Subject: [Uta] What are the actual best practices in the TLS BCP

From: Trevor Freeman <[email-masked]>
Date: Thu, 19 Jun 2014 21:47:33 +0000

There are many things in the TLS BCP which cannot really be construed as a "best" practice since they are largely in there for interoperability.

Use of 3DES today for instance by no stretch of the imagination can be classed as a "best" practice.

Can I suggest a taxonomy of identifying practices in the BCP which are either best, acceptable or minimal in the document. By and large these would map to things that are MUST and SHOULD, or MAY or SHOULD NOT.

E.g.

*         if I negotiate TLS 1.2, with EC, PFS, AES GCM, then that would be a best practice

*         If I negotiate TLS 1.1 with RSA, AES that would be acceptable

*         If I negotiate TLS 1.0 with RSA and 3DES would be minimal

It would be really useful to be able to surface to an application where  a connection was a best, acceptable or minimal practice without exposing the gory detail.

Trevor

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 19 Jun 2014 18:11:55 -0400

I don't see where 3DES is recommended.  Do you mean this:

  (even if they advertise more bits, such as the 168-bit 3DES cipher suites)
Perhaps change it to "such as AES256" ?

> There are many things in the TLS BCP which cannot really be construed as a "best" practice since they are largely in there for interoperability.

Reaching the widest possible audience is often an explicit goal and a trade-off against always being at the best security level.  I think if you have some specific issues, it would be good to edit the rationale to say "only for interopability" or something like that.

I think almost every section should have a rationale.  For example, 3.5 could say "because it's at the wrong layer and has been the subject of security weaknesses" :)

                /r$

--
Principal Security Engineer
Akamai Technologies, Cambridge, MA
IM: [email-masked]<mailto:[email-masked]>; Twitter: RichSalz

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 19 Jun 2014 18:32:02 -0400

Ø  The BCP only prohibits use of RC4 DES and 40bit crypto. As it stands now, use of 3DES is allowed as a “best” practice.

Ah, “what’s not denied is permitted” vs “what’s not permitted is denied” 

Ø  What I am suggesting is that we should correctly call out its use is really a minimal practice to distinguish it from other more worthy practices.  The motivation is to form the basis for encouraging movement towards what really is a best practice in a form the application would be able to consume.

Yes, I’d agree.

---

From: Trevor Freeman <[email-masked]>
Date: Thu, 19 Jun 2014 22:29:39 +0000

The BCP only prohibits use of RC4 DES and 40bit crypto. As it stands now, use of 3DES is allowed as a "best" practice.

What I am suggesting is that we should correctly call out its use is really a minimal practice to distinguish it from other more worthy practices.  The motivation is to form the basis for encouraging movement towards what really is a best practice in a form the application would be able to consume.

From: Salz, Rich [mailto:[email-masked]]
Sent: Thursday, June 19, 2014 3:12 PM
To: Trevor Freeman; [email-masked]
Subject: RE: What are the actual best practices in the TLS BCP

                /r$