Subject: Re: [Uta] Welcome from the chairs and work organization

From: Yaron Sheffer <[email-masked]>
Date: Sun, 15 Dec 2013 12:49:43 +0200

Responding to Peter's mail, I support working on

draft-saintandre-xmpp-tls in this group.

Moreover, I believe that draft-sheffer-tls-bcp itself should be
published within UTA. It directly addresses this charter point:
"Specify a set of best practices for TLS clients and servers,
including but not limited to recommended versions of TLS, using
forward secrecy, and one or more ciphersuites and extensions that
are mandatory to implement."

Thanks,

Yaron

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 15 Dec 2013 07:24:19 -0800

On Dec 15, 2013, at 2:49 AM, Yaron Sheffer <[email-masked]> wrote:

> Responding to Peter's mail, I support working on draft-saintandre-xmpp-tls in this group.

Yes, definitely. XMPP's use of TLS is a good example of scenarios that are poorly understood by many people who say "just use TLS" without thinking about it in contexts other than HTTP.

> Moreover, I believe that draft-sheffer-tls-bcp itself should be published within UTA. It directly addresses this charter point: "Specify a set of best practices for TLS clients and servers, including but not limited to recommended versions of TLS, using forward secrecy, and one or more ciphersuites and extensions that are mandatory to implement."

Also, yes definitely. The TLS WG is about to be focused on TLS 1.3, and this document is important for deployment of TLS in many areas.

--Paul Hoffman

---

From: Dan York <[email-masked]>
Date: Mon, 16 Dec 2013 13:58:50 +0000

On 12/15/13 10:24 AM, "Paul Hoffman" <[email-masked]> wrote:

>Yes, definitely. XMPP's use of TLS is a good example of scenarios that
>are poorly understood by many people who say "just use TLS" without
>thinking about it in contexts other than HTTP.

Agreed.  And in looking at Peter's draft, it occurs to me that it might be
useful to have a document similar to this for SIP that provides an update
on current usage of TLS within SIP and provides newer recommendations
helpful to implementers.  SIP's usage of TLS is spelled out in a couple of
different RFCs:

http://tools.ietf.org/search/rfc5630

http://tools.ietf.org/html/rfc5922

and Olle Johansson wrote a draft earlier this year looking at how DANE
could be used with SIP:

http://tools.ietf.org/html/draft-johansson-dane-sip-00

as well as various other documents that talk about SIP and DTLS (ex.
http://tools.ietf.org/html/draft-peck-suiteb-dtls-srtp ).  It would be
useful to have a document that pulls all this together for implementers
that summarizes current TLS-related thinking and best practices for SIP.

(Having said all this, I don't know that I personally have the cycles to
work on such a document for SIP, although I'd be willing to help. I'm more
just suggesting that Peter's document seems like a good framework to
provide TLS-related updates for other protocols.)

>>published within UTA. It directly addresses this charter point: "Specify
>>a set of best practices for TLS clients and servers, including but not
>>limited to recommended versions of TLS, using forward secrecy, and one
>>or more ciphersuites and extensions that are mandatory to implement."
>
>Also, yes definitely. The TLS WG is about to be focused on TLS 1.3, and
>this document is important for deployment of TLS in many areas.

Agree on the value of working on draft-sheffer-tls-bcp  here.

Dan

--
Dan York
Senior Content Strategist, Internet Society
[email-masked] +1-802-735-1624
Jabber: [email-masked]
Skype: danyork    http://twitter.com/danyork

http://www.internetsociety.org/deploy360/

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 16 Dec 2013 09:28:51 -0700

> are mandatory to implement."

Yes, we need draft-sheffer-tls-bcp to move forward in parallel with
the application-specific documents.

Among the latter I would include:

- - my document on XMPP

- - draft-moore-email-tls on POP and IMAP

- - a document on SMTP (I thought we had one but I can't find it in the
datatracker)

Documents on HTTP and SIP would also be helpful, I think.

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/