Subject: [Uta] Second WGLC for draft-ietf-uta-rfc7525bis-05

From: "Valery Smyslov" <[email-masked]>
Date: Mon, 14 Feb 2022 14:38:42 +0300

Hi,

after some discussion the chairs decided to issue a second WGLC for draft-ietf-uta-rfc7525bis.
The draft is an important one and it has received a significant number of changes
as result of the first WGLC. Despite the fact that many of them were discussed on the mailing list, 
we'd like to have more explicit confirmation that people are happy with the
way the concerns revealed in the first WGLC were addressed.

This message starts a second Working Group Last Call for draft-ietf-uta-rfc7525bis-05:
https://datatracker.ietf.org/doc/draft-ietf-uta-rfc7525bis/

The WGLC will last for two weeks and will end on March the 1st.
Please send your comments to the list before this date, even
if you only want to say: "Hey, the draft is OK".

Regards,
Leif & Valery.

---

From: "Olle E. Johansson" <[email-masked]>
Date: Mon, 14 Feb 2022 13:01:57 +0100

A nit-picking small comment. The abstract ends like this:

This document was published as RFC 7525 when the industry was in the midst of its transition to TLS 1.2. Years later this transition is largely complete and TLS 1.3 is widely available. Given the new environment, updated guidance is needed.

When published, this is the needed updated guidance.

“This document updates the guidance, given the new environment.” 

would be better.

/O

---

From: "Olle E. Johansson" <[email-masked]>
Date: Mon, 14 Feb 2022 13:13:15 +0100

From the draft:

"Protocol developers are strongly encouraged to register an ALPN identifier for their protocols. This applies to new protocols, as well as well-established protocols such as SMTP.”

I’ve tried to register ALPN for SIP/2.0 for a long time now, but fail to get responses and confusing ones.
It seems unclear whether we need to write new RFCs for SIP in order to get a registration, but that seems wrong to me.

It must be much easier to get this done. 

/O

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 14 Feb 2022 15:46:24 +0000

*   I’ve tried to register ALPN for SIP/2.0 for a long time now, but fail to get responses and confusing ones.

I don’t recall seeing the request, and I am one of the designated experts for the TLS registries.  I wonder where you asked?  [email-masked]<mailto:[email-masked]> is the place to write to.  That address doesn’t seem to be written down anywhere well-known.

  *   It seems unclear whether we need to write new RFCs for SIP in order to get a registration, but that seems wrong to me.

The requirement is that somewhere there be a stable document.  Since they don’t expire, an internet-draft is sufficient.  More likely, if the SIP documents talk about TLS, and ideally mention ALPN, that’s enough, just mention whatever docs in your email.

  *   It must be much easier to get this done.

Sorry for your frustration.  Perhaps the current draft could add a sentence giving the email address?

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 14 Feb 2022 08:52:48 -0700

On 2/14/22 5:01 AM, Olle E. Johansson wrote:
> This document was published as RFC 7525 when the industry was in the 
> midst of its transition to TLS 1.2. Years later this transition is 
> largely complete and TLS 1.3 is widely available. Given the new 
> environment, updated guidance is needed.
> 

Agreed. Thanks for the suggestion.

Peter

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 14 Feb 2022 18:30:07 +0200

In fact if you look up the relevant IANA page [1], it refers to Sec. 17 of RFC 8447, which in turn lists the email address that Rich mentions at iana.org.

Arguably email addresses are not stable enough for inclusion in RFCs but in this particular case, it is right there where it needs to be.

Thanks,
	Yaron

[1] https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids

From: "Salz, Rich" <[email-masked]>
Date: Monday, February 14, 2022 at 17:47
To: "Olle E. Johansson" <[email-masked]>, Valery Smyslov <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, Leif Johansson <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [Uta] Second WGLC for draft-ietf-uta-rfc7525bis-05
Resent-From: <[email-masked]>
Resent-To: <[email-masked]>, <[email-masked]>, <[email-masked]>
Resent-Date: Mon, 14 Feb 2022 07:47:00 -0800 (PST)

➢ I’ve tried to register ALPN for SIP/2.0 for a long time now, but fail to get responses and confusing ones.

I don’t recall seeing the request, and I am one of the designated experts for the TLS registries.  I wonder where you asked?  mailto:[email-masked] is the place to write to.  That address doesn’t seem to be written down anywhere well-known.

➢ It seems unclear whether we need to write new RFCs for SIP in order to get a registration, but that seems wrong to me.

The requirement is that somewhere there be a stable document.  Since they don’t expire, an internet-draft is sufficient.  More likely, if the SIP documents talk about TLS, and ideally mention ALPN, that’s enough, just mention whatever docs in your email.
➢ It must be much easier to get this done.

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 14 Feb 2022 17:46:47 +0000

>   In fact if you look up the relevant IANA page [1], it refers to Sec. 17 of RFC 8447, which in turn lists the email address that Rich mentions at iana.org.

You're right.  Every TLS registry has that note.  Ugh, I missed it.  And I swear I looked at a registry before my note. (

---

From: "Olle E. Johansson" <[email-masked]>
Date: Mon, 14 Feb 2022 19:17:26 +0100

> On 14 Feb 2022, at 16:46, Salz, Rich <rsalz=[email-masked]> wrote:
> 
> I don’t recall seeing the request, and I am one of the designated experts for the TLS registries.  I wonder where you asked?  [email-masked] <mailto:[email-masked]> is the place to write to.  That address doesn’t seem to be written down anywhere well-known.
I have sent you separately our previous conversation that seemed to end in a black hole after I wrote the draft.

> The requirement is that somewhere there be a stable document.  Since they don’t expire, an internet-draft is sufficient.  More likely, if the SIP documents talk about TLS, and ideally mention ALPN,…
There’s a draft

> Sorry for your frustration.  Perhaps the current draft could add a sentence giving the email address?
Add a clarification that for old protocols, at least a draft is needed to make life simpler and avoid at least one round-trip :-)

/O

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 14 Feb 2022 21:07:14 +0000

Hey, the draft is OK.