Re: Comments on Mandatory Ciphers and a Proposal

[Christopher Allen <ChristopherA-Lists@xxxxxxxxxxxxx>]

At 4:15 PM -0700 7/24/97, Keith Moore wrote:
>If a application uses TLS, the specification for that application
>needs to specify which ciphersuites an implementation must support.
>But a different application could choose a different set of
>ciphersuites.  We don't expect an SMTP client be able to talk to a POP
>server.  Neither is there a requirement that an SMTP+TLS client be
>able to talk to a POP+TLS server.

Given this, you seem to be agreeing that TLS should not be mandating
ciphersuites, that instead the POP (or SMTP, or HTTP) working groups
should. That was the rough consensus that was presented to the IESG by the
working group. That is why we are arguing now for SHOULDs for generic TLS.