Updates to the Cipher Suites in Secure Syslog
Internet-Draft draft-ietf-xml2rfc-template-06
Chris Lonvick
lonvick.ietf@gmail.com
Sean Turner
sn3rd
sean@sn3rd.com
Joe Salowey
Salesforce
joe@salowey.net
2022
General
Internet Engineering Task Force
syslog
secure syslog
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
DTLS
TLS
cipher suite
This document updates the cipher suites in RFC 5425, Transport Layer Security (TLS) Transport Mapping for Syslog, and RFC 6012, Datagram Transport Layer Security (DTLS) Transport Mapping for Syslog. It also updates the transport protocol in RFC 6012.
Introduction
The Syslog Working Group produced Transport Layer Security (TLS) Transport Mapping for Syslog and Datagram Transport Layer Security (DTLS) Transport Mapping for Syslog.
Both [RFC5425] and [RFC6012] MUST support certificates as defined in [RFC5280].
[RFC5425] requires that implementations "MUST" support TLS 1.2 [RFC5246] and are "REQUIRED" to support the mandatory to implement cipher suite TLS_RSA_WITH_AES_128_CBC_SHA (Section 4.2).
[RFC6012] requires that implementations "MUST" support DTLS 1.0 [RFC4347] and are also "REQUIRED" to support the mandatory to implement cipher suite TLS_RSA_WITH_AES_128_CBC_SHA (Section 5.2).
The TLS_RSA_WITH_AES_128_CBC_SHA cipher suite has been found to be weak and the community is moving away from it and towards more robust suites.
The DTLS 1.0 transport [RFC4347] has been deprecated by [BCP195] and the community is moving to DTLS 1.2 [RFC6347] and DTLS 1.3 [I-D.ietf-tls-dtls13].
This document updates [RFC5425] and [RFC6012] to deprecate the use of TLS_RSA_WITH_AES_128_CBC_SHA and to make new recommendations to a mandatory to implement cipher suite to be used for implementations.
This document also updates [RFC6012] to make a recommendation of a mandatory to implement secure datagram transport.

Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [[RFC2119]] [[RFC8174]] when, and only when, they appear in all capitals, as shown here.

Support for Updating
[I-D.salowey-tls-rfc8447bis] generally reminds us that cryptographic algorithms and parameters will be broken or weakened over time. Blindly implementing the cryptographic algorithms listed in any specification is not advised. Implementers and users need to check that the cryptographic algorithms specified continue to provide the expected level of security.
As the Syslog Working Group determined, Syslog clients and servers MUST use certificates as defined in [RFC5280]. Since both [RFC5425] and [RFC6012] REQUIRE the use of TLS_RSA_WITH_AES_128_CBC_SHA, it is very likely that RSA certificates have been implemented in devices adhering to those specifications. [BCP195] notes that ECDHE cipher suites exist for both RSA and ECDSA certificates, so moving to an ECDHE cipher suite will not require replacing or moving away from any currently installed RSA-based certificates.
[I-D.saviram-tls-deprecate-obsolete-kex] documents that the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA has been found to be weak. As such, the community is moving away from that and other weak suites and towards more robust suites such as TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, which is also listed as a currently Recommended algorithm in [I-D.salowey-tls-rfc8447bis].
Along those lines, [I-D.ietf-uta-rfc7525bis] notes that TLS_RSA_WITH_AES_128_CBC_SHA does not provide forward secrecy, a feature that is highly desirable in securing event messages. That document also goes on to recommend TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 as a cipher suite that does provide forward secrecy.
Therefore, the mandatory to implement cipher suites listed in [RFC5425] and [RFC6012] must be updated so that implementations of secure syslog are still considered to provide an acceptable and expected level of security.
Additionally, [BCP195] [[RFC8996]] deprecates the use of DTLS 1.0 [RFC4347], which is the mandatory to implement transport protocol for [RFC6012]. Therefore, the transport protocol for [RFC6012] must be updated.

Updates to RFC 5425
Implementations of [RFC5425] MUST NOT offer TLS_RSA_WITH_AES_128_CBC_SHA. The mandatory to implement cipher suite is REQUIRED to be TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.
Implementations of [RFC5425] MUST continue to use TLS 1.2 [RFC5246] as the mandatory to implement transport protocol.
Implementations of [RFC5425] MAY use TLS 1.3 [RFC8446] as a transport as long as they support the currently recommended cipher suites.
EDITOR's NOTE: Need to address 0-RTT considerations.

Updates to RFC 6012
Implementations of [RFC6012] MUST NOT offer TLS_RSA_WITH_AES_128_CBC_SHA. The mandatory to implement cipher suite is REQUIRED to be TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.
As specified in [BCP195], implementations of [RFC6012] must not use DTLS 1.0 [RFC4347]. Implementations MUST use DTLS 1.2 [RFC6347].
DTLS 1.2 [RFC6347] implementations are REQUIRED to support the mandatory to implement cipher suite, which is TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.
Implementations of [RFC6012] MAY use DTLS 1.3 [I-D.ietf-tls-dtls13] as a transport as long as they support the currently recommended cipher suites.
EDITOR's NOTE: Need to address 0-RTT considerations.

