Subject: Re: [rtcweb] DTLS version

From: Michael Tuexen <[email-masked]>
Date: Thu, 3 Jul 2014 09:39:47 +0200

On 01 Jul 2014, at 02:20, Martin Thomson <[email-masked]> wrote:

> On 30 June 2014 16:55, Michael Tuexen <[email-masked]> wrote:
>>> "Wouldn't that imply that it makes sense to use DTLS 1.2 in all documents?"
>>> 
>>> [BA] Not necessarily.  As I understand it, existing implementations only support 1.0 - and if we were to mandate only 1.2 ciphersuites, then this would create an interoperability problem.
>> There are also several clarifications and corrections to handshake issues. This
>> really helps in interoperability....
> 
> Bernard is right.  But there are several advantages to an update to
> referencing (D)TLS 1.2.  For one, we get better ciphersuites (AES-GCM
> and all the AEAD modes).
> 
> That said, there are enough implementations out there already that
> *requiring* 1.2 might be too aggressive.  I think that I'd prefer that
> (so that we can make modern ciphersuite recommendations to fit), but
> if someone has a strong need for 1.0, I don't have a problem
> suggesting that 1.0 be accepted.
> 
> p.s., DTLS 1.2 is coming in Firefox.  As it turns out, NSS supported
> it, but it hadn't been turned on.
So the consensus seems to be to require 1.0 for now.
If there will be a change in the future, a separate RFC will change that to 1.2. Right?

Best regards
Michael

---

From: Jim Spring <[email-masked]>
Date: Thu, 3 Jul 2014 00:48:10 -0700

Personally, given the lack of widespread adoption of DTLS 1.2 at this point, I would prefer a requirement of 1.0 for this round of things.

That said, I believe there will be a pull request in the next week addressing this section of security-arch does expire in mig august, so we should make progress soon.  Hopefully any of the "TBDs" in the document can be fleshed out before Toronto.

-jim

On Jul 3, 2014, at 12:39 AM, Michael Tuexen <[email-masked]> wrote:

> _______________________________________________
> rtcweb mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rtcweb

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Thu, 3 Jul 2014 08:39:39 +0000

Can someone elaborate what this massive apparent step change is from 1.0 to 1.2?

Will those implementations that choose to stay with 1.0 still interwork with 1.2?

If everything interworks reasonably OK, I would prefer to specify 1.2, and then maybe a note acknowledging that 1.0 implementations might be out there.

Otherwise the security people are wasting their time producing 1.2.

Keith

> -----Original Message-----
> From: rtcweb [mailto:[email-masked]] On Behalf Of Jim Spring
> Sent: 03 July 2014 08:48
> To: Michael Tuexen
> Cc: [email-masked]
> Subject: Re: [rtcweb] DTLS version
> 
> Personally, given the lack of widespread adoption of DTLS 1.2 
> at this point, I would prefer a requirement of 1.0 for this 
> round of things.
> 
> That said, I believe there will be a pull request in the next 
> week addressing this section of security-arch does expire in 
> mig august, so we should make progress soon.  Hopefully any 
> of the "TBDs" in the document can be fleshed out before Toronto.
> 
> -jim
> 
> On Jul 3, 2014, at 12:39 AM, Michael Tuexen 
> <[email-masked]> wrote:
> 
> >> On 30 June 2014 16:55, Michael Tuexen 
> <[email-masked]> wrote:
> >>>> [BA] Not necessarily.  As I understand it, existing 
> implementations only support 1.0 - and if we were to mandate 
> only 1.2 ciphersuites, then this would create an 
> interoperability problem.
> >>> There are also several clarifications and corrections to 
> handshake 
> >>> issues. This really helps in interoperability....
> >> 
> >> *requiring* 1.2 might be too aggressive.  I think that I'd prefer 
> >> that (so that we can make modern ciphersuite 
> recommendations to fit), 
> >> but if someone has a strong need for 1.0, I don't have a problem

---

From: Martin Thomson <[email-masked]>
Date: Thu, 3 Jul 2014 10:58:35 -0700

> Can someone elaborate what this massive apparent step change is from 1.0 to 1.2?

Actually, it's not a massive step.  TLS 1.2 (DTLS 1.2 depends on this,
DTLS 1.0 depends on TLS 1.1) adds AEAD modes, but doesn't require
their use, so you can pretty much just bump the version number and
advertise 1.2.  That's exactly what we did with NSS, though NSS
already supports TLS 1.2.

That said, I agree with Jim about 1.0.  There's enough 1.0 out there
now to make mandating 1.2 - as much as I might prefer that - a little
too aggressive.

> Will those implementations that choose to stay with 1.0 still interwork with 1.2?

That depends.  We could say "MUST NOT negotiate 1.0", which would
prevent that.  I don't think that we're there.

---

From: Harald Alvestrand <[email-masked]>
Date: Fri, 04 Jul 2014 10:07:24 +0200

> prevent that.  I don't think that we're there.

Sounds to me like MUST implement 1.2 (in order to move forward), MUST 
accept 1.0 (in order to not lose the long tail).

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Fri, 4 Jul 2014 10:23:39 +0000

This is the direction I am tending in as well.

Although what or if the second statement needs from RFC 2119 language would need to be debated.

Obviously, new versions are not being put out there just to make it look like the WG is performing. In any referencing (not just this issue), I would need a good technical reason why the latest version cannot be made the normative reference. I am not seeing that at the moment.

There is always be non-conforming equipment on the market (as an example look at the number of SIP implementations that still use UDP for large messages, or that can at least be configured that way). Just because we mandate 1.2 does not mean that everyone will conform from day 1, but at least a marker is established for what should be addressed if interoperability issues are identified.

Keith 

> From: rtcweb [mailto:[email-masked]] On Behalf Of 
> Harald Alvestrand
> Sent: 04 July 2014 09:07
> To: [email-masked]
> Sounds to me like MUST implement 1.2 (in order to move 
> forward), MUST accept 1.0 (in order to not lose the long tail).
> 
> >

---

From: Michael Tuexen <[email-masked]>
Date: Fri, 4 Jul 2014 15:43:20 +0200

> There is always be non-conforming equipment on the market (as an example look at the number of SIP implementations that still use UDP for large messages, or that can at least be configured that way…
Hmm, the submission deadline is approaching and I try to figure out if there
is consensus which DTLS version to use:
We used DTLS 1.2 on the SCTP over DTLS ID, and both data channel IDs.
During the WG LC I got the comment that RTCWeb uses 1.0, so please change it. I haven't
got these comments on the data channel IDs during WG LC.

It looks like I'll change the documents to use 1.0 for now, submit them. Then we
have a consistent state. If the WG (or the IESG) decides that we want 1.2, the IDs have
to be resubmitted after the IETF.

Best regards
Michael

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 4 Jul 2014 12:48:48 -0700

I made this change in the current draft at:

https://github.com/rtcweb-wg/security-arch/commit/c2af2bf7fd032abd367dff8d4d16f7ec435fa663

Note that the TLS WG is currently discussing whether to bring ECC onto
Standards Track.
If they do, we probably want ot require support of ECDHE. We should discuss
in YYZ.

On Fri, Jul 4, 2014 at 3:23 AM, DRAGE, Keith (Keith) <
[email-masked]> wrote:

> Obviously, new versions are not being put out there just to make it look
> like the WG is performing. In any referencing (not just this issue), I
> would need a good technical reason why the latest version cannot be made
> the normative reference. I am not seeing that at the moment.
>
> There is always be non-conforming equipment on the market (as an example
> look at the number of SIP implementations that still use UDP for large
> messages, or that can at least be configured that way). Just because we
> mandate 1.2 does not mean that everyone will conform from day 1, but at
> least a marker is established for what should be addressed if
> interoperability issues are identified.
>
> Keith
>

---

From: Michael Tuexen <[email-masked]>
Date: Fri, 4 Jul 2014 23:11:39 +0200

> https://github.com/rtcweb-wg/security-arch/commit/c2af2bf7fd032abd367dff8d4d16f7ec435fa663
If implementations MUST implement both DTLS 1.0 and 1.2, when will they use 1.0? Wouldn't
they always use DTLS 1.2?

Best regards
Michael
> 
> Note that the TLS WG is currently discussing whether to bring ECC onto Standards Track.
> If they do, we probably want ot require support of ECDHE. We should discuss in YYZ.
> 
> 
> 
> On Fri, Jul 4, 2014 at 3:23 AM, DRAGE, Keith (Keith) <[email-masked]> wrote:

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 4 Jul 2014 14:19:56 -0700

> they always use DTLS 1.2?

There are non-RTCWEB implementations of these protocols.

-Ekr

---

From: Michael Tuexen <[email-masked]>
Date: Fri, 4 Jul 2014 23:28:08 +0200

On 04 Jul 2014, at 23:19, Eric Rescorla <[email-masked]> wrote:

> 
> 
> 
> On Fri, Jul 4, 2014 at 2:11 PM, Michael Tuexen <[email-masked]> wrote:
OK. Any suggested test for the SCTP over DTLS spec? It currently says MUST be based on DTLS 1.0 (as
you suggested).

Best regards
Michael

---

From: Shijun Sun <[email-masked]>
Date: Mon, 7 Jul 2014 21:29:51 +0000

There seems a preference on supporting DTLS 1.0 due to the widespread adoption.  There is also a desire of supporting ECDHE when ECC is on a Standards Track.  Hope we could reach a consensus in Toronto.  

To keep the discussions going, here is a proposal with a specific cipher suite based on DTLS 1.0.  

    All implementations MUST implement the cipher suite TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 
    based on DTLS 1.0 with P256 as the curve to be used with ECDHE and ECDSA.  The Implementations 
    MAY advertise additional cipher suites based on DTLS 1.0 and/or DTLS 1.2 definitions, for example, 
    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA with P256.

We could keep DTLS 1.2 as an optional implementation decision for now and make that (and some corresponding new cipher suites) as required in the future.

Thoughts?

