Subject: [Ace] Mirja Kühlewind's No Objection on draft-ietf-ace-cwt-proof-of-possession-09: (with COMMENT)

From: Mirja Kühlewind via Datatracker <[email-masked]>
Date: Fri, 25 Oct 2019 09:01:01 -0700

Mirja Kühlewind has entered the following ballot position for
draft-ietf-ace-cwt-proof-of-possession-09: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ace-cwt-proof-of-possession/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I would like to discuss one point with the IESG, however, not raising my ballot
to "discuss" as I believe we can conclude quickly and this is not a major
problem anyway.

So it seems to become more common to not only have expert review but also post
a registration request on a public list and wait for a couple of weeks for
comments. While I myself am uncertain if that is a good or bad practice (maybe
also depends on the protocol), I would like to discuss this part in the IANA
section:

   Registration requests sent to the mailing list for review should use
   an appropriate subject (e.g., "Request to Register CWT Confirmation
   Method: example").  Registration requests that are undetermined for a
   period longer than 21 days can be brought to the IESG's attention
   (using the [email-masked] mailing list) for resolution.

I would think that, no matter what, registration request should be directed at
IANA (and they would then post or forward to a mailing list and/or experts; or
alternatively the experts can post than on the mailing list). I guess IANA
would need to provide feedback here on what they prefer. However, for raising
problems, of course everybody can always bring any problem to the IESG, but I
think the first point of contact should also be IANA here. And then if no
resolution can be find quickly for whatever reason, I would think that it's
rather IANA that will bring this to the IESG (than the requesters directly).

---

From: Barry Leiba <[email-masked]>
Date: Fri, 25 Oct 2019 12:31:42 -0400

Yeh, it's very common for authors to try to tell IANA how to handle
registrations, and I often push back on that as inappropriate.  There
are certainly special conditions that IANA should be told about, but
this is standard work-flow management stuff that ought to be left to
IANA.  I do think it should be changed before this is published,
probably just removing that last sentence.

b

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 28 Oct 2019 08:31:50 -0700

> probably just removing that last sentence.

While I'm not opposed to normalizing on a default procedure, I think the
authors were just trying to follow existing examples.

RFC 7519:

   Values are registered on a Specification Required [RFC5226] basis
   after a three-week review period on the [email-masked]
   mailing list, on the advice of one or more Designated Experts.
   However, to allow for the allocation of values prior to publication,
   the Designated Experts may approve registration once they are
   satisfied that such a specification will be published.

   Registration requests sent to the mailing list for review should use
   an appropriate subject (e.g., "Request to register claim: example").

   Within the review period, the Designated Experts will either approve
   or deny the registration request, communicating this decision to the
   review list and IANA.  Denials should include an explanation and, if
   applicable, suggestions as to how to make the request successful.
   Registration requests that are undetermined for a period longer than
   21 days can be brought to the IESG's attention (using the
   [email-masked] mailing list) for resolution.

RFC 8414:

   Values are registered on a Specification Required [RFC8126] basis
   after a two-week review period on the [email-masked]
   mailing list, on the advice of one or more Designated Experts.
   However, to allow for the allocation of values prior to publication,
   the Designated Experts may approve registration once they are
   satisfied that such a specification will be published.

   Registration requests sent to the mailing list for review should use
   an appropriate subject (e.g., "Request to register OAuth
   Authorization Server Metadata: example").

   Within the review period, the Designated Experts will either approve
   or deny the registration request, communicating this decision to the
   review list and IANA.  Denials should include an explanation and, if
   applicable, suggestions as to how to make the request successful.
   Registration requests that are undetermined for a period longer than
   21 days can be brought to the IESG's attention (using the
   [email-masked] mailing list) for resolution.

RFC 8447:

   Specification Required [RFC8126] registry requests are registered
   after a three-week review period on the <[email-masked]>
   mailing list, on the advice of one or more designated experts.
   However, to allow for the allocation of values prior to publication,
   the designated experts may approve registration once they are
   satisfied that such a specification will be published.

