Subject: draft-williams-on-channel-binding: IANA rules too complicated

From: Sam Hartman <[email-masked]>
Date: Thu, 05 Jul 2007 13:53:14 -0400

Hi, folks.  During IETF last call for Nico's channel binding draft, we
added an IANA registry based on community feedback.  ALexey's proposed
registration rules involved an expert and a review list similar to how
we handle MIME types or language tags.

The IESG would like to push back on that registration process.  We
feel that in this instance, simple expert review is sufficient, and we
don't need registrations to go to a review list.

Unless there is strong support for the more complex registration
process in the draft, we'd like to go to expert review.

Sam Hartman
Security Area Director

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 05 Jul 2007 20:33:59 +0100

>don't need registrations to go to a review list.
Sam, this is fine with me. In my initial proposal I was merely 
suggesting one way to do an IANA registry.

---

From: Jeffrey Altman <[email-masked]>
Date: Fri, 06 Jul 2007 07:02:30 -0400

> process in the draft, we'd like to go to expert review.

The technical argument in favor of a review list, whether a special
list for this purpose or some pre-existing list such as SecDir, is that
it is not always easy to find experts who are familiar with both of the
protocols being bound.  As a result, having more reviewers is a safety
net.  This is especially important for reviews of security protocols.

I do not believe that the registration process defined in this draft is
particularly burdensome.  It is a well defined process with time limits
that will provide a predictable response time for requesters.  It
doesn't limit the Area Director's ability to select an expert to perform
the review.  It simply provides for transparency and public comment on
the registration.

I believe the registration procedure should be implemented as described
in the draft.

Jeffrey Altman

---

From: Simon Josefsson <[email-masked]>
Date: Fri, 06 Jul 2007 13:24:22 +0200

> net.  This is especially important for reviews of security protocols.

Another reason is accountability: the registration applications and
responses could be archived in a mailing list archive.  That is helpful
for future expert reviewers, to be able to review past behaviour and
considerations when dealing with new situations.

> I believe the registration procedure should be implemented as described

I agree.

Btw, I couldn't find any checks to make sure that the name prefixes of
channel bindings turn out to be unique?  To solve it, always adding (for
example) a ':' between the IANA allocated and the actual channel binding
value would be useful.  Consider if 'TLS1' and 'TLS1.2' are registered.
Consider a channel binding value for 'TLS1' that, through some encoding,
starts with '.2', thereby forming 'TLS1.2' at the beginning.  Maybe this
problem is already solved, although I have missed it.  Any pointers to
particular sections?

/Simon

---

From: Sam Hartman <[email-masked]>
Date: Fri, 06 Jul 2007 08:04:06 -0400

>>>>> "Jeffrey" == Jeffrey Altman <[email-masked]> writes:

    Jeffrey> Sam Hartman wrote:
    >> Unless there is strong support for the more complex
    >> registration process in the draft, we'd like to go to expert
    >> review.

    Jeffrey> The technical argument in favor of a review list, whether
    Jeffrey> a special list for this purpose or some pre-existing list
    Jeffrey> such as SecDir, is that it is not always easy to find
    Jeffrey> experts who are familiar with both of the protocols being
    Jeffrey> bound.  As a result, having more reviewers is a safety
    Jeffrey> net.  This is especially important for reviews of
    Jeffrey> security protocols.

How would you feel about an optional review list?

IESG experience has shown that mandatory review steps in previous
registries tend to add frustration.  There are cases where optional
review lists do add value.

--Sam

---

From: Jeffrey Altman <[email-masked]>
Date: Fri, 06 Jul 2007 08:14:35 -0400

> review lists do add value.
I'm not sure what the issue is here.  The requirement that the draft
makes is that there be a list and that after posting to the list that
the assigned expert wait two weeks for any reviews that might be
received before making a decision.   I do not believe that a two week
review period is burdensome nor do I believe that having a public list
that interested parties can monitor is a bad thing.

Perhaps if you described the problems the IESG believes might occur with
this process I might feel differently.

Jeffrey Altman

---

From: Kurt Zeilenga <[email-masked]>
Date: Fri, 6 Jul 2007 07:18:40 -0700

> net.  This is especially important for reviews of security protocols.

What's the scope of this review?   Are we asking the expert/list to  
merely
review the appropriateness of the registration request, or are we  
asking the
expert/list to review, in addition to the appropriateness of the  
registration
request, the merit of the technical specifications that rely on the  
requested
value?

It seems to me that we can limit the scope of the review to the  
former (as
suggested by the I-D), and then Expert Review is more than  
adequate.   If others
prefer the latter, then you'd need to Require Specification (and  
change the
wording of the I-D).

-- Kurt

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 6 Jul 2007 15:58:13 -0500

Personally I'm in favor of whatever registration rules the IESG thinks
would be best.  I'd like specs to be published, of course, and I'd like
expert review, but I don't want us to depart from standard registration
review rules if that is at all controversial.