Authors Notes
This section will be removed prior to publication.
This is version -00 for the UTA Working Group. The previous version was draft-ciphersuites-in-sec-syslog-01, which was an individual submission by the authors. Some feedback was received from the now-completed Syslog WG.
Members of IEC 62351 TC 57 WG15, who prompted this work, have proposed the following text to be inserted into their documents.
The selection of TLS connection parameters such as cipher suites, session resumption and renegotiation shall be reused from IEC 62351-3 specification. Note that port TCP/6514 is assigned by IANA to RFC 5425 (syslog-tls). The RFC requires the support of TLS1.2 and a SHA-1 based cipher suite, but does not mandate its use. The cipher does not align with IEC 62351-3 Ed.2 for profiling TLS. Nevertheless, RFC 5425 does not rule out to use stronger cipher suites. With this, clients and server supporting the selection of cipher suites stated in IEC 62351-3 Ed2 will not experience interoperability problems. Caution has to be taken in environments in which interworking with existing services utilizing syslog over TLS is intended. For these, the syslog server needs to be enabled to support the required cipher suites. This ensures connectivity with clients complying to this document and others complying to RFC 5425. Note that meanwhile the work on an update of RFC 5425 and RFC 6012 has started. It targets the adoption of stronger cipher suites for TLS and DTLS to protect syslog communication.
Comments on this text are welcome.
Acknowledgments
The authors would like to thank Arijit Kumar Bose, Steffen Fries and the members of IEC TC57 WG15 for their review, comments, and suggestions. The authors would also like to thank Tom Petch and Juergen Schoenwaelder for their comments and constructive feedback.
IANA Considerations
This document makes no requests to IANA.
Security Considerations
[BCP195] deprecates an insecure DTLS transport protocol from [RFC6012] and deprecates insecure cipher suits from [RFC5425] and [RFC6012]. This document specifies mandatory to implement cipher suites to those RFCs and the latest version of the DTLS protocol to [RFC6012].
References
Normative References
[RFC2119]

Key words for use in RFCs to Indicate Requirement Levels
S. Bradner
March 1997
BCP 14
RFC 2119
DOI 10.17487/RFC2119
[RFC8174]

Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words
B. Leiba
May 2017
BCP 14
RFC 8174
DOI 10.17487/RFC8174
[RFC5425]

Transport Layer Security (TLS) Transport Mapping for Syslog
F. Miao, Ed.
Y. Ma, Ed.
J. Salowey, Ed.
March 2009
RFC 5425
DOI 10.17487/RFC5425
[RFC5246]

The Transport Layer Security (TLS) Protocol Version 1.2
T. Dierks
E. Rescorla
August 2008
RFC 5246
DOI 10.17487/RFC5246
[RFC8446]

The Transport Layer Security (TLS) Protocol Version 1.3
E. Rescorla
August 2018
RFC 8446
DOI 10.17487/RFC8446
[RFC6347]

Datagram Transport Layer Security Version 1.2
E. Rescorla
N. Modadugu
January 2012
RFC 6347
DOI 10.17487/RFC6347
[RFC4347]

Datagram Transport Layer Security
E. Rescorla
N. Modadugu
April 2006
RFC 4347
DOI 10.17487/RFC4347
[RFC6012]

Datagram Transport Layer Security (DTLS) Transport Mapping for Syslog
J. Salowey
T. Petch
R. Gerhards
H. Feng
October 2010
RFC 6012
DOI 10.17487/RFC6012
[RFC5280]

Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
D. Cooper
S. Santesson
S. Farrell
S. Boeyen
R. Housley
W. Polk
May 2008
RFC 5280
DOI 10.17487/RFC5280
[RFC7525]

Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)
Y. Sheffer
R. Holz
P. Saint-Andre
May 2015
BCP 195
RFC 7525
DOI 10.17487/RFC7525
[RFC8996]

Deprecating TLS 1.0 and TLS 1.1
K. Moriarty
S. Farrell
March 2021
BCP 195
RFC 8996
DOI 10.17487/RFC8996
Informative References
[I-D.salowey-tls-rfc8447bis]

IANA Registry Updates for TLS and DTLS
J. Salowey
S. Turner
2 December 2021
Internet-Draft draft-salowey-tls-rfc8447bis-01
[I-D.saviram-tls-deprecate-obsolete-kex]

Deprecating Obsolete Key Exchange Methods in TLS
N. Aviram
9 July 2021
Internet-Draft draft-aviram-tls-deprecate-obsolete-kex-00
[I-D.ietf-uta-rfc7525bis]

Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)
Y. Sheffer
R. Holz
P. Saint-Andre
T. Fossati
2 December 2021
Internet-Draft draft-ietf-uta-rfc7525bis-04
[I-D.ietf-tls-dtls13]

The Datagram Transport Layer Security (DTLS) Protocol Version 1.3
E. Rescorla
H. Tschofenig
N. Modadugu
30 April 2021
Internet-Draft draft-ietf-tls-dtls13