Subject: [TLS] [Technical Errata Reported] RFC5246 (6572)

From: RFC Errata System <[email-masked]>
Date: Wed, 5 May 2021 03:21:16 -0700 (PDT)

The following errata report has been submitted for RFC5246,
"The Transport Layer Security (TLS) Protocol Version 1.2".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6572

--------------------------------------
Type: Technical
Reported by: Johannes Görlich <[email-masked]>

Section: 9

Original Text
-------------
In the absence of an application profile standard specifying otherwise, a TLS-compliant application MUST implement the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA (see Appendix A.5 for the definition).

Corrected Text
--------------
In the absence of an application profile standard specifying otherwise, a TLS-compliant application MUST implement the cipher suite TLS_RSA_WITH_AES_128_GCM_SHA256 (see Appendix A.5 for the definition).

Notes
-----
A must-be-implement cipher suite should not relay on a bulk encryption algorithm which is vulnerable to plain-text attacks or on a secure hash algorithm which has been proven to be insecure.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC5246 (draft-ietf-tls-rfc4346-bis-10)
--------------------------------------
Title               : The Transport Layer Security (TLS) Protocol Version 1.2
Publication Date    : August 2008
Author(s)           : T. Dierks, E. Rescorla
Category            : PROPOSED STANDARD
Source              : Transport Layer Security
Area                : Security
Stream              : IETF
Verifying Party     : IESG

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 5 May 2021 16:00:00 -0700

I'm not sure precisely what attacks you are referring to here. In
particular, I'm not aware of any known security issues with HMAC-SHA1. With
that said, I agree that we wouldn't choose AES_128_CBC_SHA as a default
now, but this isn't usually the kind of thing we would usually use an
erratum for. Rather, this would be appropriate for a new RFC updating 5246.

-Ekr

On Wed, May 5, 2021 at 3:21 AM RFC Errata System <[email-masked]>
wrote:

> In the absence of an application profile standard specifying otherwise, a
> TLS-compliant application MUST implement the cipher suite
> TLS_RSA_WITH_AES_128_CBC_SHA (see Appendix A.5 for the definition).
>
> Corrected Text
> --------------
> In the absence of an application profile standard specifying otherwise, a
> TLS-compliant application MUST implement the cipher suite
> TLS_RSA_WITH_AES_128_GCM_SHA256 (see Appendix A.5 for the definition).
>
> Notes
> -----
> A must-be-implement cipher suite should not relay on a bulk encryption
> algorithm which is vulnerable to plain-text attacks or on a secure hash
> algorithm which has been proven to be insecure.
>
> Instructions:
> -------------

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 5 May 2021 16:06:36 -0700

I agree that this isn't an appropriate change for an erratum.

Even with a new RFC updating RFC 5246, we'd still need to have some
discussion about a transition plan, at which point just relying
on the guidance in BCP 195 becomes more and more attractive.

-Ben

On Wed, May 05, 2021 at 04:00:00PM -0700, Eric Rescorla wrote:
> > https://urldefense.com/v3/__https://www.rfc-editor.org/errata/eid6572__;!!GjvTz_vk!FfdA-HJa47sbeeDEDwh3TNDNxVmLXLJdZQ-bzn4yM_KdLFt6kEcEiWduzMMlqw$ 
> >

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/tls__;!!GjvTz_vk!FfdA-HJa47sbeeDEDwh3TNDNxVmLXLJdZQ-bzn4yM_KdLFt6kEcEiWd4LHbbkQ$

---

From: "Martin Thomson" <[email-masked]>
Date: Thu, 06 May 2021 09:22:54 +1000

Given that RFC 5246 is obsolete, all of this is largely moot.

I think that we can reject this erratum.

On Thu, May 6, 2021, at 09:06, Benjamin Kaduk wrote:
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 6 May 2021 08:53:36 +0000

Hi Johannes,

TLS 1.2 has been obsoleted by TLS 1.3. Prior to this, other specifications have profiles the algorithm choice (see RFC 7525 and RFC 7925).

Ciao
Hannes

-----Original Message-----
From: TLS <[email-masked]> On Behalf Of RFC Errata System
Sent: Wednesday, May 5, 2021 12:21 PM
To: [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: [TLS] [Technical Errata Reported] RFC5246 (6572)

The following errata report has been submitted for RFC5246, "The Transport Layer Security (TLS) Protocol Version 1.2".

Section: 9

Original Text
-------------

Corrected Text
--------------

Notes
-----

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary.

_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.