Re: [Ace] Mirja Kühlewind's No Objection on draft-ietf-ace-cwt-proof-of-possession-09: (with COMMENT)

Mirja Kuehlewind <ietf@kuehlewind.net> Mon, 28 October 2019 15:54 UTC

Return-Path: <ietf@kuehlewind.net>
X-Original-To: ace@ietfa.amsl.com
Delivered-To: ace@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5E241200A3; Mon, 28 Oct 2019 08:54:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Level:
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Fk1tHO1tfW0; Mon, 28 Oct 2019 08:54:28 -0700 (PDT)
Received: from wp513.webpack.hosteurope.de (wp513.webpack.hosteurope.de [IPv6:2a01:488:42:1000:50ed:8223::]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A6429120098; Mon, 28 Oct 2019 08:54:28 -0700 (PDT)
Received: from 200116b82cf86d0079e292451e40657f.dip.versatel-1u1.de ([2001:16b8:2cf8:6d00:79e2:9245:1e40:657f]); authenticated by wp513.webpack.hosteurope.de running ExIM with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) id 1iP7LU-0005ag-EB; Mon, 28 Oct 2019 16:54:16 +0100
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
From: Mirja Kuehlewind <ietf@kuehlewind.net>
In-Reply-To: <20191028153150.GY69013@kduck.mit.edu>
Date: Mon, 28 Oct 2019 16:54:15 +0100
Cc: Barry Leiba <barryleiba@computer.org>, "Roman D. Danyliw" <rdd@cert.org>, ace-chairs@ietf.org, The IESG <iesg@ietf.org>, ace@ietf.org, draft-ietf-ace-cwt-proof-of-possession@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <4F15E6F7-2DA0-4C90-B891-DDA65917D1A7@kuehlewind.net>
References: <157201926102.4337.10953843577545450235.idtracker@ietfa.amsl.com> <CALaySJKSmewUn3u2T7Nr5MaCOJ5C=pAii3UB230r+jox5m-4gQ@mail.gmail.com> <20191028153150.GY69013@kduck.mit.edu>
To: Benjamin Kaduk <kaduk@mit.edu>
X-Mailer: Apple Mail (2.3445.104.11)
X-bounce-key: webpack.hosteurope.de;ietf@kuehlewind.net;1572278068;9d8fcfed;
X-HE-SMSGID: 1iP7LU-0005ag-EB
Archived-At: <https://mailarchive.ietf.org/arch/msg/ace/SbjfSNq3sDBAFwmYinXivuIVo9U>
Subject: Re: [Ace] Mirja Kühlewind's No Objection on draft-ietf-ace-cwt-proof-of-possession-09: (with COMMENT)
X-BeenThere: ace@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" <ace.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ace>, <mailto:ace-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ace/>
List-Post: <mailto:ace@ietf.org>
List-Help: <mailto:ace-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ace>, <mailto:ace-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Oct 2019 15:54:31 -0000

These are all quite recents examples, so maybe the procedures are changing at the moment. I guess we as the IESG should be aware and figure out what the right procedure actually should be here.

> On 28. Oct 2019, at 16:31, Benjamin Kaduk <kaduk@mit.edu> wrote:
> 
> On Fri, Oct 25, 2019 at 12:31:42PM -0400, Barry Leiba wrote:
>> Yeh, it's very common for authors to try to tell IANA how to handle
>> registrations, and I often push back on that as inappropriate.  There
>> are certainly special conditions that IANA should be told about, but
>> this is standard work-flow management stuff that ought to be left to
>> IANA.  I do think it should be changed before this is published,
>> probably just removing that last sentence.
> 
> While I'm not opposed to normalizing on a default procedure, I think the
> authors were just trying to follow existing examples.
> 
> RFC 7519:
> 
>   Values are registered on a Specification Required [RFC5226] basis
>   after a three-week review period on the jwt-reg-review@ietf.org
>   mailing list, on the advice of one or more Designated Experts.
>   However, to allow for the allocation of values prior to publication,
>   the Designated Experts may approve registration once they are
>   satisfied that such a specification will be published.
> 
>   Registration requests sent to the mailing list for review should use
>   an appropriate subject (e.g., "Request to register claim: example").
> 
>   Within the review period, the Designated Experts will either approve
>   or deny the registration request, communicating this decision to the
>   review list and IANA.  Denials should include an explanation and, if
>   applicable, suggestions as to how to make the request successful.
>   Registration requests that are undetermined for a period longer than
>   21 days can be brought to the IESG's attention (using the
>   iesg@ietf.org mailing list) for resolution.
> 
> RFC 8414:
> 
>   Values are registered on a Specification Required [RFC8126] basis
>   after a two-week review period on the oauth-ext-review@ietf.org
>   mailing list, on the advice of one or more Designated Experts.
>   However, to allow for the allocation of values prior to publication,
>   the Designated Experts may approve registration once they are
>   satisfied that such a specification will be published.
> 
>   Registration requests sent to the mailing list for review should use
>   an appropriate subject (e.g., "Request to register OAuth
>   Authorization Server Metadata: example").
> 
>   Within the review period, the Designated Experts will either approve
>   or deny the registration request, communicating this decision to the
>   review list and IANA.  Denials should include an explanation and, if
>   applicable, suggestions as to how to make the request successful.
>   Registration requests that are undetermined for a period longer than
>   21 days can be brought to the IESG's attention (using the
>   iesg@ietf.org mailing list) for resolution.
> 
> RFC 8447:
> 
>   Specification Required [RFC8126] registry requests are registered
>   after a three-week review period on the <tls-reg-review@ietf.org>
>   mailing list, on the advice of one or more designated experts.
>   However, to allow for the allocation of values prior to publication,
>   the designated experts may approve registration once they are
>   satisfied that such a specification will be published.
> 
>   Registration requests sent to the mailing list for review SHOULD use
>   an appropriate subject (e.g., "Request to register value in TLS bar
>   registry").
> 
>   Within the review period, the designated experts will either approve
>   or deny the registration request, communicating this decision to the
>   review list and IANA.  Denials SHOULD include an explanation and, if
>   applicable, suggestions as to how to make the request successful.
>   Registration requests that are undetermined for a period longer than
>   21 days can be brought to the IESG's attention (using the
>   <iesg@ietf.org> mailing list) for resolution.
> 
> [I stopped looking here]
> 
> So if we're going to change things around, maybe we should issue an IESG
> statement.
> 
> -Ben
> 
>