Re: [Curdle] Alissa Cooper's Discuss on draft-ietf-curdle-gss-keyex-sha2-09: (with DISCUSS)

[Benjamin Kaduk <[e-mail]>]

On Mon, Jun 24, 2019 at 05:01:28PM -0400, Alissa Cooper wrote:
> 
> 
> > On Jun 24, 2019, at 4:19 PM, Benjamin Kaduk <[e-mail]> wrote:
> > 
> > On Mon, Jun 24, 2019 at 01:18:08PM -0700, Alissa Cooper via Datatracker wrote:
> >> Alissa Cooper has entered the following ballot position for
> >> draft-ietf-curdle-gss-keyex-sha2-09: Discuss
> >> 
> >> When responding, please keep the subject line intact and reply to all
> >> email addresses included in the To and CC lines. (Feel free to cut this
> >> introductory paragraph, however.)
> >> 
> >> 
> >> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> >> for more information about IESG DISCUSS and COMMENT positions.
> >> 
> >> 
> >> The document, along with other ballot positions, can be found here:
> >> https://datatracker.ietf.org/doc/draft-ietf-curdle-gss-keyex-sha2/
> >> 
> >> 
> >> 
> >> ----------------------------------------------------------------------
> >> DISCUSS:
> >> ----------------------------------------------------------------------
> >> 
> >> "The IESG is considered to be the owner of all these key exchange
> >>   methods; this does NOT imply that the IESG is considered to be the
> >>   owner of the underlying GSS-API mechanism."
> >> 
> >> I don't understand this text. What does it mean for the IESG to be the owner of a method?
> > 
> > The IESG has change control for the SSH key exchange method; the IESG does
> > not necessarily have change control for the underlying GSS-API mechanism.
> 
> Thanks. I think it would be clearer to say that than to talk about ownership. But given that the registry policy is IETF Review, is it really appropriate to say that the IESG has change control? Would s/IESG has change control/IETF has change control/ be more accurate?

I'll wait to see what the authors think about the "ownership" vs. "change
control" pedagogy.  With respect to IESG vs. IETF, it seems that the IESG
is who is tasked with determining the consensus of the IETF, so in practice
it would be the IESG with control, even if in some formal sense the
authority is vested with the IETF.  (I thought it was near-universal to
list the IESG as the contact when the IETF is the nominal responsible
party; is this case different somehow?)

Thanks,

Ben