[OPSAWG] TACACS TLS 1.3 was Status of T+/TLS work

From: OPSAWG <opsawg-bounces@ietf.org> on behalf of heasley <heas@shrubbery.net>
Sent: 31 October 2022 17:26
To: Joe Clarke (jclarke)
Cc: heasley; draft-ietf-opsawg-tacacs-tls13@ietf.org; opsawg@ietf.org
Subject: Re: [OPSAWG] Status of T+/TLS work

Mon, Oct 31, 2022 at 04:59:33PM +0000, Joe Clarke (jclarke):
> Thanks for the summary, heas.
>
> I re-read the text, and, yes, you do cover a number of the situations (including potential ways to handle clients with TLS going forward).  On another doc I reviewed as part of the OPS DIR, it was decided that grouping text about (in that case) forward-looking considerations was worth it.
>
> In this case, the document is short, and perhaps that isn’t needed.  I defer to the general views of the WG and the authors on this.

Super; thanks!  I will publish the current version with the other fixes that
you requested later today.

<tp>

Looking back to see what has happened to get to where we are I find a challenge.  One I-D, then two, name changes. comments seemingly posted against one I-D with the Subject: of the other and nothing anywhere to say what has happened, how we got to where we are.

I see it as necessary for the TACACS.TLS13 I-D to record how it came into being.  The datatracker cannot cope with what has happened.  Nothing major, just this was first published as ... the Wg decided to split the I-D into two, one for ... and the other for the addition of TLS13 and nothing more, the latter first appearing as ..  and then as in...  filling the dots with the appropriate identifiers.

I would leave such a paragraph in the document permanently but suspect that the consensus will be to remove it from the RFC.

After this, I am not surprised to find that the terminology in the I-D is IMHO a nonsense.  There are repeated references to 'TCP/IP connections '; if only.  If we had them, then the Internet would be so much simpler, faster and more reliable; we could abolish several WG and put them to work on something productive!  I trust you know what I mean.

More generally, I suspect that every reference to 'TCP/IP' is wrong.  For me, this needs fixing first before e/g/ seeing if the challenges of TLS13 are met.   Terminology needs to be consistent but it also needs to be accurate.

The I-D does not say, but perhaps should, that nothing therein applies to TLS1.2

Tom Petch
_______________________________________________
OPSAWG mailing list
OPSAWG@ietf.org
https://www.ietf.org/mailman/listinfo/opsawg