Re: [TLS] RFC 5878 - why?

[[e-mail] (Martin Rex)]

Trevor Perrin wrote:
>
> Yoav Nir <[e-mail]> wrote:
> >
> > RFC 5878 is an experimental RFC. If you've looked at its history,
> > it was approved by the IESG in 2006, and an IPR issue surfaced,
> > so approval was withdrawn, and the draft lay dormant for 3 years.
> > If during those three years anyone had come up with some other
> > draft describing an authorization extension, I think that would
> > have been approved instead.
> 
> Why is there need of an "authorization extension"?

The rfc5878 seemed to have a use case, might have documented what they
had implemented, and just wanted to get this published.

Quoting from the Title page of rfc5878:

  http://tools.ietf.org/html/rfc5878

   Status of This Memo

   This document is not an Internet Standards Track specification; it is
   published for examination, experimental implementation, and
   evaluation.

If a document is published by the IETF, "Experimental" is the biggest
warning sign that we have to caution consumers, except for refusing
to publish.


housley-tls-authz-extns specifically had an IPR issue, which by itself
caused active _disinterest_ in the document, I assume:

  http://www.ietf.org/mail-archive/web/tls/current/msg01523.html


Btw. there was an announcement of an implementation of both
rfc4680 and housley-tls-authz-extns in GnuTLS in 2007:
  http://www.ietf.org/mail-archive/web/tls/current/msg01518.html


> 
> TLS already has well-designed, standards-track ways of passing
> extension data back and forth:
> 
> Client -> Server : ClientHello Extension
> Client <- Server : ServerHello Extension
> Client -> Server : SupplementalData (RFC 4680)
> 
> Why is that not sufficient?

It would be sufficient.

If the stuff described in rfc5878 would have been proposed after
rfc4680 existed, it probably would have used it.  But the history
of both documents suggests that housley-tls-authz-00 is actually older
than the initial draft for rfc4680:

  https://datatracker.ietf.org/doc/rfc5878/history/
  https://datatracker.ietf.org/doc/rfc4680/history/

If you combine this kind of history with a combination of
"lack of interest" and "active disinterest because of IPR issue",
then rfc5878@Experimental is what might happen.  I naively assume that
tls-authz-extns would have died silently if Russ had not been a coauthor.


If you want to create an alternative to rfc5878 that makes proper use
of rfc4680 -- go ahead.  But such an alternative might subject to the same
IPR claims as rfc5878, so it might be the same hard sell as tls-authz-extns.


-Martin