Subject: [TLS] Request to publish draft-ietf-tls-srp

From: <[email-masked]>
Date: Mon, 18 Jun 2007 13:26:38 +0300

Tim,

On behalf of the TLS working group, I'd like to submit
draft-ietf-tls-srp-14 to AD evaluation, with the goal of 
publishing it as an Informational RFC.

PROTO Write-Up:

(1.a)  Who is the Document Shepherd for this document?  Has the
       Document Shepherd personally reviewed this version of the
       document and, in particular, does he or she believe this
       version is ready for forwarding to the IESG for publication?

Pasi Eronen. Yes.

(1.b)  Has the document had adequate review both from key WG members
       and from key non-WG members?  Does the Document Shepherd have
       any concerns about the depth or breadth of the reviews that
       have been performed?

The document went through WG last call, and although the number
people who commented the technical details was rather small,
I don't have concerns about the depth or breadth.

(1.c)  Does the Document Shepherd have concerns that the document
       needs more review from a particular or broader perspective,
       e.g., security, operational complexity, someone familiar with
       AAA, internationalization or XML?

No concerns.

(1.d)  Does the Document Shepherd have any specific concerns or
       issues with this document that the Responsible Area Director
       and/or the IESG should be aware of?  For example, perhaps he
       or she is uncomfortable with certain parts of the document, or
       has concerns whether there really is a need for it.  In any
       event, if the WG has discussed those issues and has indicated
       that it still wishes to advance the document, detail those
       concerns here.  Has an IPR disclosure related to this document
       been filed?  If so, please include a reference to the
       disclosure and summarize the WG discussion and conclusion on
       this issue.

This document took quite long to get finished: the -00 version
was posted more than 6 (six) years ago... 

There are three IPR disclosures that may be relevant:

https://datatracker.ietf.org/public/ipr_detail_show.cgi?&ipr_id=25
https://datatracker.ietf.org/public/ipr_detail_show.cgi?&ipr_id=31
https://datatracker.ietf.org/public/ipr_detail_show.cgi?&ipr_id=63

Basically the only contentious issue was whether this should be 
on Standards Track or not. A straw poll was held to gauge consensus;
there was no consensus for Standards Track, and thus this document
is now progressing with intended status of Informational. 

(1.e)  How solid is the WG consensus behind this document?  Does it
       represent the strong concurrence of a few individuals, with
       others being silent, or does the WG as a whole understand and
       agree with it?

Given the amount of comments about technical details, I'd
say the interest is rather limited.

(1.f)  Has anyone threatened an appeal or otherwise indicated extreme
       discontent?  If so, please summarise the areas of conflict in
       separate email messages to the Responsible Area Director.  (It
       should be in a separate email because this questionnaire is
       entered into the ID Tracker.)

Nobody has threatened an appeal or otherwise indicated extreme
discontent.

(1.g)  Has the Document Shepherd personally verified that the
       document satisfies all ID nits?  (See
       http://www.ietf.org/ID-Checklist.html and
       http://tools.ietf.org/tools/idnits/).  Boilerplate checks are
       not enough; this check needs to be thorough.  Has the document
       met all formal review criteria it needs to, such as the MIB
       Doctor, media type and URI type reviews?

Yes.

(1.h)  Has the document split its references into normative and
       informative?  Are there normative references to documents that
       are not ready for advancement or are otherwise in an unclear
       state?  If such normative references exist, what is the
       strategy for their completion?  Are there normative references
       that are downward references, as described in [RFC3967]?  If
       so, list these downward references to support the Area
       Director in the Last Call procedure for them [RFC3967].

References are split into normative and informative; all normative
references look acceptable.

(1.i)  Has the Document Shepherd verified that the document IANA
       consideration section exists and is consistent with the body
       of the document?  If the document specifies protocol
       extensions, are reservations requested in appropriate IANA
       registries?  Are the IANA registries clearly identified?  If
       the document creates a new registry, does it define the
       proposed initial contents of the registry and an allocation
       procedure for future registrations?  Does it suggest a
       reasonable name for the new registry?  See [RFC2434].  If the
       document describes an Expert Review process has Shepherd
       conferred with the Responsible Area Director so that the IESG
       can appoint the needed Expert during the IESG Evaluation?

Everything looks OK here.

(1.j)  Has the Document Shepherd verified that sections of the
       document that are written in a formal language, such as XML
       code, BNF rules, MIB definitions, etc., validate correctly in
       an automated checker?

The only (semi-)formal language used is the TLS presentation 
language defined in RFC 4346 (the base TLS spec), for which 
no automated tools are available. I have checked them manually.

(1.k)  The IESG approval announcement includes a Document
       Announcement Write-Up.  Please provide such a Document
       Announcement Write-Up?  Recent examples can be found in the
       "Action" announcements for approved documents.  The approval
       announcement contains the following sections:

Technical Summary

   This document adds Secure Remote Password (SRP) based
   authentication to TLS. 

Working Group Summary

   This document is a product of the Transport Layer 
   Security (TLS) Working Group. 

Document Quality

   There are at least four implementations of earlier 
   versions of this document.

(end)

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Peter Sylvester <[email-masked]>
Date: Tue, 19 Jun 2007 15:21:14 +0200

> say the interest is rather limited.

The document is essentially stable since 3 years, before that there had
been discussions among the implementors, and some important
improvements.

I don't claim that the existence of at least 4 different implementations
which interoperated about 3 years ago is a sign of big interest.

There have been critiques about the status of the document,
in particular motivated by IMO irrelevant IPR issues. Or,
at least that was the argument.
When taking their comments as serious in the consensus process,
did you assume that they have read the document and agree
with the technical content? :-)

regards
Peter

---

From: Martin Rex <[email-masked]>
Date: Tue, 19 Jun 2007 16:16:57 +0200 (MEST)

> with the technical content? :-)

I can only speak for myself:
I do have a very strong opinion about the document status because
of the IPR issue, and at the same time I consider this technology
completely irrelevant for my entire company and the product(s) we ship
so that I want to leave discussion of the technical details of this
spec entirely to those parties that are interested.

The two camps that are likely to produce technical feedback are
(a) implementors and (b) people who are seriously considering
using the technology or are already doing so.

Maybe it is (as I've mentioned before) that we've been succuessfully
using SSL client certs for the last and prefer to push this technology.
It is much easier for the backends to (continue to) deal with
authentication based on client certificates that having to add
yet another password-based authentication to a distributed system.

-Martin