Subject: [Emu] I-D Action: draft-ietf-emu-eap-tls13-16.txt

From: [email-masked]
Date: Fri, 11 Jun 2021 05:50:55 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the EAP Method Update WG of the IETF.

        Title           : Using EAP-TLS with TLS 1.3 (EAP-TLS 1.3)
        Authors         : John Preuß Mattsson
                          Mohit Sethi
	Filename        : draft-ietf-emu-eap-tls13-16.txt
	Pages           : 35
	Date            : 2021-06-11

Abstract:
   The Extensible Authentication Protocol (EAP), defined in RFC 3748,
   provides a standard mechanism for support of multiple authentication
   methods.  This document specifies the use of EAP-Transport Layer
   Security (EAP-TLS) with TLS 1.3 while remaining backwards compatible
   with existing implementations of EAP-TLS.  TLS 1.3 provides
   significantly improved security, privacy, and reduced latency when
   compared to earlier versions of TLS.  EAP-TLS with TLS 1.3 (EAP-TLS
   1.3) further improves security and privacy by always providing
   forward secrecy, never disclosing the peer identity, and by mandating
   use of revocation checking.  This document also provides guidance on
   authorization and resumption for EAP-TLS in general (regardless of
   the underlying TLS version used).  This document updates RFC 5216.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-emu-eap-tls13/

There is also an htmlized version available at:
https://datatracker.ietf.org/doc/html/draft-ietf-emu-eap-tls13-16

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-emu-eap-tls13-16

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Mohit Sethi M <[email-masked]>
Date: Fri, 11 Jun 2021 13:08:46 +0000

Hi Chair/AD/EMU:

We have submitted a new version of draft-ietf-emu-eap-tls13 based on the extensive feedback from Alan Dekok, Heikki Vatiainen, and Oleg Pekar.

Can we somehow prioritize this document and move it forward? The authors have received several offline emails inquiring about the publication timeline.

Any remaining issues in the current draft can be addressed together with the comments from the AD review and the IETF last call.

John and Mohit

-------- Forwarded Message --------
Subject:        [Emu] I-D Action: draft-ietf-emu-eap-tls13-16.txt
Date:   Fri, 11 Jun 2021 05:50:55 -0700
From:   [email-masked]<mailto:[email-masked]>
Reply-To:       [email-masked]<mailto:[email-masked]>
To:     [email-masked]<mailto:[email-masked]>
CC:     [email-masked]<mailto:[email-masked]>

Abstract:

_______________________________________________
Emu mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/emu

---

From: Alan DeKok <[email-masked]>
Date: Fri, 11 Jun 2021 09:39:34 -0400

> Any remaining issues in the current draft can be addressed together with the comments from the AD review and the IETF last call. 

  I have sent a separate message re-iterating my previous detailed review, much of which remains unaddressed.

  I suggest that the authors prioritize working towards WG consensus.

  Alan DeKok.

---

From: Mohit Sethi M <[email-masked]>
Date: Fri, 11 Jun 2021 13:56:06 +0000

I guess you know that there are several implementations of the draft 
some of which are already deployed. It is of course nice to strive for 
perfection. Could you please submit a pull request addressing your 
unaddressed comments.

--Mohit

---

From: Alan DeKok <[email-masked]>
Date: Fri, 11 Jun 2021 10:17:05 -0400

On Jun 11, 2021, at 9:56 AM, Mohit Sethi M <[email-masked]> wrote:
> some of which are already deployed.

   While that's a nice comment telling me what I already know, it doesn't address my point.  The fact that implementations exist does not mean that the specification is sufficient to create an implementation.

  The implementors have had many "behind the scenes" discussions about how to implement EAP-TLS 1.3.   The outcome of those discussions was shared among implementors.  That information is largely what enabled inter-operability.  Information which is not all reflected in the document.

  I have suggested repeatedly that the document contain sufficient information to create a secure and inter-operable implementation.  It's not clear to me why these suggestions have been ignored, or rejected.

> It is of course nice to strive for perfection.

  That comment misrepresents my position.

> Could you please submit a pull request addressing your 
> unaddressed comments.

  I gave suggested text in my messages.  These comments were largely ignored across multiple reviews.  This is not how we should work towards consensus.

  If the goal of this document is simply to get it published, then I withdraw all of my objections.  Implementors will then share extra knowledge behind the scenes.

  If the goal of this document is to enable secure and inter-operable implementations, then it would be useful to address comments from major implementors.

  Alan DeKok.

