Subject: [TLS] WG actions (was Encrypt-then-MAC again (was padding bug))

From: Juho Vähä-Herttua <[email-masked]>
Date: Thu, 5 Dec 2013 12:49:33 +0200

> On 5.12.2013, at 5.24, Peter Gutmann <[email-masked]> wrote:
> 
> Eric Rescorla <[email-masked]> writes:
> 
>> This topic was discussed at the TLS WG meeting in Vancouver (since you 
>> declined to attend,
> 
> In any case the WG consists of people on this mailing list, not a select 
> few folks in some back-room in Vancouver.

I think the accusation of intentionally organizing meetings so that some members cannot attend might be better handled outside this list, since it sounds a bit personal.

However, I think the comment above about who is a memer of the WG is valid. I would like to put a bit of emphasis on what RFC 2418 says.

"All working group actions shall be taken in a public forum, and wide participation is encouraged. A working group will conduct much of its business via electronic mail distribution lists but may meet periodically to discuss and review task status and progress, to resolve specific issues and to direct future activities."

Unfortunately I haven't had a chance to take part in any of the face-to-face meetings, so my views are purely from mailing list perspective. The mailing list has extremely good discussion and interesting points, but I get the feeling that many decisions are coming from the "top" (face-to-face meetigs) down here.

When people meet regularly and know each other well, they will share more views, this is inevitable. However, IMHO minimizing the gap between the mailing list and meetings, and facilitating communication both ways should be one of the top priorities of WG chairs. 

Finding ways to get reliable votes instead of vague second hand summaries might be a good way to resolve these conflicts. All it would take in its smallest form would be to open a thread at the list for voting (with no discussion, it should be mostly done at this point), give a certain timebox for the voting and conclude the results on the list. This could be then taken to the face-to-face meetings.

Does someone know why we don't do this?

Juho

---

From: Alfredo Pironti <[email-masked]>
Date: Thu, 5 Dec 2013 12:52:16 +0100

> Does someone know why we don't do this?

My understanding is that humming is preferred, as it provides some
form of anonymity, while voting would quite break it. Voting/humming
on itself is also a delicate point, as there are not eligible voters
lists; finally, IETF (always according to my understanding) is based
on consensus, so for example, winning by a few votes would still mean
that there is no consensus.

Of course, humming has the drawback of requiring some sort of physical presence.

Alfredo

>
>
> Juho
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: Bodo Moeller <[email-masked]>
Date: Thu, 5 Dec 2013 12:59:20 +0100

As I wrote earlier, I think that Eric thought that result from humming
reflected a lack of consensus previous seen on the mailing list, as
previously summarized by him here:
http://www.ietf.org/mail-archive/web/tls/current/msg10004.html

Had there been consensus on the mailing list already, that couldn't have
been silently overruled at the meeting.  Specifically, RFC 2418 requires
that "Decisions reached during a face-to-face meeting about topics or
issues which have not been discussed on the mailing list, or are
significantly different from previously arrived mailing list consensus MUST
be reviewed on the mailing list."  In-person meetings exist to facilitate
discussion, but they're not where decisions are finalized.

Bodo

---

From: Juho Vähä-Herttua <[email-masked]>
Date: Thu, 5 Dec 2013 14:27:38 +0200

> On 5.12.2013, at 13.52, Alfredo Pironti <[email-masked]> wrote:
> 

This answers my question and I stand corrected, voting is probably not a good idea at IETF where main goal is the consensus on issues. However, I see people already collecting "votes" to prove support for their arguments, because a vocal minority can easily send off some people. I believe there are several people for whom TLS, although important, is not their main focus.

The main reason seems to be that I rarely see chairs taking part in discussion or steering it to the right direction. The voting suggestion was mainly a wild throw that something should be done. But nevertheless it feels like the decisions are made somewhere else than here...

> Of course, humming has the drawback of requiring some sort of physical presence.

Someone at the meeting should hum for the whole mailing list probably. But it would be better if him/her was neutral and active participant in the discussion.

Juho

---

From: Sean Turner <[email-masked]>
Date: Thu, 5 Dec 2013 14:44:45 +0000

I'm the responsible AD for this group, so let me try to clarify.

Our objective is to have rough consensus on a way forward.  When
there wasn’t consensus on the mailing list (I agreed with the summary
posted) it is often useful to try to resolve that F2F.  In this case, the
WG met and I made it crystal clear that doing nothing is not an option
here.  Hums were taken and there was rough consensus of the people
in the room for the AEAD approach (the minutes reflect this).  But, there
are now obviously enough people who disagree on the mailing list and we
don't yet have a draft for the alternative that the F2F meeting preferred.
This is why the chairs haven't called consensus, though
I wish they had reported this back more clearly to the mailing list.

I think this has dragged on too long and I'll be meeting with the
chairs to get them to define a process for selecting a way forward.
That should happen this week and they should send something to
the list next week.  I want to see this draft in IETF LC before the
IETF 89 in March.

spt

On Dec 05, 2013, at 11:59, Bodo Moeller <[email-masked]> wrote:

> As I wrote earlier, I think that Eric thought that result from humming reflected a lack of consensus previous seen on the mailing list, as previously summarized by him here: http://www.ietf.org/mail-archive/web/tls/current/msg10004.html
> 
> Had there been consensus on the mailing list already, that couldn't have been silently overruled at the meeting.  Specifically, RFC 2418 requires that "Decisions reached during a face-to-face meeting about topics or issues which have not been discussed on the mailing list, or are significantly different from previously arrived mailing list consensus MUST be reviewed on the mailing list."  In-person meetings exist to facilitate discussion, but they're not where decisions are finalized.
> 
> Bodo
>