Subject: [Acme] draft-ietf-acme

From: Ted Hardie <[email-masked]>
Date: Wed, 12 Aug 2015 10:46:03 -0700

Howdy,

At the meeting in Prague, the room felt that adopting draft-barnes-acme as
a working group draft was appropriate (this is also in the charter).
Richard is touching up the editing buffer for that now, but if you have a
contrary opinion, now would be the time to let us know.

thanks,

Ted and Rich

---

From: Tony Arcieri <[email-masked]>
Date: Wed, 12 Aug 2015 10:55:48 -0700

I think the duplicate-signature key selection attack Andrew Ayer discovered
here really needs to be addressed (unless it already was):

https://mailarchive.ietf.org/arch/msg/acme/F71iz6qq1o_QPVhJCV4dqWf-4Yc

On Wed, Aug 12, 2015 at 10:46 AM, Ted Hardie <[email-masked]> wrote:

> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
>
>

-- 
Tony Arcieri

---

From: Martin Thomson <[email-masked]>
Date: Wed, 12 Aug 2015 11:03:50 -0700

> here really needs to be addressed (unless it already was):

I don't see that as reason enough to block adoption.

---

From: Tony Arcieri <[email-masked]>
Date: Wed, 12 Aug 2015 11:18:54 -0700

> I don't see that as reason enough to block adoption.

It represents a conceptual misuse of digital signatures, and seems to me
like a very fundamental design flaw which is easily addressed. I'm confused
why you don't want to address it before adopting the draft.

-- 
Tony Arcieri

---

From: Martin Thomson <[email-masked]>
Date: Wed, 12 Aug 2015 11:22:43 -0700

> why you don't want to address it before adopting the draft.

If we set a precondition on adoption that said "no open issues" or
maybe even "no open issues that I think are serious" we would never
ever adopt anything.

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Wed, 12 Aug 2015 11:22:55 -0700

I agree with Tony here. I'm not familiar with IETF processes, but I
assume adopting something even as a working draft conveys some
preliminary notion of acceptance. Is that correct? If so, we should aim
to fix this large outstanding bug before adopting the current draft.

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Wed, 12 Aug 2015 14:29:07 -0400

On Wed 2015-08-12 14:18:54 -0400, Tony Arcieri wrote:
> On Wed, Aug 12, 2015 at 11:03 AM, Martin Thomson <[email-masked]> wrote:
>

I think everyone agrees that Andrew's attack needs to be fixed and the
draft won't make it out of the WG without it being adequately addressed.

But we can fix it just as well in draft -01 as in draft -00.  And
keeping -00 close to the non-WG draft is useful just for making sense of
the way the document has evolved.

I think adopting it before fixing Andrew's attack is fine.  We all know
that this attack needs to be addressed.

     --dkg

---

From: Martin Thomson <[email-masked]>
Date: Wed, 12 Aug 2015 11:32:38 -0700

> that this attack needs to be addressed.

Perhaps relevant.  If we adopt first, then *we* decide how this attack
is addressed.  If we adopt second, then whatever Richard decides to do
will affect the adoption decision.  And delay things.

---

From: Ted Hardie <[email-masked]>
Date: Wed, 12 Aug 2015 11:44:34 -0700

> to fix this large outstanding bug before adopting the current draft.

​So, this is a common misconception.  Adopting a draft doesn't mean you
think it is done or even that it has no known issues; it's a statement by
the working group that this is a starting point.  ​Think of it like picking
a github repo to work from--you want concrete text to present diffs to, and
picking a draft to work from lets you do that.   I believe the group so far
believes that the diffs should be against draft-barnes; that's all this
means.

regards,

Ted

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 12 Aug 2015 18:51:30 +0000

> I agree with Tony here. I'm not familiar with IETF processes, but I assume
> adopting something even as a working draft conveys some preliminary
> notion of acceptance. Is that correct?

No, it means that this is something the WG should, well, work on.  It means we want to use that document as the basis for work.

It doesn't imply in the slightest that it's "done"

---

From: Tony Arcieri <[email-masked]>
Date: Wed, 12 Aug 2015 11:55:00 -0700

> believes that the diffs should be against draft-barnes; that's all this

All right, my apologies then. I don't have other concerns.

-- 
Tony Arcieri

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Wed, 12 Aug 2015 11:56:00 -0700

Alright, thanks to Ted and Rich for the clarification. In that case I'm
fine with proceeding.