[Gendispatch] Re: Proposal: New Naming and Versioning Scheme for BCP and STD documents

[Timo Gerke <[e-mail]>]

Dear GENDISPATCH Community,

To refine the points regarding modular structure and persistent
identifiers (Points 1 & 2 of my previous mail), I would like to provide
a practical example using the technical content of
draft-ietf-tls-rfc8446bis (RFC-to-be 9846) as a baseline.

Instead of a monolithic document, the Full Standard (STD-) would be 
organized into a persistent, modular series. This architecture decouples 
the stable protocol logic from the rapidly evolving cryptographic lifecycle:

     STD-<TBA>
	-1 	Core Specification – Handshake state machine and
		negotiation logic (Algorithm-agnostic).
		Note: Based on 30 years of operational history, this
		part is "Proven by Reality" and should be eligible for
		the proposed Process Waiver.

	-2 	Key Exchange (X25519, X448, secp256r1) [Mandatory]

	-3 	Signature Algorithms (EdDSA, ECDSA/secp256r1,
		RSASSA-PSS) [Mandatory]

     	-4 	Encryption Algorithms (AEAD) (AES-GCM,
		ChaCha20-Poly1305) – [Mandatory]

	-5	Hash Functions (SHA-256, SHA-384, SHA-3) – [Mandatory]

	-6	ALPN

	-7	ECH

	-8	SNI)
		This allows for a surgical "withdrawn" status for
		specific extensions without impacting the core suite.

	-9	Strict Compliance Profile, including Verification
		Procedures (for Parts -1 to -5). This is the definitive
		anchor for interoperability. "Strict Compliance" 	
		requires 100% successful validation against the provided
		test vectors (Boolean Logic: Pass/Fail).

	-10	Extended Compliance Profile (Verification Procedures for
		Parts -6 to -8).

	-19	Verification Procedures for the preceding block (Parts 	
		11–18). (This periodic grouping ensures scalability as
		the standard grows).

Key Advantages:

- Single Source of Truth: By adopting annual versioning (e.g.,
   STD-<TBA>-X:2026), if required, the identifier remains stable while
   the content is updated only when technical advancements necessitate a
   new revision.

- Maintenance-Friendly: While the initial transition will trigger a
   "maintenance avalanche" to consolidate legacy documents, it is a
   necessary step to pay off the technical debt of the current fragmented
   RFC system. Namespace Integrity: Separating the Standards Track
   (PSTD/STD) from the archival RFC namespace prevents "namespace
   inflation" and provides engineers with a clear, versioned reference.

Each part would include its relevant IANA Registry Mappings to ensure
full encapsulation. I look forward to your thoughts on this 
architectural approach.

Best regards,

Timo Gerke

Am 22.04.26 um 20:02 schrieb Timo Gerke:
> Dear GENDISPATCH Community,
> 
> I propose modernizing the STD and BCP series to eliminate document
> contradictions and provide a Single Source of Truth for the industry:
> 
>     1. Persistent Identifiers & Efficient Versioning
>        Maintain stable IDs for both series (e.g., BCP 195 remains
>        BCP 195). Updates should be published as new annual revisions
>        (e.g., BCP 195:2026) instead of assigning new, disconnected
>        RFC numbers. This avoids "namespace inflation" and allows for
>        infinite updates without confusing suffixes like ter or quater. To
>        ensure maximum transparency, each revision should be accompanied
>        by a unified diff (diff -u).
> 
>     2. Modular STDs (Part-Structure): The STD series should adopt a
>        multi-part structure where Part 1 is always the Core
>        Specification. This consolidation naturally involves resolving
>        existing contradictions and harmonizing terminology across
>        previously separate documents.
> 
>     3. Security by Reference: Application standards should simply mandate
>        that the "latest revision of the relevant Security BCP" should be
>        implemented. This decouples protocol logic from the security
>        lifecycle (e.g., TLS updates).
> 
>     4, Process Waiver: For mature protocols (in operational use for 10+
>        years), the "Implementation Report" requirement for advancement to
>        Internet Standard should be waived.
> 
> While Proposed Standards (PSTD) may still reside in the traditional
> RFC archival system, once a document attains STD or BCP status, it
> should transition to this persistent model. Since technical changes are
> finalized at the PSTD stage, establishing referential integrity early is
> logical and efficient.
> 
> I look forward to your feedback.
> 
> Best regards,
> 
> Timo Gerke
> 

-- 
Timo Gerke
Lohkoppelweg 40
22529 Hamburg
Germany
Fon: [phone]
Fax: [phone]

If you think technology can solve your security problems,
then you don't understand the problems and you don't
understand the technology.
     Bruce Schneier, amerikanischer Kryptograph