   Registration requests sent to the mailing list for review SHOULD use
   an appropriate subject (e.g., "Request to register value in TLS bar
   registry").

   Within the review period, the designated experts will either approve
   or deny the registration request, communicating this decision to the
   review list and IANA.  Denials SHOULD include an explanation and, if
   applicable, suggestions as to how to make the request successful.
   Registration requests that are undetermined for a period longer than
   21 days can be brought to the IESG's attention (using the
   <[email-masked]> mailing list) for resolution.

[I stopped looking here]

So if we're going to change things around, maybe we should issue an IESG
statement.

-Ben

---

From: Mirja Kuehlewind <[email-masked]>
Date: Mon, 28 Oct 2019 16:54:15 +0100

These are all quite recents examples, so maybe the procedures are changing at the moment. I guess we as the IESG should be aware and figure out what the right procedure actually should be here.

> On 28. Oct 2019, at 16:31, Benjamin Kaduk <[email-masked]> wrote:
>

---

From: Mike Jones <[email-masked]>
Date: Mon, 28 Oct 2019 16:19:05 +0000

The practice of using a mailing list for registration requests to enable public visibility of them goes back at least to .well-known URI registrations https://tools.ietf.org/html/rfc5785 by Mark Nottingham in April 2010.  OAuth 2.0 followed this practice in RFC 6749, as did the JOSE specs and JWT in RFCs 7515-19.  The rest is history, as they say.

				-- Mike

-----Original Message-----
From: Mirja Kuehlewind <[email-masked]> 
Sent: Monday, October 28, 2019 8:54 AM
To: Benjamin Kaduk <[email-masked]>
Cc: Barry Leiba <[email-masked]>; Roman D. Danyliw <[email-masked]>; [email-masked]; The IESG <[email-masked]>; [email-masked]; [email-masked]
Subject: Re: [Ace] Mirja Kühlewind's No Objection on draft-ietf-ace-cwt-proof-of-possession-09: (with COMMENT)

> While I'm not opposed to normalizing on a default procedure, I think 
> the authors were just trying to follow existing examples.
> 
> RFC 7519:
> 
> So if we're going to change things around, maybe we should issue an 
> IESG statement.
> 
> -Ben
> 
>

---

From: Barry Leiba <[email-masked]>
Date: Mon, 28 Oct 2019 17:00:26 -0400

The issue isn't using a mailing list.  The issue is the instructions
to IANA about how to do management and tracking, stuff that they do
just fine without working groups trying -- will all good intentions --
to tell them how.

The fact that there are a lot of RFCs that do it just says that
working groups do this frequently, and most ADs don't notice or don't
care.  And the reality is that IANA will manage the registration
process how they do it, accommodating reasonable special instructions
when they can.  The point is that documents shouldn't be giving
special instructions unless there really is something special needed
for a particular reason.

Barry

---

From: Jim Schaad <[email-masked]>
Date: Mon, 28 Oct 2019 15:23:08 -0700

Given that the author is the same for RFC 7519, RFC 8414 and this document,
I don't know that this says much.   I believe that in part people are trying
to duplicate the behavior of registering media types and perhaps not doing a
good job.

Jim

-----Original Message-----
From: Ace <[email-masked]> On Behalf Of Benjamin Kaduk
Sent: Monday, October 28, 2019 8:32 AM
To: Barry Leiba <[email-masked]>
Cc: Roman D. Danyliw <[email-masked]>; [email-masked]; Mirja Kühlewind
<[email-masked]>; The IESG <[email-masked]>; [email-masked];
[email-masked]
Subject: Re: [Ace] Mirja Kühlewind's No Objection on
draft-ietf-ace-cwt-proof-of-possession-09: (with COMMENT)

RFC 7519:

RFC 8414:

RFC 8447:

[I stopped looking here]

