Re: [TLS] Additional changes for draft-ietf-tls-iana-registry-updates

[Benjamin Kaduk <[e-mail]>]

On 03/23/2018 07:59 AM, Salz, Rich wrote:
> So we have two registries that share a number space.
>
> Sounds like the right solution is for the registries to coordinate. 
>

Well, there are three registries involved -- two existing one octet
registries that apply to TLS 1.2 and below, and a new TLS 1.3 registry
with two octets of space.  The original proposal by the authors was to
mark all the unallocated entries in the existing two registries as
either reserved or deprecated.  IANA noted that this is effectively the
same as closing the registries in terms of the difficulty of making
further registrations, though I am not sure that the authors replied to
the question that I think I asked about what the procedure is for
re-opening a registry should a need arise to allocate an additional
codepoint from it.

Anyway, it seems rather challenging to try to keep all three registries
open and coordinate amongst them, given that the new two-octet registry
has a pretty low "specification required" registration policy, and
allocations from the existing registries would apparently both require a
"contiguous" 256 values to be free in the new registry and then "knock
out" those 256 values from further use.  This would eat up the free
space in the new registry relatively quickly, and presumably would not
be compatible with a weak "specification required" policy (which is
currently the policy for values 64-223).  If we agree that
"specification required" is not appropriate for the existing one-octet
registries in a proposed "coordinate" scenario, then I don't see what
the policy would be other than "standards action" (the current policy
for values 0-63).  And if "standards action" is the bar, that would
require the IETF to do work on TLS 1.2 in order to need a new
registration, but this WG is chartered primarily for TLS 1.3 and
"require significant justification" to take on work for older versions. 
So it's extremely unclear to me that there's a plausible scenario in
which a registration in the existing registries would occur.  Such a
case could presumably reopen the existing registries for its use anyway,
given the level of review that would be needed.

So, in summary, closing these registries seems to adequately reflect (my
understanding of) our expectations for what will happen to them.  I'm
curious to know how your understanding differs.

-Ben