Subject: [OAUTH-WG] Referencing TLS

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 03 Apr 2015 19:57:28 +0200

I learned something new: we can reference a BCP (instead of an RFC) and
even if the RFC gets up-dated we will still have a stable reference.
(See Stephen's response to my question below).

This is what we should do for our documents when we reference TLS in the
future. We would reference the yet-to-become BCP (currently UTA-TLS
document) and we essentially point to the recommended usage for TLS
(version, ciphersuite, everything).

Isn't that great?

--------------------------------------------------------

On 02/04/15 19:09, Hannes Tschofenig wrote:
> Hi Stephen,
> 
> if I understand it correctly, you are saying if we reference a BCP #
> (instead of the RFC) then a revised RFC will get the same BCP #. I have
> never heard about that and if that's indeed true that would be cool. I
> might also have misunderstood your idea though.

Yep, that's it. XML2RFC makes it hard but you can do it, worst
case via an RFC editor note

S.

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 03 Apr 2015 21:09:48 +0200

Here is an actual example.

When 'Guidelines for Writing an IANA Considerations Section in RFCs' was
published it got the BCP # 26. The document behind it was RFC 2434.

Later an update was published, namely RFC 5226, that obsoleted RFC 2434.
Now, BCP 26 points to RFC 5226, see https://tools.ietf.org/html/bcp26

On 04/03/2015 07:57 PM, Hannes Tschofenig wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: John Bradley <[email-masked]>
Date: Fri, 3 Apr 2015 16:16:20 -0300

Yes it is good, though reading that BCP may scare off implementers who will just ignore it. 

We may still want to give the current advice of >= tls 1.2 at the point of publication see BCP xx for additional considerations. 

John B. 

Sent from my iPhone

> On Apr 3, 2015, at 2:57 PM, Hannes Tschofenig <[email-masked]> wrote:
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 3 Apr 2015 15:50:14 -0400

Sent from my iPhone

> On Apr 3, 2015, at 3:16 PM, John Bradley <[email-masked]> wrote:
> 
I think it's fine to do that.  Using the recommended version as the base at time of publication with a pointer to the BCP is appropriate.

Thanks,
Kathleen

---

From: Leif Johansson <[email-masked]>
Date: Fri, 3 Apr 2015 22:08:14 +0200

> 3 apr 2015 kl. 21:16 skrev John Bradley <[email-masked]>:
> 

Those people are gona ignore a bunch of other good advise too. Lets not chase the rabbit down every hole.

---

From: John Bradley <[email-masked]>
Date: Fri, 3 Apr 2015 17:35:11 -0300

Thats true, most will never make it to the security considerations in the first place.  

For those that do getting the message out that TLS versions below 1.2 are not OK and pointing them to the BCP for the other 18 pages of info on the finer points of cypher suite selection and other really good stuff is probably the way to go.

I thought the draft BCP was quite good, but the key point about TLS version is down in 3.1.1 and many people won't get that far if I know developers.

Pointing at the BCP is defiantly the correct thing to do.  Hitting the highpoint in the main spec doesn't hurt and might just remind some people who see stuff about DTLS and Cypher Suites in the BCP and have there brains turn off.

John B.

> On Apr 3, 2015, at 5:08 PM, Leif Johansson <[email-masked]> wrote:
> 
> 
> 
>

---

From: Justin Richer <[email-masked]>
Date: Fri, 3 Apr 2015 16:36:52 -0400

In the end, I still say that 99.999% of implementors and deployers will look at that and say: “Am I doing HTTPS? I am, so I’m good!” and leave it at that. :)

I’m in favor of Kathleen’s approach where we give the minimum version and the BCP pointer for people who really care, and at least say “go do the right thing” to people who might otherwise ignore it.
 — Justin

> On Apr 3, 2015, at 4:08 PM, Leif Johansson <[email-masked]> wrote:
> 
> 
> 
>

---

From: Leif Johansson <[email-masked]>
Date: Sat, 4 Apr 2015 08:52:48 +0200

> 3 apr 2015 kl. 22:35 skrev John Bradley <[email-masked]>:
> 

yup

> For those that do getting the message out that TLS versions below 1.2 are not OK and pointing them to the BCP for the other 18 pages of info on the finer points of cypher suite selection and other…

until 1.3 is out, yeah maybe

> I thought the draft BCP was quite good, but the key point about TLS version is down in 3.1.1 and many people won't get that far if I know developers.

maybe we need a BCP for reading BCPs that sais 'read all of it' (but then there is that boilerplate to get through ;-))

> Pointing at the BCP is defiantly the correct thing to do.  Hitting the highpoint in the main spec doesn't hurt and might just remind some people who see stuff about DTLS and Cypher Suites in the BC…

yeah maybe