Subject: [Uta] Recommendations for Secure Use of TLS and DTLS

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 14 Nov 2014 20:57:59 +0100

I have a small request for "Recommendations for Secure Use of TLS and
DTLS" <draft-ietf-uta-tls-bcp-07>: Could you please change the scope of
the document so that it does not collide with the work we do in DICE.

Your recommendations, as stated in the abstract, focus on the
Web/messaging/email space rather than the Internet of Things space.

Ciao
Hannes

---

From: Leif Johansson <[email-masked]>
Date: Fri, 14 Nov 2014 21:37:23 +0100

On 2014-11-14 20:57, Hannes Tschofenig wrote:
> I have a small request for "Recommendations for Secure Use of TLS
> and DTLS" <draft-ietf-uta-tls-bcp-07>: Could you please change the
> scope of the document so that it does not collide with the work we
> do in DICE.
> 

Hannes,

The document is in its second WGLC. If you want to suggest changes,
please provide concrete text.

	Cheers Leif

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 16 Nov 2014 01:51:17 +0100

Here is a suggestion:

Title: "Recommendations for Secure Use of TLS in the Web"

Abstract:

Transport Layer Security (TLS) is widely used to protect data exchanged
over application protocols such as HTTP, SMTP, IMAP, POP, SIP, and XMPP.
 Over the last few years, several serious attacks on TLS have emerged,
including attacks on its most commonly used cipher suites and modes of
operation.  This document provides recommendations for improving the
security of deployed services that use TLS.  The recommendations are
applicable to the majority of use cases.
Recommendations for other environments, such as Internet of Things, XMPP
and Email, can be found in other specifications.

On 11/14/2014 09:37 PM, Leif Johansson wrote:
> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta
>

---

From: "Orit Levin (LCA)" <[email-masked]>
Date: Sun, 16 Nov 2014 04:44:18 +0000

Hannes,
This BCP is not targeted to Web applications alone, rather it is an applications' independent document recommending best existing and future practices for using TLS. Please see the discussion on the UTA's charter and the scope of each deliverable from January 2014  here: http://www.ietf.org/mail-archive/web/uta/current/msg00053.html. 

The following paragraph from the BCP Introduction says:
"These are minimum recommendations for the use of TLS in the vast majority of implementation and deployment scenarios, with the exception of unauthenticated TLS (see Section 5).  Other specifications that reference this document can have stricter requirements related to one or more aspects of the protocol, based on their particular circumstances (e.g., for use with a particular application protocol); when that is the case, implementers are advised to adhere to those stricter requirements."

In addition, Section 5 contains the detailed discussion on the applicability of this BCP to various application protocols. XMPP is an example of an application to rely on the BCP as the baseline and specify further clarifications and/or deviations in https://tools.ietf.org/html/draft-ietf-uta-xmpp-03 . Email application (with its various entities and protocols) is the next on the UTA agenda.
It would be great to see IoT following the same path, i.e. using the BCP baseline recommendations, either within or outside of UTA.
Thanks,
Orit.

> -----Original Message-----
> From: Uta [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
> Sent: Saturday, November 15, 2014 4:51 PM
> To: Leif Johansson; [email-masked]
> Subject: Re: [Uta] Recommendations for Secure Use of TLS and DTLS
> 
> Here is a suggestion:
>

---

From: Alexey Melnikov <[email-masked]>
Date: Sat, 15 Nov 2014 19:30:30 -1000

> On 15 Nov 2014, at 14:51, Hannes Tschofenig <[email-masked]> wrote:
> 
> Here is a suggestion:
> 

Actually, I disagree. The intent of this document is to also apply to email and XMPP.

---

From: "Leif Johansson" <[email-masked]>
Date: Sun, 16 Nov 2014 13:57:57 +0100

> 16 nov 2014 kl. 01:51 skrev Hannes Tschofenig <[email-masked]>:
> 
> Here is a suggestion:

Ok, this looks like a substantial change. We'll need explicit support to call consensus on this one.

