Re: [Dcrup] FW: IETF WG state changed for draft-ietf-dcrup-dkim-usage

[Scott Kitterman <[e-mail]>]

On Sunday, August 13, 2017 11:34:20 AM Murray S. Kucherawy wrote:
> On Sat, Aug 12, 2017 at 2:58 PM, Salz, Rich <[e-mail]> wrote:
> > At the IETF meeting last month there was strong consensus to have MUST NOT
> > for both generate and verify using SHA-1.  The discussion on the list had
> > one major participant opposed, who removed their objection once they
> > understood there were two separate documents.
> > 
> > Therefore, we are entering a one-week WG last call.
> > 
> > (Seth, please start preparing your shepherd writeup :)
> 
> Getting caught up after a long post-Prague vacation and recovery period.
> 
> The content and intent seem fine to me.  However, I was asked this after
> the meeting in Prague as to form, in the spirit of "it's not done until you
> can no longer remove things" or however that aphorism goes:
> 
> This document will be shown as "updates RFC6376".  Is replacing text in
> RFC6376 the right way to do this?  Or would that not be better left to an
> actual replacement document?  That is, why not just say "MUST NOT
> sign/verify with rsa-sha1", change the state of "sha1" to obsolete, change
> the minimum key size to 1024, and stop?  In particular, is it necessary to
> render "a=rsa-sha1" syntactically invalid by removing it from the ABNFs, or
> replace all of a section when only a couple of numbers are being tweaked?
> 
> Otherwise this seems ready to go.

The draft has been this way from the beginning, so I find it a bit surprising 
to see this in last call when you've reviewed this more than once before, but 
oh well.

I updated the ABNF in the draft because I think if we are going to kill it, we 
should kill it absolutely dead.  What is the benefit of retaining obsolete 
features that are MUST NOT use in the ABNF?

In terms of the structure of the draft, I wrote it this was so it's very clear 
what is being updated.  This has been discussed a bit, but I don't think 
anyone really objected so far.  I find it's common in IETF documents to see 
one document updates another, but then it's hard to really tell everything in 
the original document that's affected by the update.  This is an attempt to be 
clear about that.

That's why, but I may be the only one that feels that way.

Scott K