Re: [Uta] Proposed list of deliverables

[Paul Hoffman <[e-mail]>]

On Jan 18, 2014, at 1:24 AM, Orit Levin (LCA) <[e-mail]> wrote:

> Below is the list of deliverables for your consideration:
> 
> 1. A threat analysis document containing a collection of known security breaches to application protocols due to poor use of TLS (Likely an Informational RFC) 

Is this meant to also cover application protocols with *no* use of TLS? That is, is the threat analysis supposed to cover "why you should encrypt", or just "why you should encrypt well when you encrypt"?

> 2. Applications' independent document recommending best existing and future practices for using TLS (Likely a BCP or a Proposed Standard RFC) 

Good.

> 3. A set of documents, each describing best existing and future practices for using TLS with a specific application protocol, i.e., SMTP, POP, IMAP, XMPP, HTTP 1.1, etc. (Case-by-case likely a BCP or a Proposed Standard RFC) 

This needs to be defined more. The phase "using TLS" can mean one or more of:
- TLS with server authentication, with encryption
- TLS with server authentication, without encryption
- TLS without server authentication, with encryption
- TLS with server authentication, with client authentication, with encryption
- TLS with server authentication, with client authentication, without encryption
- TLS without server authentication, with client authentication, with encryption
Different short names are applied different scenarios, making it all the more confusing. If we don't get this one right, we can easily delay useful results from the WG by two years.

> 4. A document discussing (and potentially defining) how to apply the opportunistic encryption approach (preliminary outlined in draft-farrelll-mpls-opportunistic-encrypt-00.txt) to TLS. (Category TBD)

The preliminary outline in that document is transitory, and in some ways not easily applicable to TLS. Why are we not making our own definition so that we can apply it to TLS precisely?

--Paul Hoffman