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 16 Nov 2014 15:47:54 +0000

With no-hats, I'd be against this change.

Adding a note that CCM is common in some hardware environments
would be good though.

Delaying this to try to solve the unsolvable problem that we have
CCM and GCM both deployed would be just as bad. So I'd say add a note
that ciphersuite foo is the best one for environments where using
CCM is needed would be ok.

Picking a "foo" I'd suggest adding this to 4.2 maybe

  "There are some environments that have hardware support for
   AES-CCM but not AES-GCM. Where interoperability with such
   devices is needed, the TLS_ECDHE_ECDSA_WITH_AES_128_CCM
   ciphersuite is RECOMMENDED. There may also be niches where
   this kind of device cannot use that ciphersuite perhaps
   because they do not public key cryptography at all - this
   BCP does not cover those niches."

If getting agreement on a foo here is too hard then I'd suggest
instead adding a note somewhere that says:

  "There are some environments that have hardware support for
   AES-CCM but not AES-GCM. There may also be niches where
   this kind of device cannot use that ciphersuite perhaps
   because they do not public key cryptography at all - this
   BCP does not cover those niches."

Cheers,
S.

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 16 Nov 2014 07:52:49 -0800

> Ok, this looks like a substantial change. We'll need explicit support to call consensus on this one.

Like Alexey, I disagree with Hannes' proposal to make this document not apply to XMPP or SMTP or POP or IMAP. Even though I don't agree with everything in the draft, the recommendations apply as much to any traditional client-server use of TLS.

Hannes: if you want to carve out IoT from the draft, please do so with different wording. Instead of making the title and abstract more cumbersome, maybe just add a paragraph early in the introduction to say why IoT is special and thus not included in this document.

--Paul Hoffman

---

From: Aaron Zauner <[email-masked]>
Date: Sun, 16 Nov 2014 17:37:56 +0100

Hi Stephen,

>    BCP does not cover those niches."

To avoid further edits afterwards; If that text gets included in the
document there's a small error on the last line of both parts
"because they do not public key,.." would add 'support'.

Aaron

---

From: "Orit Levin (LCA)" <[email-masked]>
Date: Sun, 16 Nov 2014 19:22:00 +0000

> Hannes: if you want to carve out IoT from the draft, please do so with
> different wording. Instead of making the title and abstract more
> cumbersome, maybe just add a paragraph early in the introduction to say
> why IoT is special and thus not included in this document.
> 
Hannes, please, target such a paragraph  towards Section 5. Applicability Statement of the document. This section was introduced to capture this kind of use cases and the related considerations.
Thanks,
Orit.

---

From: Leif Johansson <[email-masked]>
Date: Mon, 17 Nov 2014 10:06:29 +0100

> Hannes, please, target such a paragraph  towards Section 5. Applicability Statement of the document. This section was introduced to capture this kind of use cases and the related considerations.

In the meanwhile I'm declaring Hannes original proposal in the rough.

Hannes - if you want to pursue carving out IoT from UTA then I suggest
you follow Orits suggestion, however that doesn't guarantee you'll get
the WGs support for making that change either.

The WGLC ends on Friday.

	Cheers Leif

---

From: Peter Saint-Andre - &yet <[email-masked]>
Date: Tue, 25 Nov 2014 19:46:02 -0700

>     BCP does not cover those niches."

I haven't seen substantive comments on this proposal.

>     BCP does not cover those niches."

Simplifying further, I suggest:

    Some devices have hardware support for AES-CCM but not AES-GCM.
    There are even devices that do not public key cryptography at all.
    This BCP does not cover such devices.

Peter

-- 
Peter Saint-Andre
https://andyet.com/

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 26 Nov 2014 10:08:00 +0000

>    This BCP does not cover such devices.

That'd work for me.

S.