Re: [saag] SSH & Ntruprime

[Eric Rescorla <[e-mail]>]

On Wed, Apr 10, 2024 at 7:05 PM StJohns, Michael <[e-mail]>
wrote:

> On Wed, Apr 10, 2024 at 21:06 Stephen Farrell <[e-mail]>
> wrote:
>
> I'll also note the title and content of 8447 says that it
>> applies to TLS and DTLS registries so I'm confused by any
>> argument that says that 8447 affects other protocols other
>> than in the abstract sense that it demonstrates a setup
>> that could in principle be copied.
>>
>> So, WRT this thread: IMO 8447 is fine, but that does not
>> mean everyone else needs to operate as if they're TLS,
>> and in particular, 8447 has zero implication for how best
>> to handle anything to do with SSH.
>>
>
> Yup. And had EKR not mentioned RFC8447 might be a good model for SSH
> earlier in this chain, I wouldn’t be saying anything now.
>

RFC 8447 aside, the text in RFC 9519 [0] appears to me to at least
implicitly permit registration without any IETF specification at
all. https://www.rfc-editor.org/rfc/rfc9519.html#section-3

  Expert Review [RFC8126] registry requests are registered after a
  three-week review period on the <[e-mail]> mailing
  list, and on the advice of one or more designated experts. However,
  to allow for the allocation of values prior to publication, the
  designated experts may approve registration once they are satisfied
  that such a specification will be published. Registration requests
  sent to the mailing list for review SHOULD use an appropriate
  subject (e.g., "Request to register value in SSH protocol parameters
  <specific parameter> registry").

The term "such specification" is ambiguous (and I don't see any other
text in 9519 about it) but here's RFC 8126 Expert Review says
about:

   For the Expert Review policy, review and approval by a designated
   expert (see Section 5) is required.  While this does not necessarily
   require formal documentation, information needs to be provided with
   the request for the designated expert to evaluate.  The registry's
   definition needs to make clear to registrants what information is
   necessary.

I don't know how the experts have been interpreting this text, but
I think it's at least arguable that this is consistent with having
a "specification" just exist somewhere, e.g., on someone's Web page.
It doesn't seem to require that it be stable, for instance.

-Ekr