Subject: [tcpinc] TCPINC - security protocols

From: "Black, David" <[email-masked]>
Date: Mon, 29 Feb 2016 16:30:13 +0000

Here's an update from the chairs on the two TCPINC security protocols:

While the TLS WG is hard at work on TLS 1.3, that protocol is not finished
yet; the chairs believe that completion of that base protocol is a necessary
prerequisite for a TCPINC profile of TLS 1.3 (e.g., as a TCPINC profile will
have to normatively reference the TLS 1.3 specification).  In addition,
from a broader IETF perspective, completion of TLS 1.3 really does need
to be the first priority for TLS experts such as Eric Rescorla.

The chairs believe that it is important to get something done promptly, and
that waiting for TLS 1.3 followed by spending the time to finish a profile based
on it are not consistent with that goal. We (chairs) have checked with Eric
Rescorla  (author of the TCPINC profile of TLS), and he supports this point
of view. 

For these reasons, the chairs strongly suggest that the best course of action
for the TCPINC WG is to move forward to standardize tcpcrypt and TCP-ENO,
with a plan to allocate additional TCP-ENO codepoints for the TLS profile and
possible use of TCP-ENO to negotiate application use of TLS when those
protocols are ready for standardization.  Please note that if tcpcrypt continues
to progress faster than TCP-use-TLS, tcpcrypt would become the initial
mandatory-to-implement security protocol in the TCP-ENO specification.

Updated drafts have been posted to the datatracker for TCP-ENO and
tcpcrypt.  The chairs still intend to proceed with the expert reviews for the
security and transport aspects of these drafts, and expect those reviews
to complete during the month of March (i.e., results should be available
prior to the Buenos Aires meeting) supporting prompt progress towards
publication of both drafts as RFCs.

A final WG decision on how to proceed should be made in the next few
weeks,  so comments on the list are welcome.

Thanks, --David/Mirja/Kyle

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 29 Feb 2016 16:36:04 +0000

(with no hats)

> weeks,  so comments on the list are welcome.

I think that plan sounds good. I'm happy to see tcpinc
make progress without taking cycles away from TLS1.3.

(Ok, that last bit did involve a bit of a hat:-)

S.

---

From: Ted Hardie <[email-masked]>
Date: Mon, 29 Feb 2016 09:10:18 -0800

> weeks,  so comments on the list are welcome.
I believe this is a sensible approach to serializing the work, and I
support this way of moving forward.

regards,

Ted

> _______________________________________________
> Tcpinc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tcpinc
>

---

From: Derek Fawcus <[email-masked]>
Date: Mon, 29 Feb 2016 18:42:20 +0000

> mandatory-to-implement security protocol in the TCP-ENO specification.

That is a sensible approach.

DF

---

From: Jana Iyengar <[email-masked]>
Date: Mon, 29 Feb 2016 14:48:48 -0800

> mandatory-to-implement security protocol in the TCP-ENO specification.

A big +1 to moving the work forward without blocking on TLS1.3.

- jana

---

From: Joe Touch <[email-masked]>
Date: Mon, 29 Feb 2016 16:31:21 -0800

> Black, David wrote:

Sorry if this has been asked (I didn't see it), but is this merely a
person-cycles issue or is there some deeper reason for not designing it
agnostic to 1.2 vs. 1.3 and requiring 1.2 support until 1.3 is ready?

Joe