Re: [saag] SSH & Ntruprime

[Christian Huitema <[e-mail]>]

On 3/26/2024 8:09 PM, Michael Richardson wrote:
> 
> Orie Steele <[e-mail]> wrote:
>      > 1. Publish SSH related specifications as RFCs
>      > 2. Support the review process from RFC9519 (We're working to resolve the
>      > issue with the list, thanks for reporting it)
> 
>      > I don't think using IDs to document SSH algorithms and then never
>      > publishing those drafts helps either community.
> 
> It's a lot of effort and money to publish a document for an algorithm that
> some say isn't as secure as claimed, and perhaps shouldn't be widely implemented.
> 
> a) anyone can register [e-mail] in the SecSH ecosystem, and openssh
>     has done exactly that, and really, it's done.
> 
> b) if someone wants "foobar", I'm fine with *any stable web page* (including
>     ietf.org/archive/foobar).  That's what **Specifications Required** means, and
>     please let's not raise the bar here.
>     If necessary, we can loop it through archive.org, which is what the RPC
>     is doing for other references in RFCs.

+1

The "specification required" policy has the big advantage of not using 
code-point registration as a gatekeeping tool. There are some rare 
conditions were gating is necessary, for example when the code space is 
really small. But otherwise, code-point gatekeeping becomes a tools that 
insiders can use to pick favorites, and the net result is to force 
communities to develop workarounds outside the IETF and IANA.

The current rule is fine.

-- Christian Huitema