[saag] Re: New Version Notification for draft-rsalz-crypto-registries-00.txt

["Salz, Rich" <[e-mail]>]

>>What problem are you trying to solve with this document?
>>Could we start with a problem statement?
>
> It was discussed during SAAG. See the tail end of the chat at https://zulip.ietf.org/#narrow/stream/337-saag <https://zulip.ietf.org/#narrow/stream/337-saag>

>That link leads to a login prompt that requires me to run remotely
>controlled JavaScript code in my browser. Is the chat publicly
>archived? Wouldn't it be nice if things had to be "permanent and
>readily available" to be used as reference material? :)

Ha.

The Zulip stream requires a datatracker login. I don't know if there's a public archive available, but here are the parts I meant:
author	"Richard Barnes"
text	"<p>@Eric - yes, that's what i meant.  make a thing that writes the TLS-like policy in a referenceable way, to avoid copying</p>"
author	"Richard Barnes"
text	"<p>since several groups have already found it useful, and had to copy by value</p>"
author	"Stephen Farrell"
text	"<p>+1 to having the tls-style setup documented in a way that can be referenced (if you can find a willing victim to do it:-)</p>"
author	"Rich Salz"
text	"<p>Turning 8447bis into a generic document seems easy if people think it worthwhile.</p>"
author	"Richard Barnes"
text	"<p>Thank you for volunteering @Rich</p>"
author	"Orie Steele"
text	"<p>^</p>"
author	"Rich Salz"
text	"<p>sure.  since 2026/2418 is now blocked waiting for someone to propose a bof.</p>"
time	"2024-11-08T10:30:05Z"

>Good. I don't claim the document encourage rejecting non-NIST crypto,
>but I think the document may be a useful tool for people who want to
>delay deployment of strong non-sanctioned crypto. The document suggests
>"Specification Required" for all registries. This is a limitation
>compared to broad set of different policies allowed by RFC 8126.

Yes it limits the options defined by 8126, and I understand your concern about this being used as a tool to delay. I think there were reasons why SSH had some issues with its registries, and I trust that the RFC makes things smoother. But I understand we may disagree on that.