Re: [cti-taxii] HTTPS

[Eric Burger <Eric.Burger@georgetown.edu>]

I strongly support mandating TLS 1.2. It is supported by all the open source servers and clients, so there is lots of code to reuse, steal, or just run out-of-the-box.

One word of warning: specifying HTTPS requires a bit more work than just saying “MUST implement TLS 1.2.” We need to specify what servers and clients should expect in the Subject field, any limitations or MTI’s for cypher suites, etc. For example, for the open server TAXII case, I would say we would still require HTTPS, but allow the NULL cypher suite. That gets us some level of client and identity, as well as GZIP for free (well, paid for). That will also eliminate the mistaken thought that we need to allow HTTP access for open servers. Other things to specify is either requirements or implementation suggestions for what to do with self-signed certificates, etc.

I know, “send text.” I may get to it over the break if someone does not jump in before me.

On Dec 16, 2015, at 5:48 AM, Adam Cooper <adam.cooper@digital.cabinet-office.gov.uk> wrote:

I would advise specifying TLS v 1.2 or higher rather than 1.1.

There seems no reason not to go for v1.2.

On 16 December 2015 at 10:24, Jerome Athias <athiasjerome@gmail.com> wrote:

TAXII systems MUST use TLS version 1.1 [RFC4346] or higher for
confidentiality, identification, and authentication, when sending
TAXII messages over HTTPS.  HTTPS is specified in Section 2 of
[RFC2818].

NB: stolen from https://www.rfc-editor.org/rfc/rfc6546.txt

2015-12-15 21:40 GMT+03:00 Jordan, Bret <bret.jordan@bluecoat.com>:
> Please propose some updated verbiage...
>
>
> Thanks,
>
> Bret
>
>
>
> Bret Jordan CISSP
> Director of Security Architecture and Standards | Office of the CTO
> Blue Coat Systems
> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
> "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can
> not be unscrambled is an egg."
>
> On Dec 15, 2015, at 11:35, Jerome Athias <athiasjerome@GMAIL.COM> wrote:
>
> Hi,
>
> Thanks for asking.
> Yes I think we should specify/highly recommend TLS
>
> My favorite resource:
> https://www.feistyduck.com/books/bulletproof-ssl-and-tls/
>
> Cheers
>
> On Tuesday, 15 December 2015, Jordan, Bret <bret.jordan@bluecoat.com> wrote:
>>
>> All,
>>
>> Currently in the pre-draft document we have the following verbiage.
>>
>> This specification defines requirements for using HTTPS; this
>> specification does not define requirements for using non-encrypted HTTP. All
>> TAXII compliant communications and interactions in TAXII 2 MUST use HTTPS.
>>
>>
>> Question:
>> Do we need to add anything extra about specific types of HTTPS, TLS
>> version, etc?
>>
>>
>> Thanks,
>>
>> Bret
>>
>>
>>
>> Bret Jordan CISSP
>> Director of Security Architecture and Standards | Office of the CTO
>> Blue Coat Systems
>> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
>> "Without cryptography vihv vivc ce xhrnrw, however, the only thing that
>> can not be unscrambled is an egg."
>>
>

---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail.  Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php

--

Adam Cooper

Identity Assurance Programme

Government Digital Service

125 Kingsway, London, WC2B 6NH

Tel: 07973 123 038

official: adam.cooper@digital.cabinet-office.gov.uk

official sensitive: adam.cooper@govdigital.gsi.gov.uk

Attachment: smime.p7s
Description: S/MIME cryptographic signature