Subject: [CDNi] draft text re TLS cipher suites (for cdni-logging and other cdni interfaces)

From: "Francois Le Faucheur (flefauch)" <[email-masked]>
Date: Thu, 20 Mar 2014 14:32:22 +0000

Folks,

Here is the draft text proposed by Jan (with input from Jon, and small editorial enhancements from me) for inclusion in cdni-logging:
“
A CDNI Logging implementation MUST support the TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 cipher suite [RFC5288]. A CDNI Logging implementation SHOULD favor cipher suites which support perfect forward secrecy over non-perfect forward secrecy cipher suites.
”

Please review and comment if needed.

A few additional points:
* the statements around TLS and cipher suites discussed here in the context of cdni-logging are expected to apply to all the CDNI interfaces (unless there is some specific reason to do otherwise for a given interface)
* there is no final position on this from IESG yet. So we may have to adapt the text based on IESG review.
* Jan identified that the rtcweb group has been looking at the same question ( "http://tools.ietf.org/html/draft-ietf-rtcweb-security-arch-09” section 5.5) and used their draft text and approach (ie RTCWEB decided not to require the use of PFS, but to say that if both sides support it, it should be used) as a basis.

Cheers

Francois

PS: For memory, here is an excerpt fom the IETF-89 meeting minutes where TLS cipher suites were discussed:
"
Spencer Dawkins: IESG currently looking at cipher suites and perfect forward secrecy. No formal decision yet about whether specifying cipher suites is mandatory for drafts.
Jan S.: Once IESG is done, I’m willing to help with updating draft to reflect outcome.
Rob Murray: Will we have the same discussion for other interfaces as well? Maybe have transport in separate draft?
Daryl M.: Don’t think that’s a good idea. Jan, could you help with recommendation while we wait for IESG (i.e. send proposed text for that to authors)?
Jan S.: Ok.
Spencer D.: Most important thing right now is that you’ve thought about it. Fact that we’re having this discussion is a good sign.
“

---

From: <[email-masked]>
Date: Thu, 20 Mar 2014 16:40:13 +0100

Hello all,

I would have phrased it as "A CDNI Logging implementation MUST support the TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 cipher suite [RFC5288]. An implementation of the CDNI Logging Interface SHOULD prefer cipher suites which support perfect forward secrecy over cipher suites that don't."

My 2 eurocents...
-- iuniana

De : CDNi [mailto:[email-masked]] De la part de Francois Le Faucheur (flefauch)
Envoyé : jeudi 20 mars 2014 15:32
À : [email-masked]
Objet : [CDNi] draft text re TLS cipher suites (for cdni-logging and other cdni interfaces)

Folks,

A few additional points:
* the statements around TLS and cipher suites discussed here in the context of cdni-logging are expected to apply to all the CDNI interfaces (unless there is some specific reason to do otherwise for a given interface)
* there is no final position on this from IESG yet. So we may have to adapt the text based on IESG review.
* Jan identified that the rtcweb group has been looking at the same question ( "http://tools.ietf.org/html/draft-ietf-rtcweb-security-arch-09" section 5.5) and used their draft text and approach (ie RTCWEB decided not to require the use of PFS, but to say that if both sides support it, it should be used) as a basis.

Cheers

Francois

PS: For memory, here is an excerpt fom the IETF-89 meeting minutes where TLS cipher suites were discussed:
"
Spencer Dawkins: IESG currently looking at cipher suites and perfect forward secrecy. No formal decision yet about whether specifying cipher suites is mandatory for drafts.
Jan S.: Once IESG is done, I'm willing to help with updating draft to reflect outcome.
Rob Murray: Will we have the same discussion for other interfaces as well? Maybe have transport in separate draft?
Daryl M.: Don't think that's a good idea. Jan, could you help with recommendation while we wait for IESG (i.e. send proposed text for that to authors)?
Jan S.: Ok.
Spencer D.: Most important thing right now is that you've thought about it. Fact that we're having this discussion is a good sign.
"

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.