Re: [kitten] Murray Kucherawy's No Objection on draft-ietf-kitten-krb-spake-preauth-11: (with COMMENT)

[Nico Williams <[e-mail]>]

On Thu, Jan 18, 2024 at 08:17:52PM -0800, Murray S. Kucherawy wrote:
> On Thu, Jan 18, 2024 at 10:15 AM Greg Hudson <[e-mail]> wrote:
> > The IANA Kerberos preauthentication registry contains references
> > to numerous expired drafts besides this one.
> 
> I think that's unfortunate, since the whole idea of having a specification
> be required is that it needs to be relatively stable, and something that
> has expired is, to me at least, not.

I-Ds expire, yes, but they are not deleted, neither from the Internet
nor from the IETF I-D archive.  I-Ds are versioned, and each version is
"stable".  I believe an I-D counts as "specification exists" under RFC
2434.

When an RFC is desired one might want to use IETF Consensus as the
registry's allocation policy.  In this case the registry in question has
an allocation policy of Expert Review, which means that a specification
is not even needed, let alone an RFC.

Many Internet protocols require IANA registry allocations prior to RFC
publication for good reasons:

 - publishing an RFC just to obtain an allocation for a work-in-progress
   is impractical

 - not having allocations prior to publication greatly complicates
   testing and soaking

 - private use namespaces do work, but then when upon publication
   _different_ allocations are obtained there then arises an upgrade
   problem in the field that may not be trivial to manage

It's not just Kerberos, but TLS and others, that have used I-Ds as
"specifications".

Often what we want is just Expert Review, and sometimes we want both
Expert Review _and_ Specification Exists.  RFC 2434 doesn't limit
allocation policies to the ones it lists, as it terms them "example
policies, some of which are in use today", but this registry currently
requires only Expert Review.  I believe Expert Review is appropriate for
this registry.

Nico
--