Subject: [dns-privacy] Why is draft-ietf-dprive-dtls-and-tls-profiles still blocked?

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 27 Oct 2017 14:55:10 +0200

The datatracker tells us that draft-ietf-dprive-dtls-and-tls-profiles
has a DISCUSS "This needs to be updated to indicate that the client
MUST NOT offer 7250 unless it has a preconfigured SPKI, otherwise
you're going to have interop problems." The DISCUSS was against -09,
the current version is -11 (1.5 months old) which does address the
problem "A client MUST only indicate support for raw public keys if it
has an SPKI pinset pre-configured (for interoperability reasons)."

Therefore, what's the problem with
draft-ietf-dprive-dtls-and-tls-profiles?

---

From: Brian Haberman <[email-masked]>
Date: Fri, 27 Oct 2017 09:30:43 -0400

Hi Stephane,

> draft-ietf-dprive-dtls-and-tls-profiles?

There was discussions with EKR over his issues and a revision published.
EKR asked for a review by DKG before he would clear his DISCUSS. We are
waiting on that review.

Regards,
Brian

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Fri, 27 Oct 2017 18:35:50 -0400

> EKR asked for a review by DKG before he would clear his DISCUSS. We are

my apologies.  I'm going through that now and hope to post a review to
the list by tomorrow.

    --dkg

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Mon, 30 Oct 2017 16:27:16 +0100

On Fri 2017-10-27 15:55:10 +0200, Stephane Bortzmeyer wrote:
> you're going to have interop problems."

I agree that this DISCUSS should be cleared, since draft-10 and draft-11
both state:

    A client MUST only indicate support for raw public keys if it has an
    SPKI pinset pre-configured (for interoperability reasons).

Regards,

    --dkg