Re: [kitten] Murray Kucherawy's No Objection on draft-ietf-kitten-krb-spake-preauth-11: (with COMMENT)

[Greg Hudson <[e-mail]>]

On 1/18/24 23:17, Murray S. Kucherawy wrote:
>>> In Section 12, we're telling the Designated Experts that an I-D
>>> counts as a specification, even if it is never published as an RFC.

I misunderstood this comment as referring to the PA-SPAKE (151) 
registration in the existing IANA Kerberos preauthentication type 
registry.  Because of this misunderstanding, I initially replied that I 
assumed the comment wasn't actionable.

The comment was actually about the sentence "It is sufficient to have an 
Internet-Draft (that is posted and never published as an RFC)..." in the 
text establishing two new registries.  As Amanda Baber pointed out, this 
text also appears in RFC 8447.

Speaking as an implementer: we have seen numerous expensive mishaps 
related to number spaces in the Kerberos ecosystem over the decades, but 
to my knowledge none of them have involved implementers being warned 
away by references to expired I-Ds in registries.  I believe that the 
advantages of allowing I-Ds as specification references (they are 
in-house, long-lasting, and have a low barrier to entry) outweigh the 
disadvantages (they contain the word "draft" and may say that they are 
expired when you look them up).  This is a fairly weak preference.

Speaking as a document editor: based on the positions of Nico Williams 
and Simo Sorce, I think changing this sentence would not reflect WG 
consensus.  I hear and understand Eliot Lear's argument that this 
document should not endeavor to change global IANA policy regarding 
specification-required registries, but given the precedent in RFC 8447, 
I agree with Stephen Farrell that it would actually be a policy change 
to prevent new registries from explicitly allowing I-D specification 
references.

So for the next draft revision, I do not plan to change this sentence. 
If the IETF chooses to change it before publication, I do not object.