Subject: [Curdle] Alissa Cooper's Discuss on draft-ietf-curdle-gss-keyex-sha2-09: (with DISCUSS)

From: Alissa Cooper via Datatracker <[email-masked]>
Date: Mon, 24 Jun 2019 13:18:08 -0700

Alissa Cooper has entered the following ballot position for
draft-ietf-curdle-gss-keyex-sha2-09: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-curdle-gss-keyex-sha2/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

"The IESG is considered to be the owner of all these key exchange
   methods; this does NOT imply that the IESG is considered to be the
   owner of the underlying GSS-API mechanism."

I don't understand this text. What does it mean for the IESG to be the owner of a method?

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 24 Jun 2019 15:19:55 -0500

> https://datatracker.ietf.org/doc/draft-ietf-curdle-gss-keyex-sha2/

The IESG has change control for the SSH key exchange method; the IESG does
not necessarily have change control for the underlying GSS-API mechanism.

-Ben

---

From: Alissa Cooper <[email-masked]>
Date: Mon, 24 Jun 2019 17:01:28 -0400

> On Jun 24, 2019, at 4:19 PM, Benjamin Kaduk <[email-masked]> wrote:
> 

Thanks. I think it would be clearer to say that than to talk about ownership. But given that the registry policy is IETF Review, is it really appropriate to say that the IESG has change control? Would s/IESG has change control/IETF has change control/ be more accurate?

Alissa

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 24 Jun 2019 16:08:37 -0500

> Thanks. I think it would be clearer to say that than to talk about ownership. But given that the registry policy is IETF Review, is it really appropriate to say that the IESG has change control? Wo…

I'll wait to see what the authors think about the "ownership" vs. "change
control" pedagogy.  With respect to IESG vs. IETF, it seems that the IESG
is who is tasked with determining the consensus of the IETF, so in practice
it would be the IESG with control, even if in some formal sense the
authority is vested with the IETF.  (I thought it was near-universal to
list the IESG as the contact when the IETF is the nominal responsible
party; is this case different somehow?)

Thanks,

Ben

---

From: Simo Sorce <[email-masked]>
Date: Mon, 24 Jun 2019 17:15:22 -0400

> party; is this case different somehow?)

If I remember correctly this language has been inherited untouched from
the original RFC we are updating.

If at all possible we'd like to maintain consistency with the previous
language and not change it.

Simo.

-- 
Simo Sorce
RHEL Crypto Team
Red Hat, Inc

---

From: Alissa Cooper <[email-masked]>
Date: Tue, 25 Jun 2019 10:52:18 -0400

> On Jun 24, 2019, at 5:08 PM, Benjamin Kaduk <[email-masked]> wrote:
> 

That usually appears in an actual registration (e.g., “Contact: IESG <[email-masked] <mailto:[email-masked]>>”) whereas this registry already has a registration policy of IETF Review and this text doesn’t appear in the section where the new registrations are made, so I didn’t understand what it meant. I can live with “the IESG is the change controller” though.

Thanks,
Alissa

---

From: Alissa Cooper <[email-masked]>
Date: Tue, 25 Jun 2019 10:53:25 -0400

> On Jun 24, 2019, at 5:15 PM, Simo Sorce <[email-masked]> wrote:
> 

Since this document updates RFC 4462, would it be possible to add a note (perhaps in Section 3) indicating that the term “owner” is synonymous with “change controller” in both documents?

Thanks,
Alissa

---

From: Mirja Kuehlewind <[email-masked]>
Date: Tue, 25 Jun 2019 18:14:57 +0200

Hi all,

See below.

> On 25. Jun 2019, at 16:53, Alissa Cooper <[email-masked]> wrote:
> 
> 
> 

As I was confused by this as well but was initially actually assuming that we talk about the registry entries, maybe it would make it clearer to say this in the text, e.g.

s/owner of all these key exchange methods/change controller of the IANA registration of these key exchange methods/

?

Mirja

---

From: Adam Roach <[email-masked]>
Date: Tue, 25 Jun 2019 11:49:21 -0500

> not necessarily have change control for the underlying GSS-API mechanism.

I'm confused. Your statement would imply that one of the following is false:

 1. GSS-API is authoritatively defined by RFC 2743
 2. RFC 2743 is an IETF-stream document
 3. The IESG is responsible for change control of IETF-stream documents

Which of these have I misunderstood?

/a

---

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 25 Jun 2019 11:53:09 -0500

> Which of these have I misunderstood?

None of them :)

"GSS-API mechanism" is a term of art for a cryptographic service provider,
identified by OID, that implements the underlyin functionality of the
GSS-API.  While the GSS-API framework is defined by RFC 2743, anyone that
can allocate an OID can specify a GSS-API mechanism corresponding to that
OID, and the IETF cannot try to assert change control over that
cryptographic provider.

Does that help?

-Ben

---

From: Adam Roach <[email-masked]>
Date: Tue, 25 Jun 2019 12:26:00 -0500

> OID, and the IETF cannot try to assert change control over that

Oh! Yes, that's much clearer, thanks. I hear you saying that there's a 
one-to-one correspondence. I think replacing "underlying" with 
"corresponding" might avoid similar confusion by others.

/a