Re: [Uta] draft adoption - draft-sheffer and xmpp

Hi all,

On 3 February 2014 12:31, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:
>
> I would like to propose that the WG chairs just declare
> that the WG have adopted at least draft-sheffer-tls-bcp [1]
> and http://tools.ietf.org/html/draft-saintandre-xmpp-tls. [2]
>
> There may be others that are equally obvious but at least
> those two should be non controversial. Since Feb 14 is the
> cutoff for drafts before London that ought be done by now
> really IMO.
> [...]
>
> [1] https://tools.ietf.org/html/draft-sheffer-tls-bcp-01
> [2] https://tools.ietf.org/html/draft-saintandre-xmpp-tls
> _______________________________________________
> Uta mailing list
> Uta@ietf.org
> https://www.ietf.org/mailman/listinfo/uta

Speaking as an observer, the sheffer document reads very closely to
what we've been working to accomplish in the PHP programming language
for PHp 5.5. Daniel Lowry is currently running with an RFC [1] or two
[2] that would implement most of its recommendations.

In terms of implementation, PHP supports both its own layer (for PHP
Streams) based on openssl and a separate cURL extension using libcurl.
PHP Streams and sockets have historically had peer verification, etc.
disabled by default and this is being reversed at long last.

It also means that PHP is, for once, departing from openssl's DEFAULT
ciphersuite in favour of the current Mozilla recommendation [3]. This
is then divorced from openssl and curl. curl also departed from
openssl's DEFAULT earlier in January but doesn't prioritise for
perfect forward secrecy yet. That PHP, openssl and curl may soon
define three varying ciphersuites is a little confusing for us!

My point here is that I really appreciate the WG's mission and I hope
that something, whether it be the draft-sheffer-tls-bcp or another
document, emerge to get everyone on the same page. At the moment it's
down to pulling random pages off the internet as references and it
doesn't carry the same weight.

[1] https://wiki.php.net/rfc/tls-peer-verification
[2] https://wiki.php.net/rfc/improved-tls-defaults
[3] https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_Ciphersuite

--
Pádraic Brady