Subject: [OAUTH-WG] TLS question from token revocation draft iesg evaluation

From: Stephen Farrell <[email-masked]>
Date: Sun, 02 Jun 2013 20:52:51 +0100

Hiya,

This draft has a couple of minor changes needed as a result
of IESG review (see [1]) but one question came up that I
wanted to bring back to the WG to see what you think. Any
good answer should be fine btw, this isn't a case of the
insisting on stuff.

The question is whether the WG think that the situation
related to the mandatory-to-implement TLS version has changed
since that was last discussed a couple of years ago. There
have been changes in the implementation status of TLS1.2
since then, mainly driven by the discovery of weaknesses
with some deployment choices for TLS1.0.

So - should we stick with the TLS1.0 as MTI and TLS1.2
as a SHOULD implement or can we now safely bump up to
TLS1.2 as MTI?

And since its been a source of confusion here before,
we're discussing what's mandatory to *implement* not
what's mandatory to *use*.

Thanks,
S.

PS: the other changes are mechanical so don't need to
take up WG time but feel free to comment to the list,
chairs, authors, me, ... whatever.

[1] https://datatracker.ietf.org/doc/draft-ietf-oauth-revocation/ballot/

---

From: "Donald F Coffin" <[email-masked]>
Date: Mon, 3 Jun 2013 12:26:52 -0700

Stephen,

I feel it should be MANDATORY to implement TLS1.2, especially since NIST is
in the process of deprecating TLS1.0 as a supported version.

Best regards,
Don
Donald F. Coffin
Founder/CTO

REMI Networks
22751 El Prado Suite 6216
Rancho Santa Margarita, CA  92688-3836

Phone:      (949) 636-8571
Email:       [email-masked]

-----Original Message-----
From: Stephen Farrell [mailto:[email-masked]] 
Sent: Sunday, June 02, 2013 12:53 PM
To: [email-masked]
Subject: [OAUTH-WG] TLS question from token revocation draft iesg evaluation

Hiya,

This draft has a couple of minor changes needed as a result of IESG review
(see [1]) but one question came up that I wanted to bring back to the WG to
see what you think. Any good answer should be fine btw, this isn't a case of
the insisting on stuff.

The question is whether the WG think that the situation related to the
mandatory-to-implement TLS version has changed since that was last discussed
a couple of years ago. There have been changes in the implementation status
of TLS1.2 since then, mainly driven by the discovery of weaknesses with some
deployment choices for TLS1.0.

So - should we stick with the TLS1.0 as MTI and TLS1.2 as a SHOULD implement
or can we now safely bump up to
TLS1.2 as MTI?

And since its been a source of confusion here before, we're discussing
what's mandatory to *implement* not what's mandatory to *use*.

Thanks,
S.

PS: the other changes are mechanical so don't need to take up WG time but
feel free to comment to the list, chairs, authors, me, ... whatever.

---

From: Justin Richer <[email-masked]>
Date: Tue, 4 Jun 2013 12:52:42 -0400

This question will come up on other drafts as well, like Dynamic 
Registration and Introspection that I've been working on, so we should 
really decide what the language is going to be in order to be 
consistent. Would this be also filed as an errata or something on 
RFC6749/6750? (Honestly not sure what/if the process is.)

I will say from the average app developer's perspective, though, that 
most people are just going to look to see if there's an "https" in the 
URL and call it done, so I'm personally not sure what a practical 
difference it will make how we specify things here. The people that care 
about TLS versions will already know to use 1.2 or whatever's the latest 
and greatest, and everyone else isn't going to check the version. 
However, I made this same argument back when this first came up in OAuth 
core and we still ended up having the TLS version language in there in 
the end.

  -- Justin

On 06/03/2013 03:26 PM, Donald F Coffin wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth