Subject: [secdir] Secdir review of draft-ietf-uta-tls-for-email-03

From: Radia Perlman <[email-masked]>
Date: Thu, 30 Jan 2020 08:30:15 -0800

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments just
like any other last call comments.

This is an utterly trivial and non-controversial update to RFC8314 changing
references to TLS v1.1 to TLSv1.2 as the minimum acceptable version of TLS
to use for this purpose.

While there is nothing to debate with respect to security, I do question
whether it's better to release a document like this which specifies changes
to RFC8314 or whether it would be better to update (and obsolete) that
document so that this one would stand alone. Better yet would be to come up
with a replacement version of RFC8314 that would not need to be updated
again when TLSv1.2 needs to be replaced with TLSv1.3. Introducing new
versions of TLS and obsoleting old ones should happen without having to
update the - likely hundreds of - RFCs that refer to TLS.

Radia

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 30 Jan 2020 16:41:48 +0000

Hi Radia,

Thanks for the review.

> update the - likely hundreds of - RFCs that refer to TLS.

I wish! Take a peek at the header of [1] for example:-)

Avoiding those issues in future was part of the logic
behind BCP195/RFC7525 [2] so if in future consumers of
TLS refer to BCP195, then we'll be in a good position
as BCP195 can just be updated to point to whatever RFC
has the current guidance for TLS1.3 and the RFCs that
refer to BCP195 won't need to change. That is happening
already to some extent, and the more the better I'd
say (hence this mail:-).

In the meantime, I think we gotta do this kind of
deprecation draft, even if it's a small pain in this
case (and a big pain for [1]).

Cheers,
S.

[1] https://tools.ietf.org/html/draft-ietf-tls-oldversions-deprecate-06
[2] https://tools.ietf.org/html/rfc7525