Re: [openpgp] Éric Vyncke's No Objection on draft-ietf-openpgp-crypto-refresh-12: (with COMMENT)

[Paul Wouters <[e-mail]>]

> On Dec 13, 2023, at 16:26, Stephen Farrell <[e-mail]> wrote:
> 
> 
> Hiya,
> 
> Answering the shepherd-like questions...
> 
>> # COMMENTS (non-blocking)
>> ## The most concise shepherd's write-up
>> The justification for the intended status is just "PS"... not even expanded...
> 
> It seemed obvious:-) If you'd like it in more words, this is
> adding new crypto as a revision of a complex spec that has
> lots of history and significant deployment so PS seems like
> the only sensible target.

It also is a bis document of a standards track document 😀

> Not sure "very rough" is right in this case so maybe the write-up was
> a bit misleading (sorry if so). There's good consensus among currently
> active WG participants, which includes a set of implementers. The issue
> is that the main contributor to one important implementation no longer
> support the draft. That's a shame IMO, but doesn't make the consensus
> very rough.

It also included a positive voice of at least one author of RFC 4880 and possibly two (I’d have to hunt the archives to confirm). The person now objecting and claiming to speak as “the old group of openpgp” was not listed as author in RFC4880.

>> 
> 
>> ## IANA registries
>> Should this I-D be an opportunity to reserve some registry values for a FCFS
>> allocation ?
> 
> The WG did not discuss FCFS, but did explicitly discuss lowering the bar
> for registration of new codepoints in many registries. I'd be surprised
> though if there was consensus to take that as far as FCFS registrations.
> That's fairly consistent with many other crypto related registries where
> we generally only want to get as "loose" as specification required, e.g.
> to avoid registration of codepoints for snake-oil or secret algorithms,
> which FCFS would permit.

Indeed. Especially because encrypted messages tend to still need to be decryptable decades into the future. So a Delegated Expert with specification required seems more appropriate.

Paul