Re: [kitten] Comments on draft-ietf-kitten-password-storage-00

[Alexey Melnikov <[e-mail]>]

Hi Sam,

On 04/11/2020 20:47, Sam Whited wrote:
> Following up on this after our conversation out-of-band since I
> apparently misunderstood this sentence:
>
> On Wed, Nov 4, 2020, at 13:03, Ludovic BOCQUET wrote:
>> Note: The final "draft-ietf-kitten-password-storage" must be validated
>> like a RFC after the next two I-Ds, it is really important.
> I appreciate your confidence and desire to see this published as an RFC,
> but I don't think we can set such an aggressive timeline on it.
>
> I'll be the first to complain about working with the IETFs obtuse
> process (someone was kind enough to sit me down and walk me through the
> whole thing on video chat and I still have no idea how any of it works
> or what my role as an author is, the tools are impossible to use, the
> format is impossible to write, etc.), but picking an arbitrary number of
> drafts before advancing a document with a lot of subtle bits that need
> expert review doesn't seem like a good idea to me.
>
> Sorry, I'd love to see it advance too, but I'm not sure it's ready
> quite yet. We have plenty of time to see what happens with the other
> SCRAM I-D first. If one document or the other looks like it's ready to
> advance, we can reevaluate this position before doing so. Don't worry,
> if the new SCRAM mechanisms look like they're going to work out, we'll
> get them in there!

I am Ok with you not including SCRAM-SHA-512, etc until these documents 
are approved for publication or at least adopted by the Kitten WG.

As far as the IETF process is concerned, if you include a normative 
reference to it in your draft now, your document couldn't be published 
as an RFC until after all normative references are published as RFCs.

> Although I haven't heard many other opinions; if waiting on linking the
> other SCRAM I-Ds seems too conservative I'd love to be told I'm wrong by
> more seasoned IETF folks.
>
> Thanks,
> Sam