Subject: [Uta] I-D Action: draft-ietf-uta-rfc7525bis-00.txt

From: [email-masked]
Date: Thu, 29 Oct 2020 23:07:55 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Using TLS in Applications WG of the IETF.

        Title           : Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)
        Authors         : Yaron Sheffer
                          Ralph Holz
                          Peter Saint-Andre
	Filename        : draft-ietf-uta-rfc7525bis-00.txt
	Pages           : 29
	Date            : 2020-10-29

Abstract:
   Transport Layer Security (TLS) and Datagram Transport Layer Security
   (DTLS) are widely used to protect data exchanged over application
   protocols such as HTTP, SMTP, IMAP, POP, SIP, and XMPP.  Over the
   last few years, several serious attacks on TLS have emerged,
   including attacks on its most commonly used cipher suites and their
   modes of operation.  This document provides recommendations for
   improving the security of deployed services that use TLS and DTLS.
   The recommendations are applicable to the majority of use cases.

   This document was published as RFC 7525 when the industry was in the
   midst of its transition to TLS 1.2.  Years later this transition is
   largely complete and TLS 1.3 is widely available.  Given the new
   environment, we believe new guidance is needed.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-uta-rfc7525bis/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-uta-rfc7525bis-00
https://datatracker.ietf.org/doc/html/draft-ietf-uta-rfc7525bis-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Yaron Sheffer <[email-masked]>
Date: Fri, 30 Oct 2020 08:18:44 +0200

Dear UTA folks,

We have just published version -00 of the WG draft. This is the change log:

* Renamed: WG document.
* Started populating list of changes from RFC 7525.
* General rewording of abstract and intro for revised version.
* Protocol versions, fallback.
* Reference to ECHO.

This is an early version with only some of the changes required to the General Recommendations, but not all. We will continue to refine the document after IETF-109.

Thanks,
	Yaron

On 10/30/20, 08:09, "[email-masked] on behalf of [email-masked]" <[email-masked] on behalf of [email-masked]> wrote:

    Abstract:

    _______________________________________________
    Uta mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/uta

---

From: Julien ÉLIE <[email-masked]>
Date: Fri, 30 Oct 2020 13:34:16 +0100

Hi,

> We have just published version -00 of the WG draft.

Thanks for this new version.
Just to report two nits while reading it:

In Section 3.3, a comma is missing after "when using TLS 1.2":
   In order to help prevent compression-related attacks (summarized in	
   Section 2.6 of [RFC7457]), when using TLS 1.2 implementations and	
   deployments SHOULD disable TLS-level compression (Section 6.2.2 of	
   [RFC5246]), unless the application protocol in question has been	
   shown not to be open to such attacks.

In Section 6, the first sub-section is not correctly identified ("## 
Host Name Validation" should be 6.1).

-- 
Julien ÉLIE

« Vina bibant homines, animantia cetera fontes. »