Best, Shijun 

-----Original Message-----
From: rtcweb [mailto:[email-masked]] On Behalf Of Michael Tuexen
Sent: Friday, July 4, 2014 2:28 PM
To: Eric Rescorla
Cc: [email-masked]
Subject: Re: [rtcweb] DTLS version

On 04 Jul 2014, at 23:19, Eric Rescorla <[email-masked]> wrote:

> If implementations MUST implement both DTLS 1.0 and 1.2, when will 
> they use 1.0? Wouldn't they always use DTLS 1.2?
> 
OK. Any suggested test for the SCTP over DTLS spec? It currently says MUST be based on DTLS 1.0 (as you suggested).

Best regards
Michael
> > > From: rtcweb [mailto:[email-masked]] On Behalf Of Harald 
> > > Alvestrand
> > > Sent: 04 July 2014 09:07
> > > To: [email-masked]
> > > > DTLS 1.0 depends on TLS 1.1) adds AEAD modes, but doesn't 
> > > > require their use, so you can pretty much just bump the version 
> > > > number and advertise 1.2.  That's exactly what we did with NSS, 
> > > > though NSS already supports TLS 1.2.
> > > >
> > > > That depends.  We could say "MUST NOT negotiate 1.0", which 
> > > > would prevent that.  I don't think that we're there.
> > >
> > > Sounds to me like MUST implement 1.2 (in order to move forward), 
> > > MUST accept 1.0 (in order to not lose the long tail).
> > >
> > > >

---

From: Justin Uberti <[email-masked]>
Date: Sat, 19 Jul 2014 23:50:24 -0400

I was thinking the baseline cipher suite would be
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (note RSA instead of ECDSA), as the best
choice that maintains 1.0 compatibility.

I think we could also have a SHOULD for
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 as the preferred TLS 1.2 ciphersuite.

On Mon, Jul 7, 2014 at 5:29 PM, Shijun Sun <[email-masked]> wrote:

> There seems a preference on supporting DTLS 1.0 due to the widespread
> adoption.  There is also a desire of supporting ECDHE when ECC is on a
> Standards Track.  Hope we could reach a consensus in Toronto.
>
> We could keep DTLS 1.2 as an optional implementation decision for now and
> make that (and some corresponding new cipher suites) as required in the
> future.
>
> Thoughts?
>
> Best, Shijun
>
> > > Obviously, new versions are not being put out there just to make it
> look like the WG is performing. In any referencing (not just this issue), I
> > > There is always be non-conforming equipment on the market (as an
> example look at the number of SIP implementations that still use UDP for
> large messages, or that can at least be configured that way). Just because
> we mandate 1.2 does not mean that everyone will conform from day 1, but at

---

From: Shijun Sun <[email-masked]>
Date: Sun, 20 Jul 2014 11:58:25 +0000

I’m fine with the baseline (MUST) proposed by Justin.

We can keep the ECDSA option as a recommendation (as another SHOULD or MAY) if some implementations are expected to move to it over time.

From: Justin Uberti [mailto:[email-masked]]
Sent: Saturday, July 19, 2014 8:50 PM
To: Shijun Sun
Cc: Michael Tuexen; Eric Rescorla; [email-masked]
Subject: Re: [rtcweb] DTLS version

I was thinking the baseline cipher suite would be TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (note RSA instead of ECDSA), as the best choice that maintains 1.0 compatibility.

I think we could also have a SHOULD for TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 as the preferred TLS 1.2 ciphersuite.

On Mon, Jul 7, 2014 at 5:29 PM, Shijun Sun <[email-masked]<mailto:[email-masked]>> wrote:
There seems a preference on supporting DTLS 1.0 due to the widespread adoption.  There is also a desire of supporting ECDHE when ECC is on a Standards Track.  Hope we could reach a consensus in Toronto.

Thoughts?

Best, Shijun

-----Original Message-----
From: rtcweb [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Michael Tuexen
Sent: Friday, July 4, 2014 2:28 PM
To: Eric Rescorla
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [rtcweb] DTLS version
On 04 Jul 2014, at 23:19, Eric Rescorla <[email-masked]<mailto:[email-masked]>> wrote:

>
>
>
> On Fri, Jul 4, 2014 at 2:11 PM, Michael Tuexen <[email-masked]<mailto:[email-masked]>> wrote:
> On 04 Jul 2014, at 21:48, Eric Rescorla <[email-masked]<mailto:[email-masked]>> wrote:
>

Best regards
Michael
> > On Fri, Jul 4, 2014 at 3:23 AM, DRAGE, Keith (Keith) <[email-masked]<mailto:[email-masked]>> wrote:
> > > From: rtcweb [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Harald
> > > Alvestrand
> > > Sent: 04 July 2014 09:07
> > > To: [email-masked]<mailto:[email-masked]>
> > > > <[email-masked]<mailto:[email-masked]>> wrote:
> > > > [email-masked]<mailto:[email-masked]>
> > > [email-masked]<mailto:[email-masked]>
> > [email-masked]<mailto:[email-masked]>
> > [email-masked]<mailto:[email-masked]>

_______________________________________________
rtcweb mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/rtcweb

_______________________________________________
rtcweb mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/rtcweb