Re: [saag] SSH & Ntruprime

Michael StJohns <msj@nthpermutation.com> Thu, 11 April 2024 16:26 UTC

Return-Path: <msj@nthpermutation.com>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F379CC14F70E for <saag@ietfa.amsl.com>; Thu, 11 Apr 2024 09:26:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.895
X-Spam-Level:
X-Spam-Status: No, score=-1.895 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nthpermutation-com.20230601.gappssmtp.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Di7eER-TsrEk for <saag@ietfa.amsl.com>; Thu, 11 Apr 2024 09:26:11 -0700 (PDT)
Received: from mail-qt1-x830.google.com (mail-qt1-x830.google.com [IPv6:2607:f8b0:4864:20::830]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 56696C14F6F6 for <saag@ietf.org>; Thu, 11 Apr 2024 09:26:11 -0700 (PDT)
Received: by mail-qt1-x830.google.com with SMTP id d75a77b69052e-434a76386feso33762461cf.1 for <saag@ietf.org>; Thu, 11 Apr 2024 09:26:10 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nthpermutation-com.20230601.gappssmtp.com; s=20230601; t=1712852769; x=1713457569; darn=ietf.org; h=in-reply-to:from:references:cc:to:content-language:subject :user-agent:mime-version:date:message-id:from:to:cc:subject:date :message-id:reply-to; bh=bBqYxZaeaEJRUwxOe7x3ks2zNI3BwORcBz31mXSp3SE=; b=MJhzvXyIgwWiCTnBXf+LYCeoQDhV1PzjmSbO80us3U1BQWRwkmEwClmgwKMCDa7WF5 QmDWXVQJQMx5r1dwxUNU7qGzNmy7rjfbQXwtAnhVMDluQPByZug5oY7rDZ3i6Zbp7V7M bgeoTML6DSe3hTuls+wxiKBvsgTfXLKB25hMMUhkWuoTgePjRkk7n5caWj4Hz8H8cM6v Jpu9A0JULsNqsE/P0cpd2m475nSTRFFtB6us1IIjBPZvt7s6TVq0P4F+8x0XYjD5/yWs 9sO4iHccSicJpqC6YHit7Rn/lod+1+yu92lL1/17y1ToRUZikymonVwHqIC96uN0ZBDN ehlQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1712852769; x=1713457569; h=in-reply-to:from:references:cc:to:content-language:subject :user-agent:mime-version:date:message-id:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=bBqYxZaeaEJRUwxOe7x3ks2zNI3BwORcBz31mXSp3SE=; b=NE+bUnAV0OEuf9Y0yRPGbYLU3xQykB8hEff970oCW/RoybW6ujxqOMkNOqTZs5cDhd 5JeNavZ3+V3oHbPZ/LTMnJB6Wi7n61HMskWOoPKyMLxARq2R7O3o8z4gkDFHh12hgMby gNaqE7WntaiJO5JznFmfQM86SAXpw1l4N6weH4zeFUErZvm8nXQDUz9rbvJYnargR3Dw m439li3Pd5exYQmCuxn02gcOsqtnVlKNJYCpD589fzjbb3+KET92w2XZA2bvoZNWMD/w e065tutcMbZp/p3T2xeJLDXB4KecitTxRNOFowr1ru5P6k+Fj5PTktqhv9kDa8kOsKyA 9Kgg==
X-Gm-Message-State: AOJu0YwoTOC2Lvo2oeWba18oqBhu5d7qW0+hn+xWaBYu/QZj5ueTI02a 6LpAO4PG0sysWKN2GlGDbwasikrhRHb4eE477r4i07PLOqGPUJ9BqbeQwMPfWm40LuYlas+7zKD 2
X-Google-Smtp-Source: AGHT+IHYeLILUJwf2+dsB98aCqV1V+rTiFPP4IkhN1+Wt15JrWTFqJcB5C0kRpzAUjrYIMQdHI5etA==
X-Received: by 2002:a05:622a:3:b0:434:f229:28cf with SMTP id x3-20020a05622a000300b00434f22928cfmr163113qtw.45.1712852769496; Thu, 11 Apr 2024 09:26:09 -0700 (PDT)
Received: from [192.168.1.23] (pool-108-31-156-76.washdc.fios.verizon.net. [108.31.156.76]) by smtp.gmail.com with ESMTPSA id r10-20020ac85e8a000000b004347d76f43csm1085897qtx.79.2024.04.11.09.26.08 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 11 Apr 2024 09:26:09 -0700 (PDT)
Content-Type: multipart/alternative; boundary="------------0A7IfveOWeuwks0tpBBBJteo"
Message-ID: <4148ae7e-80b9-4e24-8d61-a95882313600@nthpermutation.com>
Date: Thu, 11 Apr 2024 12:26:07 -0400
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US
To: Watson Ladd <watsonbladd@gmail.com>
Cc: Security Area Advisory Group <saag@ietf.org>, Stephen Farrell <stephen.farrell@cs.tcd.ie>
References: <05D73B77-ECFB-43E9-A2A8-00D46F63FC32@aiven.io> <20240405162821.1801419.qmail@cr.yp.to> <CAGL5yWaJXRDyiQ=w2XJcoFhCQ3JDriqO+jAcOKz7J4kW2PY=uw@mail.gmail.com> <87o7ahzi8c.fsf@kaka.sjd.se> <CABcZeBO-_k3pTsLAqOm3c5F8Cnbnd1mtdpuaoQicoCRBLPZLLg@mail.gmail.com> <d2bd2378-4de4-4426-b2f4-fbcff6de5d2a@cs.tcd.ie> <CABcZeBPtRoGg=diFd2MjRXn0SD+KMJSC65ROe55SpsdcLL_m_g@mail.gmail.com> <9da5e8a6-b329-41cd-89c1-4423f6739341@nthpermutation.com> <CABcZeBN-Oy-vG=VYwqAmd=Fi7AWyp1pQPnMQMhe0-EzOPZwrsQ@mail.gmail.com> <7127f31a-bb6f-467a-aa67-55b46e7f95f2@nthpermutation.com> <3bef7fff-6a84-42ba-a2ee-a5e6bd60c816@cs.tcd.ie> <CANeU+ZDvWWd+HmtXx=4x0zgO6FNfeqwzybU+jjVHzFWqkgz2Rg@mail.gmail.com> <CACsn0ckmW9oSvUarqRYDVLJS6K-6_c2j7UhYTM6TpdYjr_GrQA@mail.gmail.com>
From: Michael StJohns <msj@nthpermutation.com>
In-Reply-To: <CACsn0ckmW9oSvUarqRYDVLJS6K-6_c2j7UhYTM6TpdYjr_GrQA@mail.gmail.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/saag/oVx8QuiXFDwX49xj_B5h-J3VuHA>
Subject: Re: [saag] SSH & Ntruprime
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/saag/>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 11 Apr 2024 16:26:12 -0000

