Subject: [xmpp] #2: split TLS cipher recommendations into separate spec?

From: "xmpp issue tracker" <[email-masked]>
Date: Mon, 06 Jul 2009 22:46:56 -0000

#2: split TLS cipher recommendations into separate spec?
--------------------------------+-------------------------------------------
 Reporter:  [email-masked]  |       Owner:            
     Type:  defect              |      Status:  new       
 Priority:  minor               |   Milestone:  milestone1
Component:  3920bis             |     Version:            
 Severity:  Active WG Document  |    Keywords:            
--------------------------------+-------------------------------------------
 Recommended TLS ciphers might change with TLS versions, the results of
 security research, etc. Rather than "hardcoding" this information in the
 core XMPP specification, would it be preferable to move this information
 into a separate specification that can be updated more frequently?

 See also
 http://mail.jabber.org/pipermail/security/2009-January/000612.html

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/xmpp/trac/ticket/2>
xmpp <http://tools.ietf.org/xmpp/>

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 07 Jul 2009 12:42:19 -0600

On 7/7/09 12:39 PM, Jiří Zárevúcky wrote:
> 2009/7/7 xmpp issue tracker <[email-masked]>:
> Perhaps it would be nice to have a separate specification for the
> exact requirements, but I'm skeptical about real-life value of any
> such definitions. Everyone (perhaps except of some embedded platforms,
> but that's not really my area) will use abstract TLS libraries anyway.
> 
> I believe an ordinary (and sane) programmer will certainly not bother
> with TLS implementation or anything concerning it.

You're probably right...

> btw, is it OK to respond to the tickets on this list instead of
> commenting them directly?

Sure. Indeed I prefer it. I just figured I'd test the issue tracker
since that's what the IETF Tools Team has given us. :)

Peter

- --
Peter Saint-Andre
https://stpeter.im/

---

From: Jiří Zárevúcky <[email-masked]>
Date: Tue, 7 Jul 2009 20:39:27 +0200

---

From: Sean Turner <[email-masked]>
Date: Thu, 23 Jul 2009 13:52:23 -0400

Peter Saint-Andre wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 

Splitting out the algorithms from the protocol gets done a lot in the 
security area because the protocol doesn't change much just the 
algorithms.  The issue then is that there needs to be another document 
that says: use this protocol and these algorithms for version X of the 
protocol.  If we split it out would we need a 3rd document to do that?

spt