Re: [lamps] Benjamin Kaduk's Yes on draft-ietf-lamps-rfc5750-bis-06: (with COMMENT)

[Benjamin Kaduk <[e-mail]>]

Just to close the loop: thanks for the extra responses; your proposal
to not change the document text seems reasonable to me, now.

-Benjamin

On Wed, Jun 20, 2018 at 01:41:39PM -0700, Jim Schaad wrote:
> 
> 
> > -----Original Message-----
> > From: Benjamin Kaduk <[e-mail]>
> > Sent: Wednesday, June 20, 2018 12:43 PM
> > To: Jim Schaad <[e-mail]>
> > Cc: 'The IESG' <[e-mail]>; [e-mail];
> 'Russ
> > Housley' <[e-mail]>; [e-mail]; [e-mail]
> > Subject: Re: Benjamin Kaduk's Yes on draft-ietf-lamps-rfc5750-bis-06:
> (with
> > COMMENT)
> > 
> > Trimming the easily resolved bits...
> > 
> > On Wed, Jun 20, 2018 at 12:34:46PM -0700, Jim Schaad wrote:
> > >
> > >
> > > > -----Original Message-----
> > > > From: Benjamin Kaduk <[e-mail]>
> > > > Sent: Wednesday, June 20, 2018 12:11 PM
> > > > To: The IESG <[e-mail]>
> > > > Cc: [e-mail]; Russ Housley
> > > > <[e-mail]>; [e-mail]; [e-mail];
> > > > [e-mail]
> > > > Subject: Benjamin Kaduk's Yes on draft-ietf-lamps-rfc5750-bis-06:
> > > > (with
> > > > COMMENT)
> > > >
> > > >
> > > > Section 4.3
> > > >
> > > > Why are we going from SHOULD+ (in RFC 5750) to just SHOULD for
> > > > RSASSA- PSS with SHA-256?
> > >
> > > Big long discussion on this, but mostly because EdDSA has overtaken
> > RSASSA-PSS in the mind share of the world.
> > 
> > Maybe we could have a little text in Appendix A, then?
> 
> Putting it in Appendix A seems really wrong because it is not a historical
> algorithm.  I am reluctant to do this because the only reason why we have
> discussed why algorithms are changing is because they are no longer
> considered to be of sufficient strength.  The plus basically says this is
> our best guess of what is going to happen when we right the algorithm.  That
> best guess has changed and different people are going to have different
> ideas of why it changed.  It boils down from it was a SHOULD and it is now a
> SHOULD we just don't think it is where the world is headed at the moment.
> This could change next year if something really unexpected happens. 
> 
> > 
> > >
> > > >
> > > >    [...] Other extensions may be included, but those extensions
> > > >    SHOULD NOT be marked as critical.
> > > >
> > > > Is this a candidate for a 2119 MAY?
> > >
> > > No not really, marking things a critical is a hinderance to
> interoperability
> > rather than promoting it.  The selection of SHOULD NOT rather than MAY
> > indicates this by saying that if you want to do this you should probably
> > reconsider that decision unless you have a really good case to do so.
> > 
> > Whoops, I was talking about "MAY be included", not the "SHOULD NOT be
> > marked as critical".  But I could go either way; it's kind of a statement
> of fact.
> 
> I think that is a very poor use of the word MAY.  On the other hand for the
> most part I don't like MAY in general because the sentences that include it
> are not written in a way which is useful.
> 
> So - No.
> 
> Jim
> 
> 
> > 
> > -Benjamin
>