---

From: Mohit Sethi M <[email-masked]>
Date: Fri, 11 Jun 2021 16:20:41 +0000

I guess you wanted to say that the document does not? contain sufficient information to create a secure and interoperable implementation. I disagree. But that doesn't mean your comments will not be addressed. This is after all a working group document and should reflect rough consensus. So we will address your remaining issues.

 It's not clear to me why these suggestions have been ignored, or rejected.

I find it odd that you claim your suggestions have been ignored or rejected. We have created many issues on github  (https://github.com/emu-wg/draft-ietf-emu-eap-tls13/issues?q=is%3Aissue+is%3Aclosed+Alan) and submitted many pull requests addressing your comments (https://github.com/emu-wg/draft-ietf-emu-eap-tls13/pulls?q=is%3Apr+Alan+is%3Aclosed).

When I merged this PR in the morning: https://github.com/emu-wg/draft-ietf-emu-eap-tls13/pull/71, it looked like all of your comments had been addressed in the PR. Joe (the other co-chair) had approved this PR?

As authors of a working group document of a voluntary standards organization, we have been doing voluntary service over the last several years. We started working on this document in 2018 (https://datatracker.ietf.org/doc/html/draft-mattsson-eap-tls13). You have been helping us with the document since the beginning. So thank you for your voluntary service as well. While it is not mandatory, helping us with github issues/PRs related to your reviews can help us ensure that your comments are not inadvertently left unaddressed; and that this community effort moves forward faster.

--Mohit

On 6/11/21 5:17 PM, Alan DeKok wrote:

On Jun 11, 2021, at 9:56 AM, Mohit Sethi M <[email-masked]><mailto:[email-masked]> wrote:

  Alan DeKok.

---

From: Alan DeKok <[email-masked]>
Date: Fri, 11 Jun 2021 13:32:56 -0400

On Jun 11, 2021, at 12:20 PM, Mohit Sethi M <[email-masked]> wrote:
> I find it odd that you claim your suggestions have been ignored or rejected.

  So -16 does address my review from May 6?  Could you please go through my review of today, and point out in -16 where each of my comments was addressed?

  As a reminder, many of those comments go back to my earlier review of -13 on March 13.   So we now have -14, -15, and -16 which (so far as I can tell) don't address substantial portions of the reviews.

> We have created many issues on github  (https://github.com/emu-wg/draft-ietf-emu-eap-tls13/issues?q=is%3Aissue+is%3Aclosed+Alan) and submitted many pull requests addressing your comments (https://github.com/emu-wg/draft-ietf-emu-eap-tls13/pulls?q=is%3Apr+Alan+is%3Aclosed). 
> 

  I had sent a review of -13 on March 3.  And another one May 6.  And another today.  The second and third reviews were largely copied from the first one.  And contained issues which (so far as I can tell) have not been addressed, much less discussed.  These issues do not appear to be addressed in that PR.

> As authors of a working group document of a voluntary standards organization, we have been doing voluntary service over the last several years. We started working on this document in 2018 (https://…

  I'm asking that my reviews be discussed and/or addressed, by the authors, in the WG.  I didn't expect to get that particular response.  It is distinctly unusual.

  Alan DeKok.

---

From: Joseph Salowey <[email-masked]>
Date: Fri, 11 Jun 2021 11:24:39 -0700

Hi Folks,

I realize that there is frustration with the current document and process.
I ask that we all focus on finishing off the current document so that we
can move it forward.  This does require that we consider the issues on the
table.  I think we are close to the finish line.  I am asking the authors
to help work through the final issues.

Please continue to remain professional in your discussions on the list.

Thanks,

Joe

On Fri, Jun 11, 2021 at 10:33 AM Alan DeKok <[email-masked]>
wrote:

