Re: [TLS] TLS 1.3 process

[Trevor Perrin <[e-mail]>]

On Thu, Mar 27, 2014 at 2:48 PM, Sean Turner <[e-mail]> wrote:
> All,
>
> The TLS WG charter is pretty clear that the intention isn't to design
> a completely new protocol but rather to revise TLS, and specifically
> to "place a priority in minimizing gratuitous changes to TLS." This
> is not to say that we can't consider new cryptographic handshake flows
> -- TLS has always been open to that -- but completely replacing TLS
> with a new protocol is out of scope for this WG.


Hi Sean,

Thanks for creating this discussion.

The distinction between a "new protocol" (forbidden!) and
re-evaluating / updating both the handshake and record layer is not
super clear to me.

For example: Eric's draft redesigns the TLS handshake around the new
concept of "semi-static public keys".  That gave me the impression
we're willing to consider radical changes!  Is that not the case?

I also didn't expect such a strict interpretation of the charter, and
such a rigid process.  Your email in January gave a different
impression:

"""
Rene,

A couple of people have mentioned the fact that list of objectives is
incomplete or they're worried their issue not being listed means it's
out of scope.  Right now the charter includes the following to address
this (at least in my mind) "Some of the main design goals are as
follows, in no particular order:"  That list is honestly there to make
sure the IESG will be comfortable agreeing to the rechartering.  What
I hope will happen is that folks can bring their proposals, they get
evaluated, and the WG will use its better judgement about what makes
sense to get adopted.
"""
http://www.ietf.org/mail-archive/web/tls/current/msg11257.html

That email made it seem like we should not worry too much about the
charter, we'd have time for "folks to bring their proposals" later.

I would have asked for more clarity on the charter - and the
"minimizing gratuitous changes" phrase - if not for that.


Anyways, maybe this is just me.  If everyone else understand what
scope of changes is allowed, and is happy with the step-wise process
you describe, then that's fine.  I'm happy we're discussing this.

But I would personally prefer a more open process based around
soliciting and comparing different proposals, without pre-judging in
advance what changes are "gratuitous".


Trevor