Re: [lamps] Benjamin Kaduk's Yes on draft-ietf-lamps-rfc5750-bis-06: (with COMMENT)

[Jim Schaad <[e-mail]>]

> -----Original Message-----
> From: Benjamin Kaduk <[e-mail]>
> Sent: Wednesday, June 20, 2018 12:43 PM
> To: Jim Schaad <[e-mail]>
> Cc: 'The IESG' <[e-mail]>; [e-mail];
'Russ
> Housley' <[e-mail]>; [e-mail]; [e-mail]
> Subject: Re: Benjamin Kaduk's Yes on draft-ietf-lamps-rfc5750-bis-06:
(with
> COMMENT)
> 
> Trimming the easily resolved bits...
> 
> On Wed, Jun 20, 2018 at 12:34:46PM -0700, Jim Schaad wrote:
> >
> >
> > > -----Original Message-----
> > > From: Benjamin Kaduk <[e-mail]>
> > > Sent: Wednesday, June 20, 2018 12:11 PM
> > > To: The IESG <[e-mail]>
> > > Cc: [e-mail]; Russ Housley
> > > <[e-mail]>; [e-mail]; [e-mail];
> > > [e-mail]
> > > Subject: Benjamin Kaduk's Yes on draft-ietf-lamps-rfc5750-bis-06:
> > > (with
> > > COMMENT)
> > >
> > >
> > > Section 4.3
> > >
> > > Why are we going from SHOULD+ (in RFC 5750) to just SHOULD for
> > > RSASSA- PSS with SHA-256?
> >
> > Big long discussion on this, but mostly because EdDSA has overtaken
> RSASSA-PSS in the mind share of the world.
> 
> Maybe we could have a little text in Appendix A, then?

Putting it in Appendix A seems really wrong because it is not a historical
algorithm.  I am reluctant to do this because the only reason why we have
discussed why algorithms are changing is because they are no longer
considered to be of sufficient strength.  The plus basically says this is
our best guess of what is going to happen when we right the algorithm.  That
best guess has changed and different people are going to have different
ideas of why it changed.  It boils down from it was a SHOULD and it is now a
SHOULD we just don't think it is where the world is headed at the moment.
This could change next year if something really unexpected happens. 

> 
> >
> > >
> > >    [...] Other extensions may be included, but those extensions
> > >    SHOULD NOT be marked as critical.
> > >
> > > Is this a candidate for a 2119 MAY?
> >
> > No not really, marking things a critical is a hinderance to
interoperability
> rather than promoting it.  The selection of SHOULD NOT rather than MAY
> indicates this by saying that if you want to do this you should probably
> reconsider that decision unless you have a really good case to do so.
> 
> Whoops, I was talking about "MAY be included", not the "SHOULD NOT be
> marked as critical".  But I could go either way; it's kind of a statement
of fact.

I think that is a very poor use of the word MAY.  On the other hand for the
most part I don't like MAY in general because the sentences that include it
are not written in a way which is useful.

So - No.

Jim


> 
> -Benjamin