On 4/10/2024 10:07 PM, Watson Ladd wrote:
>> According to the datracker, you were the document shepherd, but the shepherd report that Sean added to the tracker was done against the -03 draft (note the date of the report vs the post date of -04).  The -04 draft was where the notes were added.  None of the text in either the shepherd report nor the last call announcement text mentioned that  IDs were now acceptable for Specification Required references.
> Why do you think that this applies to anything other than the
> registries specifically named in the RFC?
> Sincerely,
> Watson

Hi -

Well context should have told you that the comment you snipped out was 
specific to RFC8447, but still let's assume for argument's sake that it 
wasn't completely clear:

Not sure you read all of the thread, but a) 8447 refers to a specific 
set of registries and rewrote the meaning of "Specification Required" 
for those registries, b) EKR suggested that 8447 was enough of a 
precedent that this new meaning could be carried to other registries, c) 
I suggested that more work needs to be done before we give up on IDs as 
"draft documents" and "to cite them as other than 'work in progress'" 
and that RFC8447 was probably not vetted completely by the community for 
this change - however limited.

So - sort of?   A well meaning participant could read 8447 and the 
related registries and go "Ooooh - shiny - I want to do that too!"  If 
that document were as innocuous and registry boiler plate, its possible 
that could make it through all of the filters that 8447 made it 
through.  I'd prefer that not happen without actually changing the 
process and resolving what it actually means to cite an ID as a code 
point reference.

So that's where we are.

Or at least where I am.

Mike

(*sigh* too late to change the subject line - sorry should have been 
done a long while back).