Re: [TLS] Publication has been requested for draft-ietf-tls-oldversions-deprecate-05

[Rob Sayre <[e-mail]>]

On Mon, Oct 7, 2019 at 1:25 AM Eric Rescorla <[e-mail]> wrote:

>
>>>> It seems strange to put DTLS 1.0 (based on TLS 1.1) into new documents.
>>>>
>>>
>>> A few points.
>>>
>>> 1. It doesn't pull it in. There's no reference and there's just an
>>> informative statement.
>>>
>>
>> Shouldn't there be an informative reference?
>>
>
> To what?
>

Hi, I missed this response. This discussion seems a bit tedious, but

1) it doesn't seem like a particularly valid claim to say that the document
"doesn't pull" in DTLS 1.0 when the rationale for that claim is a missing
reference.
2) if "DTLS 1.0" remains in the document, I /think/ the document should
cite RFC 4347, and maybe the updates to it. But, perhaps there's a chain of
unstated dependencies in these documents, and I've only noticed the latest
one.

This thread also has some other unusual claims:

On Tue, Oct 1, 2019 at 7:34 PM Stephen Farrell <[e-mail]>
wrote:
> we can't "UPDATE" an I-D.

Not true. If you need to refer to something that's been IESG-approved but
still in the RFC queue, you can leave a note for the RFC editor to update
the reference to the eventual RFC number.

On Wed, Oct 2, 2019 at 8:17 PM Sean Turner <[e-mail]> wrote:
> You can change the text, but I do not believe it will change the
implementations.

If true, changing the text would seem to be uncontroversial.

Anyway, leaving strange text like this DTLS 1.0 stuff in the webrtc
document is one thing (although I'm surprised the IESG allowed it).
Claiming that a document like draft-ietf-tls-oldversions-deprecate can't
update documents from a concluded WG is another.

If the IETF can't get consensus on actually deprecating DTLS 1.0, maybe
something similar to the text from draft-ietf-rtcweb-security-arch should
be added to draft-ietf-tls-oldversions-deprecate.

"Earlier specifications required DTLS 1.0. Endpoints which support only
DTLS 1.2 might encounter interoperability issues."

That would seem to subvert the point of the draft--I think this is the
point that the original post in this thread was making.

thanks,
Rob