Subject: Re: [TLS] Straw poll on TLS SRP status

From: Jeffrey Altman <[email-masked]>
Date: Mon, 04 Jun 2007 23:48:00 -0400

Peter Gutmann wrote:
> <[email-masked]> writes:
>
>> The question is: Do you support advancing draft-ietf-tls-srp as Proposed
>> Standard?
>>
>>   [ ] Yes.
>>   [X] I think Informational/Experimental is better.
>>   [ ] I don't care about the status, just get it published.
>>   [ ] Something else, please state:
>>
>> You may reply either on the list, or privately to the chairs.
>
> I'll reply publicly in order to provide a rationale: Arguments against it
> becoming a full standard are that this spec has been around for six years now
> without any significant implementations appearing (apologies to the authors of
> GnuTLS and TLS Lite :-).  
Commercial implementations are blocked while waiting for the RFC so that
the permanent cipher suite numbers can be assigned.
>
> So really the only deciding factor is the IP status.  The Lucent and
> especially the Phoenix IPR statements will be, in my experience, sufficient to
> scare off any commercial users (and by extension non-commercial users who have
> to worry about lawyers).  So although it'd be nice to see SRP deployed, I
> don't think the IP encumbrance will get it past Informational.  If it wasn't
> for that, my vote would be "Just get it published".
There are several commercial implementations of RFC 2944 and RFC 2945. 
The IPR statements and surrounding FUD were not sufficient to prevent
implementations for Telnet clients and servers.

Just publish the thing and let the market decide when to implement it.

Jeffrey Altman
Secure Endpoints Inc.

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Peter Sylvester <[email-masked]>
Date: Tue, 05 Jun 2007 11:47:32 +0200

Peter Gutmann wrote:
> <
Sorry to disagree, since 3 years there exist also implementations for 
openssl and java,
the java one is used in jboss as far as I understand the manuals. 
Whether people use it,
who knows.
I got tired to follow each openssl version and maintain the patch, I 
understand that
the maintainers don't want to include the stuff before there is a stable 
status of
the specification. And seeing that ciphersuites had been reserved by 
IANA but not
the extension number, on 26.6.2006 I asked IANA

This discussion is the first time in 4 years that some almost technical 
discussion
takes place, at least.
_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Peter Sylvester <[email-masked]>
Date: Tue, 05 Jun 2007 17:38:32 +0200

My previous mail was incomplete. I wanted to copy the letter
I had sent to IANA and their response.

from: [email-masked]
date: 10 august 2006

Dear Peter,

This message is just to let you know that your request
is still in process.  You should be hearing from us soon.

On behalf of the IANA,

Jonathan Stewart
Internet Assigned Numbers Authority (IANA)

On Mon Jun 26 01:37:04 2006, [email-masked] wrote:

> > > Hello,
> > > it seems that you have allocated the TLS extension number 6 to ume.
> > The number 6  had been in the srp-tls draft since years.
> > > The srp-tls draft also contains three alert number for which
> > there is a temporary assignment.
> > > It seems quite unfortunate to me that you have the number to
> > some other extension although you must have been aware
> > of the usage in tls-srp.
> > > I wonder what can be done to avoid such clashes in the future
> > and to remedy the situation with srp-tls.
> > > Peter Sylvester
> > >