Re: [kitten] review of draft-ietf-kitten-krb-spake-preauth-00

[Benjamin Kaduk <[e-mail]>]

Sorry for the slow reply; I was on vacation last week.

On Tue, Aug 22, 2017 at 06:49:58PM -0400, Greg Hudson wrote:
> On 08/22/2017 06:30 PM, Robbie Harwood wrote:
> >> I tend to agree that any mandatory-to-implement policy should be
> >> written into this draft, and not be part of the registry.
> > 
> > The disadvantage of having mandatory-to-implement items defined but not
> > in the registry is that it fragments the numbering.  For example, in our
> > Kerberos SPAKE Groups registry, currently P-256 is required, and
> > assigned ID Number: 1.  If we remove it from the registry, it won't have
> > an ID Number.  (Unless we give it one a different way.)
> 
> I think I miscommunicated.  P-256 should be in the registry, but if we
> want to specify that it is mandatory-to-implement, I believe we should
> say that in the RFC outside of the IANA registry.

That's my understanding as well -- the MTI items should still be in
the registry, but the registry is not the best place to specify the
MTI nature.  Making something MTI for a standards-track document
"should" require standards-action, so there's not much value in having
a field in the registry when there will have to be a new document
for such things anyway.

-Ben