-Ben

_______________________________________________
Ace mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ace

---

From: Mike Jones <[email-masked]>
Date: Thu, 31 Oct 2019 00:13:58 +0000

I'm in the process of creating -10, which addresses the IESG comments other than Mirja's.  I'm reluctant to change the registration instructions, as they are currently identical to those for CWTs (and many other specifications going back to at least RFC 6749, modulo the name of the mailing list).  That said, if the IESG *really* wants to change the party to appeal to in the case of non-action from the Designated Experts from the IESG to IANA, I'm amenable to also making that change tomorrow, immediately following the telechat, so we can send the spec on to the RFC Editor.  Let me know what you decide.

				Thanks again,
				-- Mike

-----Original Message-----
From: Barry Leiba <[email-masked]> 
Sent: Monday, October 28, 2019 2:00 PM
To: Mike Jones <[email-masked]>
Cc: Mirja Kuehlewind <[email-masked]>; Benjamin Kaduk <[email-masked]>; Roman D. Danyliw <[email-masked]>; [email-masked]; The IESG <[email-masked]>; [email-masked]; [email-masked]
Subject: Re: [Ace] Mirja Kühlewind's No Objection on draft-ietf-ace-cwt-proof-of-possession-09: (with COMMENT)

The issue isn't using a mailing list.  The issue is the instructions to IANA about how to do management and tracking, stuff that they do just fine without working groups trying -- will all good intentions -- to tell them how.

The fact that there are a lot of RFCs that do it just says that working groups do this frequently, and most ADs don't notice or don't care.  And the reality is that IANA will manage the registration process how they do it, accommodating reasonable special instructions when they can.  The point is that documents shouldn't be giving special instructions unless there really is something special needed for a particular reason.

Barry

On Mon, Oct 28, 2019 at 12:19 PM Mike Jones <[email-masked]> wrote:
>
> The practice of using a mailing list for registration requests to enable public visibility of them goes back at least to .well-known URI registrations https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Frfc5785&amp;data=02%7C01%7CMichael.Jones%40microsoft.com%7C085270914a0b42e5007908d75be9e2ea%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637078932422930532&amp;sdata=bwglng9A7A8OGaV4vicvLAAcd%2FqcK7Q%2Fv9cnywn8fDo%3D&amp;reserved=0 by Mark Nottingham in April 2010.  OAuth 2.0 followed this practice in RFC 6749, as did the JOSE specs and JWT in RFCs 7515-19.  The rest is history, as they say.
>
>                                 -- Mike
>
> Cc: Barry Leiba <[email-masked]>; Roman D. Danyliw 
> <[email-masked]>; [email-masked]; The IESG <[email-masked]>; 
> [email-masked]; [email-masked]
> >> registrations, and I often push back on that as inappropriate.  
> >> There are certainly special conditions that IANA should be told 
> >> about, but this is standard work-flow management stuff that ought 
> >> to be left to IANA.  I do think it should be changed before this is 
> >> published, probably just removing that last sentence.
> >

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 30 Oct 2019 17:28:55 -0700

Just to be clear, IANA raising the issue to the IESG is described in
Section 5.3 of RFC 8126, which would be the default expectations if an
individual document/registry did not give other instructions.

-Ben

---

From: Mike Jones <[email-masked]>
Date: Thu, 31 Oct 2019 00:47:57 +0000

Thanks for the clarification, Ben.  I'm fine with this going either way (appeal to IESG or appeal to IANA).  Just drop me a note after the issue is discussed on the telechat and I'll turn around a new draft right away tomorrow, if requested.

