Subject: [TLS] draft-tschofenig-lwig-tls-minimal = TLS profile proposal

From: "Schwarz, Albrecht (Albrecht)" <[email-masked]>
Date: Thu, 8 Nov 2012 10:47:51 +0100

Dear All,
like to raise a general comment to the group, driven by the "TLS minimal" draft:

Do agree to the message of this doc, guess that the subject as such is out of question in the TLS community.
Actually I've expected more concrete specification guidelines from the conclusion section.
Notions such as "TLS can be customized ...", "... required TLS functionality" or "It can be tailored to fit the needs of a specific deployment environment." point out that TLS related parameters and procedures could and should be specified in detail for a particular communication (and security) environment.

The answer could be the explicit introduction of a profile concept, - which is very well known already for some protocols.
Profiles could be more high level (like the "RTP profiles" (e.g. RFC 3551 as a "minimum" ...) or fairly detailed (such as the 3GPP "SIP Gm profile" or H.248 profiles).

And there are already concepts for "TLS profiles" around, see e.g.
- "3GPP TLS Protocol Profile" (Annex E/33.310)
- "OMA TLS Profile" (OMA-TS-TLS-V1_...) or
- "Operating system xyz TLS Profile" ('xyz' as a placeholder for some well known OSs)

However, all these TLS profile concepts are not really identical, sharing some common capabilities, but also adding some specifics.
The rational behind is the fact that an explicit TLS profile concept is not (yet?) introduced in the IETF TLS core RFCs in my understanding.

We faced the same situation in ITU-T SG16 in work items for H.248-controlled TLS services.
Thus, we made a definition proposal as a working assumption.

Interested parties may have a look in:
a) H.248.TLS "H.248 packages for control of transport security"
http://wftp3.itu.int/av-arch/avc-site/2009-2012/1209_Bri/TD-23.zip

3.2.6   TLS-profile: A selection of options from a set of TLS related parameters and procedures.

and a concrete example may be found in:
8.7      Example for the TLS profile concept

b) H.248.TLSPROF "Guidelines on the use of H.248 capabilities for transport security in TLS networks in H.248 Profiles"
http://wftp3.itu.int/av-arch/avc-site/2009-2012/1209_Bri/TD-24.zip

Would be interested whether the TLS WG experts
a) thought already about the definition of a profile for TLS (and DTLS)?
[Which would be a terminology definition and could be additionally a template for protocol profiling]
b) got any comments on our proposed TLS terms in above ITU-T work items?

Thanks,
Albrecht