Subject: [Uta] draft adoption - draft-sheffer and xmpp

From: Stephen Farrell <[email-masked]>
Date: Mon, 03 Feb 2014 12:31:10 +0000

I would like to propose that the WG chairs just declare
that the WG have adopted at least draft-sheffer-tls-bcp [1]
and http://tools.ietf.org/html/draft-saintandre-xmpp-tls. [2]

There may be others that are equally obvious but at least
those two should be non controversial. Since Feb 14 is the
cutoff for drafts before London that ought be done by now
really IMO.

Protocols do involve state machines but that doesn't
imply working in a stately manner:-)

S.

[1] https://tools.ietf.org/html/draft-sheffer-tls-bcp-01
[2] https://tools.ietf.org/html/draft-saintandre-xmpp-tls

---

From: Leif Johansson <[email-masked]>
Date: Mon, 03 Feb 2014 15:50:59 +0100

> and http://tools.ietf.org/html/draft-saintandre-xmpp-tls. [2]
The authors of these drafts were going to meet last week to discuss a
possible merger/split of the drafts into possibly 2 or 3 new drafts
forming a more consistent overall structure.

The chairs are waiting to hear back from Yaron and St Peter.

In the meanwhile could I ask you (and anyone else for that matter) to
please review the drafts on the list so we can at least have _some_
discussion before we turn anything into WG documents!

The reason me and Orit are being a bit difficult is that this WG was
created wo a BOF process which means we don't have any initial consensus
around what the initial contributions are to lean on.

We (the chairs) feel this makes it even more important to be extra
careful about how this WG gets going and that this maybe is worth a
little extra startup delay.

Having said that, the WG has the final decision so feel free to disagree
and we'll adopt away :-)
> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 03 Feb 2014 09:04:18 -0700

> forming a more consistent overall structure.

That didn't happen last week because I was travelling. We're going to 
chat this evening, and will report to the list soon thereafter (likely 
in about 24 hours).

Peter

---

From: Pádraic Brady <[email-masked]>
Date: Mon, 3 Feb 2014 16:32:06 +0000

Hi all,

On 3 February 2014 12:31, Stephen Farrell <[email-masked]> wrote:
> [...]

Speaking as an observer, the sheffer document reads very closely to
what we've been working to accomplish in the PHP programming language
for PHp 5.5. Daniel Lowry is currently running with an RFC [1] or two
[2] that would implement most of its recommendations.

In terms of implementation, PHP supports both its own layer (for PHP
Streams) based on openssl and a separate cURL extension using libcurl.
PHP Streams and sockets have historically had peer verification, etc.
disabled by default and this is being reversed at long last.

It also means that PHP is, for once, departing from openssl's DEFAULT
ciphersuite in favour of the current Mozilla recommendation [3]. This
is then divorced from openssl and curl. curl also departed from
openssl's DEFAULT earlier in January but doesn't prioritise for
perfect forward secrecy yet. That PHP, openssl and curl may soon
define three varying ciphersuites is a little confusing for us!

My point here is that I really appreciate the WG's mission and I hope
that something, whether it be the draft-sheffer-tls-bcp or another
document, emerge to get everyone on the same page. At the moment it's
down to pulling random pages off the internet as references and it
doesn't carry the same weight.

[1] https://wiki.php.net/rfc/tls-peer-verification
[2] https://wiki.php.net/rfc/improved-tls-defaults
[3] https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_Ciphersuite

--
Pádraic Brady

---

From: Leif Johansson <[email-masked]>
Date: Mon, 03 Feb 2014 17:45:55 +0100

> chat this evening, and will report to the list soon thereafter (likely
Perfect!