Re: [secdir] Secdir review of draft-ietf-uta-tls-for-email-03

[Stephen Farrell <[e-mail]>]

Hi Radia,

Thanks for the review.

On 30/01/2020 16:30, Radia Perlman wrote:
> While there is nothing to debate with respect to security, I do question
> whether it's better to release a document like this which specifies changes
> to RFC8314 or whether it would be better to update (and obsolete) that
> document so that this one would stand alone. Better yet would be to come up
> with a replacement version of RFC8314 that would not need to be updated
> again when TLSv1.2 needs to be replaced with TLSv1.3. Introducing new
> versions of TLS and obsoleting old ones should happen without having to
> update the - likely hundreds of - RFCs that refer to TLS.

I wish! Take a peek at the header of [1] for example:-)

Avoiding those issues in future was part of the logic
behind BCP195/RFC7525 [2] so if in future consumers of
TLS refer to BCP195, then we'll be in a good position
as BCP195 can just be updated to point to whatever RFC
has the current guidance for TLS1.3 and the RFCs that
refer to BCP195 won't need to change. That is happening
already to some extent, and the more the better I'd
say (hence this mail:-).

In the meantime, I think we gotta do this kind of
deprecation draft, even if it's a small pain in this
case (and a big pain for [1]).

Cheers,
S.

[1] https://tools.ietf.org/html/draft-ietf-tls-oldversions-deprecate-06
[2] https://tools.ietf.org/html/rfc7525