Re: [Curdle] Alissa Cooper's Discuss on draft-ietf-curdle-gss-keyex-sha2-09: (with DISCUSS)

[Alissa Cooper <[e-mail]>]

> On Jun 24, 2019, at 5:15 PM, Simo Sorce <[e-mail]> wrote:
> 
> On Mon, 2019-06-24 at 16:08 -0500, Benjamin Kaduk wrote:
>> On Mon, Jun 24, 2019 at 05:01:28PM -0400, Alissa Cooper wrote:
>>> 
>>> 
>>>> On Jun 24, 2019, at 4:19 PM, Benjamin Kaduk <[e-mail]> wrote:
>>>> 
>>>> On Mon, Jun 24, 2019 at 01:18:08PM -0700, Alissa Cooper via Datatracker wrote:
>>>>> Alissa Cooper has entered the following ballot position for
>>>>> draft-ietf-curdle-gss-keyex-sha2-09: Discuss
>>>>> 
>>>>> When responding, please keep the subject line intact and reply to all
>>>>> email addresses included in the To and CC lines. (Feel free to cut this
>>>>> introductory paragraph, however.)
>>>>> 
>>>>> 
>>>>> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
>>>>> for more information about IESG DISCUSS and COMMENT positions.
>>>>> 
>>>>> 
>>>>> The document, along with other ballot positions, can be found here:
>>>>> https://datatracker.ietf.org/doc/draft-ietf-curdle-gss-keyex-sha2/
>>>>> 
>>>>> 
>>>>> 
>>>>> ----------------------------------------------------------------------
>>>>> DISCUSS:
>>>>> ----------------------------------------------------------------------
>>>>> 
>>>>> "The IESG is considered to be the owner of all these key exchange
>>>>>  methods; this does NOT imply that the IESG is considered to be the
>>>>>  owner of the underlying GSS-API mechanism."
>>>>> 
>>>>> I don't understand this text. What does it mean for the IESG to be the owner of a method?
>>>> 
>>>> The IESG has change control for the SSH key exchange method; the IESG does
>>>> not necessarily have change control for the underlying GSS-API mechanism.
>>> 
>>> Thanks. I think it would be clearer to say that than to talk about ownership. But given that the registry policy is IETF Review, is it really appropriate to say that the IESG has change control? Would s/IESG has change control/IETF has change control/ be more accurate?
>> 
>> I'll wait to see what the authors think about the "ownership" vs. "change
>> control" pedagogy.  With respect to IESG vs. IETF, it seems that the IESG
>> is who is tasked with determining the consensus of the IETF, so in practice
>> it would be the IESG with control, even if in some formal sense the
>> authority is vested with the IETF.  (I thought it was near-universal to
>> list the IESG as the contact when the IETF is the nominal responsible
>> party; is this case different somehow?)
> 
> If I remember correctly this language has been inherited untouched from
> the original RFC we are updating.
> 
> If at all possible we'd like to maintain consistency with the previous
> language and not change it.

Since this document updates RFC 4462, would it be possible to add a note (perhaps in Section 3) indicating that the term “owner” is synonymous with “change controller” in both documents?

Thanks,
Alissa

> 
> Simo.
> 
> -- 
> Simo Sorce
> RHEL Crypto Team
> Red Hat, Inc
> 
> 
> 
>