifetime. One assumption is that
> TLS 1.3 will exist longer that TLS 1.2 and that certain software tools
> (also browsers) may not support TLS 1.2 in the future  …
>
>
>
> Most browsers already do not support NULL encryption, and it is highly
> unlikely that any will add it for 1.3.  Have you any indication otherwise?
> If you’re not going to use the algorithms in general use on the public
> Internet, then you should expect that standard clients such as browsers,
> will not work.  PeterG can attest to this. :)
>
>
>
> True. I was more referring to an embedded device, which currently supports
> TLS 1.2 (for using integrity only) for machine to machine communication  If
> this device is accessed by a service technician, it will also use today
> cipher suites with encryption. If a browser provider decides to deprecate
> TLS 1.2 in the future, access by standard software would be hindered. This
> would end up in a device supporting TLS 1.3 for service technicians access
> and 1.2 for machine to machine communication to (still) have integrity
> only.
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>
>