[art] Re: AD Evaluation: draft-barnes-sframe-iana-256-00

[Aron Rosenberg <[e-mail]>]

> On Jan 18, 2026, at 4:08 PM, Martin Thomson <[e-mail]> wrote:
> 
> On Sat, Jan 17, 2026, at 03:41, Aron Rosenberg wrote:
>> We changed the Change Controller portion of the registry because it was 
>> not actually the original intent of the original authors to require a 
>> new RFC for introducing a new cipher suite definition.
> 
> That's a misunderstanding of what the change controller is for.
> 
> If the IETF is responsible for maintaining an entry, then it is the change controller.
> 
> But if an independent entity (Apple as an organization or just the individual Richard Barnes) wants to register an entry, they can become the change controller.  The question the field answers is "who does IANA ask to approve a change to that entry?"  That's an important field for maintaining the registry.
> 
> The registry operates under "specification required", which is the same "expert review" plus a requirement to have a specification.  If you think a specification is too onerous, I'd like to understand why.  You have defined the three new entries in this document in a single small paragraph, meeting the requirement easily.  I don't think that it could be made much easier without compromising the openness of the protocol.


The new draft isn’t asking to change the underlying controller requirements, I was just providing background on what the original intent was and how it wasn’t expressed correctly in the final RFC. However, since RFC 9605 is issued and mandates specification required as the only way to get new entries added to the registry, there was no point in having a Change Controller column that always listed IETF, since there is no way for any other entities to register or change the values. Most of the recent RFC’s that establish Cipher Suite IANA registries don’t include a Change Controller column in them (see MLS, COAP, EDHOC, and others). Since we had to modify the registry to support the new cipher suites and the new columns, we decided it was worth dropping this un-needed column at the same time.

If this is not the correct way to proceed, I am fine with leaving the column and updating the draft. The expert review was a tangent and not related to why the column was actually dropped.

Aron