Replace reference to obsolete RFC7525 with BCP195

[Joseph Heenan]

In the TLS section FAPI2SP references RFC7525, which is now obsolete.

I think we should reference https://www.rfc-editor.org/info/bcp195 directly instead.

[Nat Sakimura]

Agreed on the Call 2023-09-13.

[Daniel Fett]

This turned out to be harder than expected:

• A BCP has no (fixed) title
• It has no (fixed) set of authors
• It has no publication date (and we want to explicitly avoid adding one as we want this to be the latest RFC in that series; however, we need a date for the list of references)

It seems that referencing a BCP without also referring to the latest RFC in that series is not really something people do.

‌

Also, RFCs in that BCP series do not all serve the same purpose. While RFC 9325 has normative language on cipher suites, RFC 8996 does not. The former updates RFC7525, the latter does not.

‌

So I suggest that we find some language saying that you should use cipher suites from RFC 9325 or a later publication in the BCP 195 series if we think that that is what we want. If we want a stable spec, we should just go for RFC 9325.

Let’s discuss.

‌

[Joseph Heenan]

I don’t like the “just go for RFC 9325” option.

Given it will be painful to ever update the spec once we get to final my preference is finding some wording so that when BCP 195 series say “stop using TLS 1.3” that automatically becomes the FAPI2 position without us needing to update anything. I appreciate that’s not particular straightforward though…

[Daniel Fett]

Consensus in the call today was to find wording working around the technical limitations of references.

[Dave Tonge]

Joseph mentioned that in one of the verifiable credentials specs this was also an issue

[Joseph Heenan]

This is how Kristina managed to do it in the VCI spec: 

https://github.com/openid/OpenID4VCI/commit/1a21933413e19a153bf60eb1634ce6b0583f57d8

[Joseph Heenan]

PR: https://bitbucket.org/openid/fapi/pull-requests/450

[Dave Tonge]

PR merged