Subject: Re: [TLS] Draft minutes for TLS at IETF 108

From: "Christopher Wood" <[email-masked]>
Date: Tue, 04 Aug 2020 11:16:46 -0700

The official minutes are now up:

   https://datatracker.ietf.org/doc/minutes-108-tls/

Best,
Chris, on behalf of the chairs

On Tue, Jul 28, 2020, at 9:29 AM, Christopher Wood wrote:
> Hi folks,
> 
> Draft minutes for today's TLS meeting at IETF 108 are now available:
> 
>    https://github.com/tlswg/wg-materials/blob/master/ietf108/minutes.md
> 
> Thanks to Carrick and others for taking notes! Please send any 
> corrections or updates to the list or as pull requests to the 
> repository.
> 
> Thanks,
> Chris, on behalf of the chairs
>

---

From: tom petch <[email-masked]>
Date: Wed, 5 Aug 2020 10:30:39 +0000

From: TLS <[email-masked]> on behalf of Christopher Wood <[email-masked]>
Sent: 04 August 2020 19:16

<tp>
What is Benjamin talking about at the end?

It looks as if you are proposing action on all or some RFC that have TLS 1.0 or 1.1 as MTI, related to oldversions-deprecate but that is a guess from reading between the lines and that topic is a live one for me so I would appreciate clarity.

Tom Petch

Best,

> Chris, on behalf of the chairs

_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 11 Aug 2020 10:06:01 -0700

On Wed, Aug 05, 2020 at 10:30:39AM +0000, tom petch wrote:
>    https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_minutes-2D108-2Dtls_&d=DwICAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=bJwecPEDnXCm7Huw2ovjHwHyzCjhyu2kGMG-qijduH0&s=ksaUzUpfyd4LFplcfnjfXdGBN-jTrMiqS2Z1vk_Iftw&e= 
> 
> <tp>

oldversions-deprecate is already taking action on all RFCs that have TLS 1.0 or
1.1 as MTI (there are some 80-odd documents in the Updates: header).  The
particular itesm I was mentioning in the meeting relate to various subsets of
those documents that may need some additional handling on top of the basic
"don't use TLS 1.0/1.1; use 1.2 and 1.3 instead" that is currently the content
of the updates.  Details are at https://mailarchive.ietf.org/arch/msg/tls/K9_uA6m0dD_oQCw-5kAbha-Kq5M/
So:

- RFC 5469 defines DES and IDEA ciphers that are not in TLS 1.2; the
  document as a whole should be historic

- The downgrade-detection SCSV of RFC 7507 is probably in a similar boat

- We should be more clear about "if the document being updated says you
  MUST use TLS 1.0/1.1, that part is removed"

- No change proposed w.r.t. MTI ciphers (even though the old MTI ciphers
  are no longer considered very good)

Were there additional specific items you were unsure about?

-Ben

---

From: tom petch <[email-masked]>
Date: Thu, 13 Aug 2020 11:33:38 +0000

From: Benjamin Kaduk <[email-masked]>
Sent: 11 August 2020 18:06

Benjamin

This is the bit I could not guess; the rest of the minutes I could guess but your explanation is much easier to understand.  I have been tracking 'diediedie', including the AD review, since it first appeared and more a comment on that for Kathleen and Stephen is that RFC5953 does not get a mention although since it is Obsoleted and the Normative Reference is to RFC4347 then that is a category that does not seem to fit in any of the paragraphs of the I-D;  Obsolete and TLS1.0 yes, Obsolete and DTLS1.0 no. 

RFC6353 I did expect to find; Internet Standard, STD0078, Normative Reference to RFC4347; the Security Considerations of that RFC say 'MUST NOT negotiate SSL 2.0' which might not be considered sufficiently strong for 2020 but how do you update a Standard?

Tom Petch

-Ben

---

From: tom petch <[email-masked]>
Date: Thu, 13 Aug 2020 11:43:54 +0000

Kathleen

I have some thoughts below on RFC5953 and RFC6353 which I cannot find in deprecate but thought that I would.

Tom Petch
________________________________________
From: TLS <[email-masked]> on behalf of tom petch <[email-masked]>
Sent: 13 August 2020 12:33
To: Benjamin Kaduk
Cc: TLS Chairs; [email-masked]
Subject: Re: [TLS] Draft minutes for TLS at IETF 108

Tom Petch

-Ben