Subject: [TLS] Registry for ALPN

From: Martin Thomson <[email-masked]>
Date: Mon, 26 Aug 2013 12:55:08 -0700

draft-ietf-tls-applayerprotoneg-01 describes a registry for new
strings, but it does not describe what rules that registry operates
under, nor does it describe what information a registration is
expected to contain.

I'm going to suggest that "Expert Review" [RFC5226] is sufficient for
this registry.  Here's what I propose the document describe.

OLD:
   This document also requires the IANA to create a registry of
   Application Layer Protocol Negotiation protocol byte strings,
   initially containing the following entries:

   [... registrations ...]

   We propose that this new registry be created in a new page entitled:
   "Application Layer Protocol Negotiation (ALPN) Protocol IDs" beneath
   the existing heading of "Transport Layer Security (TLS)".

NEW:
  This document establishes a registry for protocol identifiers entitled
   "Application Layer Protocol Negotiation (ALPN) Protocol IDs" under the
   existing "Transport Layer Security (TLS)" heading.

   Entries in this registry require the following fields:

    Protocol: The name of the protocol.
    Identification Sequence: The precise set of octet values that identifies
       the protocol.  This could be the UTF-8 encoding [RFC3269] of the
       protocol name.
    Specification: A reference to a specification that defines the protocol.

   This registry operates under the "Expert Review" policy as defined
   in [RFC5226].  The designated expert is advised to encourage the
   inclusion of a reference to a permanent and readily available
   specification that enables the creation of interoperable
   implementations of the identified protocol.

   An initial set of registrations for this registry follow:

    Protocol: HTTP/1.1
    Identification Sequence:
       0x68 0x74 0x74 0x70 0x2f 0x31 0x2e 0x31 ("http/1.1")
    Specification: RFC 2616

    Protocol: SPDY/1
    Identification Sequence:
       0x68 0x74 0x74 0x70 0x2f 0x31 0x2e 0x31 ("http/1.1")
   Specification:
       http://dev.chromium.org/spdy/spdy-protocol/spdy-protocol-draft1

etc...

---

From: "Stephan Friedl (sfriedl)" <[email-masked]>
Date: Mon, 26 Aug 2013 20:08:22 +0000

Martin,

Did you intend to have 'http/1.1" as the identification sequence for spdy, or is that a typo?

Off the cuff, the changes look very reasonable, certainly much more precise than the current wording.  I'm not familiar enough with RFC5526 to have an opinion on that right now, I'll read the RFC for implications - though I'd expect review will be a good thing.

With regard to the 'exp' prefix for experimental protocols, as nobody else responded that they really wanted the prefix any longer, I'd suggest that we drop the 'exp' prefix and replace the sentence calling out the experimental namespace with a statement directing protocol developers to reference RFC6648 in the event they feel the need for an 'experimental or private' protocol identifier.  Even RFC6648 recognizes that occasionally there will be such a need and has some suggestions on forming such identifiers.

Does that sound reasonable?

Thanks,

Stephan

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Martin Thomson
Sent: Monday, August 26, 2013 1:55 PM
To: [email-masked]
Subject: [TLS] Registry for ALPN

draft-ietf-tls-applayerprotoneg-01 describes a registry for new strings, but it does not describe what rules that registry operates under, nor does it describe what information a registration is expected to contain.

I'm going to suggest that "Expert Review" [RFC5226] is sufficient for this registry.  Here's what I propose the document describe.

OLD:

   [... registrations ...]

NEW:

    Protocol: HTTP/1.1
    Identification Sequence:

    Protocol: SPDY/1
    Identification Sequence:

etc...
_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: Yoav Nir <[email-masked]>
Date: Mon, 26 Aug 2013 20:15:28 +0000

Hi Martin

Any reason for "expert review" rather than "first come first serve"? 

What meaningful input can a designated expert have on someone asking for a string for their proprietary protocol?

Yoav

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 26 Aug 2013 13:56:48 -0700

> this registry.  Here's what I propose the document describe.

+1. And +1 to Martin's specific text changes.

> What meaningful input can a designated expert have on someone asking for a string for their proprietary protocol?

In the past, we have seen individuals *not* associated with a particular protocol try to register strings in IANA and do harm. For example, they might register a string that is similar to, but different from, the string used in the code that people were running. Another is that someone might try to squat on strings that would otherwise be useful.

An expert reviewer can often see problems like this and prevent them from happening.

--Paul Hoffman

---

From: Martin Thomson <[email-masked]>
Date: Mon, 26 Aug 2013 15:38:39 -0700

On 26 August 2013 13:08, Stephan Friedl (sfriedl) <[email-masked]> wrote:
> I'd suggest that we drop the 'exp' prefix and replace the sentence calling out the experimental namespace with a statement directing protocol developers to reference RFC6648 in the event they feel the need for an 'experimental or private' protocol identifier.

In practice, what people do is very simple.  They make up a new string
and start using it.  Then, sometimes, they get around to telling IANA
about it.  It sounds kinda bad, but it does tend to work out.

I can't see a way to add text to that effect that wouldn't also invite
confusion.

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 26 Aug 2013 16:46:59 -0600

> I can't see a way to add text to that effect that wouldn't also invite

Tell people to mint their own names. RFC 6648 suggests ways to do that.
There's no need for yet another form of "X-".

http://tools.ietf.org/html/rfc6648

Peter

-- 
Peter Saint-Andre
https://stpeter.im/