Re: [cti-taxii] HTTPS

["Jason Keirstead" <Jason.Keirstead@ca.ibm.com>]

Just want to play devils advocate - one problem with having things like "MUST support TLS 1.2" in a standard vs. leaving it more open-ended, is what happens if/when TLS 1.2 has a gaping hole discovered in 6 months... we now have a standard mandating that people implement an insecure protocol, until we revise the standard.


-
Jason Keirstead
Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown


Eric Burger ---12/16/2015 10:55:52 AM---I strongly support mandating TLS 1.2. It is supported by all the open source servers and clients, so

From: Eric Burger <Eric.Burger@georgetown.edu>
To: "cti-taxii@lists.oasis-open.org" <cti-taxii@lists.oasis-open.org>
Date: 12/16/2015 10:55 AM
Subject: Re: [cti-taxii] HTTPS
Sent by: <cti-taxii@lists.oasis-open.org>

---

I strongly support mandating TLS 1.2. It is supported by all the open source servers and clients, so there is lots of code to reuse, steal, or just run out-of-the-box.

One word of warning: specifying HTTPS requires a bit more work than just saying “MUST implement TLS 1.2.” We need to specify what servers and clients should expect in the Subject field, any limitations or MTI’s for cypher suites, etc. For example, for the open server TAXII case, I would say we would still require HTTPS, but allow the NULL cypher suite. That gets us some level of client and identity, as well as GZIP for free (well, paid for). That will also eliminate the mistaken thought that we need to allow HTTP access for open servers. Other things to specify is either requirements or implementation suggestions for what to do with self-signed certificates, etc.

I know, “send text.” I may get to it over the break if someone does not jump in before me.

On Dec 16, 2015, at 5:48 AM, Adam Cooper <adam.cooper@digital.cabinet-office.gov.uk> wrote:

I would advise specifying TLS v 1.2 or higher rather than 1.1.

There seems no reason not to go for v1.2.


On 16 December 2015 at 10:24, Jerome Athias <athiasjerome@gmail.com> wrote:
TAXII systems MUST use TLS version 1.1 [RFC4346] or higher for
confidentiality, identification, and authentication, when sending
TAXII messages over HTTPS. HTTPS is specified in Section 2 of
[RFC2818].

NB: stolen from https://www.rfc-editor.org/rfc/rfc6546.txt

2015-12-15 21:40 GMT+03:00 Jordan, Bret <bret.jordan@bluecoat.com>:
> Please propose some updated verbiage...
>
>
> Thanks,
>
> Bret
>
>
>
> Bret Jordan CISSP
> Director of Security Architecture and Standards | Office of the CTO
> Blue Coat Systems
> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050
> "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can
> not be unscrambled is an egg."
>
> On Dec 15, 2015, at 11:35, Jerome Athias <athiasjerome@GMAIL.COM> wrote:
>
> Hi,
>
> Thanks for asking.
> Yes I think we should specify/highly recommend TLS
>
> My favorite resource:
> https://www.feistyduck.com/books/bulletproof-ssl-and-tls/
>
> Cheers
>
> On Tuesday, 15 December 2015, Jordan, Bret <bret.jordan@bluecoat.com> wrote:
>>
>> All,
>>
>> Currently in the pre-draft document we have the following verbiage.
>>
>> This specification defines requirements for using HTTPS; this
>> specification does not define requirements for using non-encrypted HTTP. All
>> TAXII compliant communications and interactions in TAXII 2 MUST use HTTPS.
>>
>>
>> Question:
>> Do we need to add anything extra about specific types of HTTPS, TLS
>> version, etc?
>>
>>
>> Thanks,
>>
>> Bret
>>
>>
>>
>> Bret Jordan CISSP
>> Director of Security Architecture and Standards | Office of the CTO
>> Blue Coat Systems
>> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050
>> "Without cryptography vihv vivc ce xhrnrw, however, the only thing that
>> can not be unscrambled is an egg."
>>
>

---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail. Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php




--
Adam Cooper
Identity Assurance Programme
Government Digital Service
125 Kingsway, London, WC2B 6NH

Tel: 07973 123 038
official: adam.cooper@digital.cabinet-office.gov.uk
official sensitive: adam.cooper@govdigital.gsi.gov.uk