Re: [rfc-i] I-D expiry [was Re: RFCs vs Standards]

[Phillip Hallam-Baker <[e-mail]>]

On Mon, Dec 9, 2024 at 2:57 PM Eliot Lear <[e-mail]> wrote:

> Yes. and now we are repeating the SAAG discussion in its entirety.
>

Like we don't repeat it there every 6 months.

I haven't waded in this time round. But as I always say, the solution to
these issues is to design the protocol so you can use an OID as an
algorithm identifier.

The big advantage of OIDs for algorithms is that anyone can define them
without IETF involvement and thus the issue of endorsement simply doesn't
come up.

XML Signature uses URIs and there is an OID URI.

For other protocols which use labels, I would construct a single registry
for all algorithms with the JOSE and COSE tags and tell all apps going that
route to use them. And I would make that specification required, again to
avoid endorsement.