Re: [Uta] updated I-Ds

Peter et al,
First, thanks a lot for investing the cycles before the deadline.
Inline are my comments and questions for clarification.
Looking forward to having a good discussion next week. Hopefully Yaron and Ralph will be able to join remotely.
Orit.

> -----Original Message-----
> From: Uta [mailto:uta-bounces@ietf.org] On Behalf Of Peter Saint-Andre
> Sent: Thursday, February 13, 2014 10:51 AM
> To: uta@ietf.org
> Subject: [Uta] updated I-Ds
> 
> Yaron, Ralph, and I have updated our respective documents as follows:
> 
> 1. draft-sheffer-uta-tls-attacks is in essence what used to be Section 2
> of draft-sheffer-tls-bcp
> 
[OL] Looks good. My question to the list is to what extent having an RFC listing the known attacks is helpful? Should it include more detailed info for each attack?
What are our expectations from the scope of the intended RFC, who would like to contribute, and in what timeframe?

> 2. draft-sheffer-tls-bcp now focuses primarily on the recommendations
>
[OL] A great start!
A few thoughts and questions that come to mind:
- The title includes both TLS and DTLS. Per our AD's email from a few weeks ago, we should discuss how to proceed.
- It would be helpful to compile a list of additional aspects to be covered under Chapter 3 "Considerations" based on the list feedback and  f2f discussions next week.
- In 4.1 the statement that this document is not a profile in the sense of Sec.9 of RFC5246 is very important. It should be at the very top of the document ;-).
For improved readability, please,  consider to
- Combine 3.3 with 4 in terms of content and style (for example, as "Rationale" where appropriate).
- Keep "Security Considerations" to the minimum and incorporate the current "considerations" under the Recommendations topics
- Number the bullets for easier reference
One specific: In 3.3, "export-level" encryption might be an inappropriate term to be used by a standard, while the length examples are probably outdated.

> 3. draft-saintandre-xmpp-tls now mostly points to draft-sheffer-tls-bcp
> 
[OL] I trust your knowledge about TLS with XMPP ;--) My comments are procedural only.
- Where would this draft belong to? To UTA or to XMPP since it is an active WG?
- Section 4.6 Unauthenticated Connections carefully and successfully avoids the "opportunistic encryption" terminology ;-) and introduces its own definitions... still an alignment will be needed  with whatever terminology the community decides to use going forward.

> Please review the document set and let us know how things can be
> improved!
[OL] +1
> 
> https://datatracker.ietf.org/doc/draft-sheffer-uta-tls-attacks/
> 
> https://datatracker.ietf.org/doc/draft-sheffer-tls-bcp/
> 
> https://datatracker.ietf.org/doc/draft-saintandre-xmpp-tls/
> 
> Peter
> 
> --
> Peter Saint-Andre
> https://stpeter.im/
> 
> _______________________________________________
> Uta mailing list
> Uta@ietf.org
> https://www.ietf.org/mailman/listinfo/uta