Repository navigation
No mention of NIST SP 800-52r1 #86
Description
NIST SP 800-52r1 (http://dx.doi.org/10.6028/NIST.SP.800-52r1) is normative for TLS usage, but is not mentioned here. While it specifies that TLS 1.2 be preferentially used (along with quite a few other requirements), it does not make TLS 1.2 mandatory (and should) and as well unfortunately requires the use of several non-PFS ciphers (and should not).
Perhaps some of the guidance from NIST SP-80052r1 could be distilled here.
Activity
dnesting commentedon Mar 19, 2015
Additionally, possibly we can chat with the NIST folks about updating their recommendations. They appear to take feedback at SP80052-comments@nist.gov. NIST recommendations are not binding, but FISMA is. Both this NIST publication and this HTTPS-only proposal are intended (or at least expected) to simplify FISMA compliance. I agree that it seems useful to ensure we're both on the same page and that we reconcile any differences rather than compete.
NoahKunin commentedon Mar 20, 2015
Both are excellent points. Cross agency review is always a part of policies like this reaching their final release, and certainly NIST would be included here too.
One point of clarification, my understanding has always been that while the Special Publications (SPs) are not binding, Federal Information Processing Standards (FIPS) are.