Re: [Uta] Require TLS=NO is very much needed

[Viktor Dukhovni <[e-mail]>]

> On Nov 17, 2017, at 1:10 AM, Alexey Melnikov <[e-mail]> wrote:
> 
> (As a participant) Maybe write a separate draft?

There'd be considerable overlap between the documents,
both need essentially the same mechanisms to tunnel
TLS policy in headers, and there should only be one
such header to avoid having to resolve conflicts.

The security issues are two sides of the same coin
and should be discussed together.  Both features
override default TLS policy, one to require greater
than default security, the other to deliver despite
failure of default security policy.

The obstacle in the current draft was that  the "NO"
case appeared to over-complicate the ESMTP extension,
but it is now clear that the "NO" case need not use
the "ESMTP" extension and should be carried exclusively
via a header.  However, since the same TLS policy
header is also needed for the "YES" case (but with
a slightly different payload), the same draft should
specify both.  We should not force these to be separate
just to hurry the "YES" case out the door.  Let's do
this right.

-- 
	Viktor.