TLS 1.3 (HTTPS-24)

[dlemire60]

TLS 1.3 (HTTPS-24)

[dlemire60]

Addressed in PR #53.

[jmbrule]

Agree with 'SHOULD' use 1.3 but 'REQUIRED' precludes TLS 1.2 and may inhibit backward compatibility. It is conceded that there are currently no openc2 instances operating today, however existing products may implement in the future. In the interest of backward compatibility and minimizing constraints, suggest SHOULD vice REQUIRED

[dlemire60]

This was discussed at the 19 Dec 2018 IC-SC meeting (attendees were Lemire, Brule, Considine, Kemp, Martinez, Sparrell). Consensus of the meeting was supportive of requiring TLS 1.3 and precluding prior versions of TLS / SSL. Supporting rationales included:

• No known use cases requiring earlier TLS / SSL versions
• Vendors will build to lowest acceptable requirement
• Implementations will likely have a long enough marketplace lifetime that setting a strong minimum requirement is appropriate
• Interoperability is better served by limiting options

[dlemire60]

This was discussed at the January 2019 F2F and the PR language was presented. Several participants asserted that they already have OpenC2 implementations that are using TLS v1.2. Some also indicated they had had significant difficulty getting customers to move to TLS v1.2 from previous versions. General consensus was to keep the existing language.

After hearing the discussion, the original commenter (Duncan Sparrell) withdrew the comment.

[dlemire60]

This comment has been withdrawn. No changes to the HTTPS specification. Closing this issue.