[Tls-reg-review] [IANA #1275005] Re: Request to register DICOM as a protocol for ALPN

[Sabrina Tanamal via RT <[e-mail]>]

Hi Rich, Yoav, and Nick, 

We received a request to register the DICOM protocol in the TLS ALPN Protocol IDs registry. Please see below. It seems the applicant had some trouble sending this to the tls-reg-review mailing list. 

Is this OK to register? 

Thanks,
Sabrina

====

On behalf of DICOM WG-14, we (the DICOM WG-14 “Security” co-chairs Lawrence Tarbox, Ph.D. and Robert Horn, along with the DICOM General Secretary Carolyn Hull) would like to register the DICOM Upper Layer Service Protocol running on TLS in the Application-Layer Protocol Negotiation (ALPN) Protocol ID registry, using the value “dicom”. 

Here is the information for registering the protocol:

Protocol: DICOM
Identification Sequence: 0x64 0x69 0x63 0x6f 0x6d ("dicom")
Reference: https://www.dicomstandard.org/current 
In particular, Part 15 Annex B includes profiles defining how 
the DICOM Upper Layer Service Protocol, defined in Part 8, runs on
top of a Transport Layer Security (TLS) stack.

On Fri Jun 16 15:23:28 2023, [e-mail] wrote:
> Ten weeks ago I sent in a request to register the DICOM protocol in
> the TLS Application-Layer Protocol Negotiation (ALPN) Protocol ID
> registry (e-mail attached).  As directed by the IANA web site and
> RFC8447, Section 17, I emailed the request to the tls-reg-
> [e-mail]<mailto:[e-mail]> mailing list.  I got
> back a notice that, since I was not a member of that list, a moderator
> would have to approve the posting.  I also got back an e-mail from
> [e-mail]<mailto:[e-mail]>
> asking me to confirm my e-mail address, which I confirmed by replying
> to the message as directed. (see attached email reply)
> 
> Is there any way to get a status report on the request?
> Theoretically, per the RFC8447 one or more of the experts should have
> reviewed the request within 3 weeks (i.e. before the end of April).
> It is now nearing the end of June with no indication to me by e-mail
> or through other methods what was the disposition of the review.
> Could I possibly get an update?  Should I re-email the request?
> 
> DICOM is a major healthcare standard, used by nearly every medical
> imaging department (e.g., Radiology, Cardiology) on the planet,
> supported by hundreds of products and dozens of open source toolkits.
> It is recognized as an ISO standard and has been in use for over 30
> years.  Billions of medical images have been moved over networks using
> the DICOM protocol.  We want DICOM to keep up with the latest security
> recommendations, including BCP-195, which now requires the use of
> ALPN.  But it is impossible to comply unless DICOM, particularly the
> DICOM DIMSE protocol, are not registered as a ALPN Protocol with IANA.
> 
> Is there something we (the DICOM Standards Committee) need to do to
> get the ALPN registration in place?  We already have register port
> numbers.
> 
> Thanks!
> 
> --------
> Lawrence Tarbox, Ph.D., Dept. of Biomedical Informatics, Univ. of
> Arkansas for Medical Sciences
> Associate Professor and Director of the UAMS Center for High
> Performance Computing
> Architect for The Cancer Imaging Archive (TCIA)
> [cancerimagingarchive.net]<https://urldefense.com/v3/__https:/www.cancerimagingarchive.net/__;!!LpKI!2UxLgsCA1KTt5HLbN1Yi15E95mJc17MGknvSBJORzHhG_l0tPfVCMoyWM8TSJlz9$>
> and PRISM
> [prismtools.dev]<https://urldefense.com/v3/__https:/www.prismtools.dev/__;!!LpKI!2UxLgsCA1KTt5HLbN1Yi15E95mJc17MGknvSBJORzHhG_l0tPfVCMoyWM6sGe-
> Bb$>
> Former User Co-Chair of the DICOM Standards Committee
> [dicomstandard.org]<https://urldefense.com/v3/__https:/www.dicomstandard.org/__;!!LpKI!2UxLgsCA1KTt5HLbN1Yi15E95mJc17MGknvSBJORzHhG_l0tPfVCMoyWMxSmWvbX$>
> mailto:[e-mail] +1.314.681-2752
> 
> ----------------------------------------------------------------------
> Confidentiality Notice: This e-mail message, including any
> attachments, is for the sole use of the intended recipient(s) and may
> contain confidential and privileged information. Any unauthorized
> review, use, disclosure or distribution is prohibited. If you are not
> the intended recipient, please contact the sender by reply e-mail and
> destroy all copies of the original message.