Re: [saag] SSH & Ntruprime

On Wed, Apr 10, 2024 at 7:28 PM Eric Rescorla <ekr@rtfm.com> wrote:
>
>
>
> On Wed, Apr 10, 2024 at 7:05 PM StJohns, Michael <msj@nthpermutation.com> wrote:
>>
>> On Wed, Apr 10, 2024 at 21:06 Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:
>>
>>> I'll also note the title and content of 8447 says that it
>>> applies to TLS and DTLS registries so I'm confused by any
>>> argument that says that 8447 affects other protocols other
>>> than in the abstract sense that it demonstrates a setup
>>> that could in principle be copied.
>>>
>>> So, WRT this thread: IMO 8447 is fine, but that does not
>>> mean everyone else needs to operate as if they're TLS,
>>> and in particular, 8447 has zero implication for how best
>>> to handle anything to do with SSH.
>>
>>
>> Yup. And had EKR not mentioned RFC8447 might be a good model for SSH earlier in this chain, I wouldn’t be saying anything now.
>
>
> RFC 8447 aside, the text in RFC 9519 [0] appears to me to at least
> implicitly permit registration without any IETF specification at
> all. https://www.rfc-editor.org/rfc/rfc9519.html#section-3
>
>   Expert Review [RFC8126] registry requests are registered after a
>   three-week review period on the <ssh-reg-review@ietf.org> mailing
>   list, and on the advice of one or more designated experts. However,
>   to allow for the allocation of values prior to publication, the
>   designated experts may approve registration once they are satisfied
>   that such a specification will be published. Registration requests
>   sent to the mailing list for review SHOULD use an appropriate
>   subject (e.g., "Request to register value in SSH protocol parameters
>   <specific parameter> registry").
>
> The term "such specification" is ambiguous (and I don't see any other
> text in 9519 about it) but here's RFC 8126 Expert Review says
> about:
>
>    For the Expert Review policy, review and approval by a designated
>    expert (see Section 5) is required.  While this does not necessarily
>    require formal documentation, information needs to be provided with
>    the request for the designated expert to evaluate.  The registry's
>    definition needs to make clear to registrants what information is
>    necessary.
>
> I don't know how the experts have been interpreting this text, but
> I think it's at least arguable that this is consistent with having
> a "specification" just exist somewhere, e.g., on someone's Web page.
> It doesn't seem to require that it be stable, for instance.

In the filing cabinet behind the door below the stairs marked beware of puma?

More seriously I would when interpreting strike out that entire
sentence in RFC 9519 as scrivener's error. The process described
doesn't have a spec, Specification Required is stricter than Expert
Review in RFC 8126, applying all the requirements and more. If the
authors of RFC 9519 had wanted a specification to be required they
knew how to say that consistently, and clues in the text that indicate
they may at one point have wanted to are insufficient to conclude that
the specification is in fact required. But maybe that's wrong and if
someone had noticed this in last call we'd have gone back and changed
to Specification Required.

Sincerely,
Watson Ladd

>
> -Ekr
>
>
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag

-- 
Astra mortemque praestare gradatim