Re: [tsvwg] Comments regarding draft-westerlund-tsvwg-sctp-crypto-chunk

[[e-mail]]

> On 27. Jul 2023, at 16:08, Magnus Westerlund <magnus.westerlund=[e-mail]> wrote:
> 
> Hi,
>  See below.
>  On 2023-07-27, 09:15, "[e-mail]" <[e-mail]> wrote:
> > On 27. Jul 2023, at 08:27, Magnus Westerlund <magnus.westerlund=[e-mail]> wrote:
> > > Hi Michael,
> >  On the major issue, as we talked here in San Francisco I think it is possible to do what you suggest. It impacts the extensibility in that any future protection engine would need to define a crypto chunk protection specification that is added as an algorithm used to protect. We definitely need algorithm agility at this layer independently so I think it is more a document structure thing. We will look into this in more detail to see if there are any issues, but it sounds possible to make this change. I will note that that this would likely mean that we define the crypto chunk such that it has two defined payload protection’s one being the DTLS 1.2 record layer, one being the DTLS 1.3 record layer. The API to this function would then
>  Why do we need to support DTLS 1.2 and DTLS 1.3? Wouldn't it be simpler to support only one version?
> I would suggest to use DTLS 1.3 only...
>  MW: Yes, and we proposed before that we should go DTLS 1.3 only. There was push back on that, but I guess with the delay this might be more acceptable at this point. The issue is that so far there are limited availability of DTLS 1.3 stacks, and especially there none from OpenSSL which I think is a reason that makes many less happy.  Cheers
I'm not sure if using OpenSSL is possible at all, depending on the final solution and the IPR situation at that point.

Best regards
Michael
>  Magnus