>   So -16 does address my review from May 6?  Could you please go through
> my review of today, and point out in -16 where each of my comments was
> addressed?
>
>   As a reminder, many of those comments go back to my earlier review of
> -13 on March 13.   So we now have -14, -15, and -16 which (so far as I can
> tell) don't address substantial portions of the reviews.
>
> > We have created many issues on github  (
> https://github.com/emu-wg/draft-ietf-emu-eap-tls13/issues?q=is%3Aissue+is%3Aclosed+Alan)
> and submitted many pull requests addressing your comments (
> https://github.com/emu-wg/draft-ietf-emu-eap-tls13/pulls?q=is%3Apr+Alan+is%3Aclosed).
>
> >
> > When I merged this PR in the morning:
> https://github.com/emu-wg/draft-ietf-emu-eap-tls13/pull/71, it looked
> like all of your comments had been addressed in the PR. Joe (the other
> co-chair) had approved this PR?
>
>   I had sent a review of -13 on March 3.  And another one May 6.  And
> another today.  The second and third reviews were largely copied from the
> first one.  And contained issues which (so far as I can tell) have not been
> addressed, much less discussed.  These issues do not appear to be addressed
> in that PR.
>
> > As authors of a working group document of a voluntary standards
> organization, we have been doing voluntary service over the last several
> years. We started working on this document in 2018 (
> https://datatracker.ietf.org/doc/html/draft-mattsson-eap-tls13). You have
> been helping us with the document since the beginning. So thank you for
> your voluntary service as well. While it is not mandatory, helping us with
> github issues/PRs related to your reviews can help us ensure that your
> comments are not inadvertently left unaddressed; and that this community
> effort moves forward faster.
>
>   I'm asking that my reviews be discussed and/or addressed, by the
> authors, in the WG.  I didn't expect to get that particular response.  It
> is distinctly unusual.
>
>   Alan DeKok.
>
> [email-masked]

---

From: John Mattsson <[email-masked]>
Date: Fri, 11 Jun 2021 21:57:40 +0000

Hi,

I think it would be good to first make sure that we have GitHub issues or pull requests for the remaining EAP-TLS issues.

https://github.com/emu-wg/draft-ietf-emu-eap-tls13

The more I work with GitHub in IETF, the more I like it, both as an author or commenting on documents. It forces comments to be much more concrete, it makes sure that no issues are forgotten, and it makes it clearer why changes was made and the discussion behind it. Maybe the EMU WG should discuss and formalize a bit on how to work with GitHub at IETF 111.

Cheers,
John

From: Emu <[email-masked]> on behalf of Joseph Salowey <[email-masked]>
Date: Friday, 11 June 2021 at 20:25
To: Alan DeKok <[email-masked]>
Cc: Roman Danyliw <[email-masked]>, Mohit Sethi M <[email-masked]>, [email-masked] <[email-masked]>
Subject: Re: [Emu] I-D Action: draft-ietf-emu-eap-tls13-16.txt
Hi Folks,

I realize that there is frustration with the current document and process.  I ask that we all focus on finishing off the current document so that we can move it forward.  This does require that we consider the issues on the table.  I think we are close to the finish line.  I am asking the authors to help work through the final issues.

Thanks,

Joe

On Fri, Jun 11, 2021 at 10:33 AM Alan DeKok <[email-masked]<mailto:[email-masked]>> wrote:

> We have created many issues on github  (https://github.com/emu-wg/draft-ietf-emu-eap-tls13/issues?q=is%3Aissue+is%3Aclosed+Alan<https://protect2.fireeye.com/v1/url?k=6242a48c-3dd99d89-6242e417-86d2114eab2f-17c457b5f780f34b&q=1&e=f27361e9-1243-4ef0-b2dc-e81a4ff8946d&u=https%3A%2F%2Fgithub.com%2Femu-wg%2Fdraft-ietf-emu-eap-tls13%2Fissues%3Fq%3Dis%253Aissue%2Bis%253Aclosed%2BAlan>) and submitted many pull requests addressing your comments (https://github.com/emu-wg/draft-ietf-emu-eap-tls13/pulls?q=is%3Apr+Alan+is%3Aclosed<https://protect2.fireeye.com/v1/url?k=2ea35929-7138602c-2ea319b2-86d2114eab2f-b9e622cabe80ccc1&q=1&e=f27361e9-1243-4ef0-b2dc-e81a4ff8946d&u=https%3A%2F%2Fgithub.com%2Femu-wg%2Fdraft-ietf-emu-eap-tls13%2Fpulls%3Fq%3Dis%253Apr%2BAlan%2Bis%253Aclosed>).
>
> When I merged this PR in the morning: https://github.com/emu-wg/draft-ietf-emu-eap-tls13/pull/71<https://protect2.fireeye.com/v1/url?k=8f90a00d-d00b9908-8f90e096-86d2114eab2f-0e4aca5ebf1d50d0&q=1&e=f27361e9-1243-4ef0-b2dc-e81a4ff8946d&u=https%3A%2F%2Fgithub.com%2Femu-wg%2Fdraft-ietf-emu-eap-tls13%2Fpull%2F71>, it looked like all of your comments had been addressed in the PR. Joe (the other co-chair) had approved this PR?

  Alan DeKok.