Re: [Uta] Proposed list of deliverables

["Orit Levin (LCA)" <[e-mail]>]

Alexey et al,
Sounds good to me. Removing overlaps by merging the drafts is definitely the right way forward.

draft-newman-email-deep has a number of interesting suggestions. Some of the described techniques could be generalized and discussed in the context of the application-independent deliverable #4, indeed.

Overall, it would be great if the authors of these and other UTA-related drafts make a stab at identifying practices and techniques useful for other application protocols. Once specified in a way independent from the application logic, they will become candidates towards #4.

Thanks,
Orit.

> -----Original Message-----
> From: Alexey Melnikov [mailto:[e-mail]]
> Sent: Monday, January 20, 2014 3:52 AM
> To: Orit Levin (LCA)
> Cc: [e-mail]; Pete Resnick; Barry Leiba
> Subject: Re: [Uta] Proposed list of deliverables
> 
> Hi,
> This looks sensible, but I am trying to figure out how existing drafts
> fit into this plan.
> 
> On 18/01/2014 06:24, Orit Levin (LCA) wrote:
> > Below is the list of deliverables for your consideration:
> >
> > 1. A threat analysis document containing a collection of known security
> breaches to application protocols due to poor use of TLS (Likely an
> Informational RFC)
> > 2. Applications' independent document recommending best existing and future
> practices for using TLS (Likely a BCP or a Proposed Standard RFC)
> > 3. A set of documents, each describing best existing and future practices for
> using TLS with a specific application protocol, i.e., SMTP, POP, IMAP, XMPP,
> HTTP 1.1, etc. (Case-by-case likely a BCP or a Proposed Standard RFC)
> It sounds like the following 2 would cover this for SMTP/POP/IMAP:
> 
> http://datatracker.ietf.org/doc/draft-melnikov-email-tls-certs/
> http://datatracker.ietf.org/doc/draft-moore-email-tls/
> 
> (Some pieces of draft-newman-email-deep might apply here as well).
> > 4. A document discussing (and potentially defining) how to apply the
> opportunistic encryption approach (preliminary outlined in draft-farrelll-mpls-
> opportunistic-encrypt-00.txt) to TLS. (Category TBD)
> 
> There is a document defining this for email:
> http://datatracker.ietf.org/doc/draft-newman-email-deep/
> 
> Last time I talked to Chris and Keith, they were planning to merge it
> with Keith's document:
> http://datatracker.ietf.org/doc/draft-moore-email-tls/
> 
> 
> I would like to confirm with WG chairs that the proposal above makes sense.
> 
> Best Regards,
> Alexey
> > Please, send your feedback to the list (including short +1s to indicate that the
> direction makes sense to you).
> >
> > Thanks,
> > Leif and Orit - the chairs.