				Later,
				-- Mike

-----Original Message-----
From: Ace <[email-masked]> On Behalf Of Benjamin Kaduk
Sent: Wednesday, October 30, 2019 5:29 PM
To: Mike Jones <[email-masked]>
Cc: Roman D. Danyliw <[email-masked]>; [email-masked]; Mirja Kuehlewind <[email-masked]>; The IESG <[email-masked]>; [email-masked]; [email-masked]; Barry Leiba <[email-masked]>
Subject: Re: [Ace] Mirja Kühlewind's No Objection on draft-ietf-ace-cwt-proof-of-possession-09: (with COMMENT)

Just to be clear, IANA raising the issue to the IESG is described in Section 5.3 of RFC 8126, which would be the default expectations if an individual document/registry did not give other instructions.

-Ben

On Thu, Oct 31, 2019 at 12:13:58AM +0000, Mike Jones wrote:
> Cc: Mirja Kuehlewind <[email-masked]>; Benjamin Kaduk 
> <[email-masked]>; Roman D. Danyliw <[email-masked]>; [email-masked]; 
> The IESG <[email-masked]>; [email-masked]; 
> > The practice of using a mailing list for registration requests to enable public visibility of them goes back at least to .well-known URI registrations https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Frfc5785&amp;data=02%7C01%7CMichael.Jones%40microsoft.com%7C0b217822fdab454c213408d75d995cec%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637080785592172015&amp;sdata=dvBR4fRzp1xSMcqXyaSa68Px7AJs3alwwTPJVH4YyMA%3D&amp;reserved=0 by Mark Nottingham in April 2010.  OAuth 2.0 followed this practice in RFC 6749, as did the JOSE specs and JWT in RFCs 7515-19.  The rest is history, as they say.
> >
> >                                 -- Mike
> >
> > >> Yeh, it's very common for authors to try to tell IANA how to 
> > >> handle registrations, and I often push back on that as inappropriate.
> > >> to be left to IANA.  I do think it should be changed before this 
> > >> is published, probably just removing that last sentence.
> > >
> > > While I'm not opposed to normalizing on a default procedure, I 
> > > think the authors were just trying to follow existing examples.
> > >
> > > RFC 7519:
> > >
> > > So if we're going to change things around, maybe we should issue 
> > > an IESG statement.
> > >
> > > -Ben
> > >
> > >
> >

_______________________________________________
Ace mailing list
[email-masked]
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Face&amp;data=02%7C01%7CMichael.Jones%40microsoft.com%7C0b217822fdab454c213408d75d995cec%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637080785592182009&amp;sdata=8VdwDB36GMdeSsrXWDUK0DZ8%2BvjcQJKcV5I95588UQo%3D&amp;reserved=0

---

From: Mike Jones <[email-masked]>
Date: Thu, 31 Oct 2019 14:49:06 +0000

Per the decision on the telechat, I have published -11, which removes the IESG appeal language in favor of direct appeal to the IESG.  See https://tools.ietf.org/html/draft-ietf-ace-cwt-proof-of-possession-11#section-7.

Please update the document status accordingly.

				Thank you,
				-- Mike

-----Original Message-----
From: Mike Jones 
Sent: Wednesday, October 30, 2019 5:48 PM
To: Benjamin Kaduk <[email-masked]>
Cc: Roman D. Danyliw <[email-masked]>; [email-masked]; Mirja Kuehlewind <[email-masked]>; The IESG <[email-masked]>; [email-masked]; [email-masked]; Barry Leiba <[email-masked]>
Subject: RE: [Ace] Mirja Kühlewind's No Objection on draft-ietf-ace-cwt-proof-of-possession-09: (with COMMENT)

				Later,
				-- Mike

-----Original Message-----
From: Ace <[email-masked]> On Behalf Of Benjamin Kaduk
Sent: Wednesday, October 30, 2019 5:29 PM
To: Mike Jones <[email-masked]>
Cc: Roman D. Danyliw <[email-masked]>; [email-masked]; Mirja Kuehlewind <[email-masked]>; The IESG <[email-masked]>; [email-masked]; [email-masked]; Barry Leiba <[email-masked]>
Subject: Re: [Ace] Mirja Kühlewind's No Objection on draft-ietf-ace-cwt-proof-of-possession-09: (with COMMENT)

-Ben