Re: [Uta] Proposed list of deliverables

["Orit Levin (LCA)" <[e-mail]>]

Alexey et al,
After rereading yours and the related drafts 
http://datatracker.ietf.org/doc/draft-melnikov-email-tls-certs/
http://datatracker.ietf.org/doc/draft-moore-email-tls/
http://datatracker.ietf.org/doc/draft-newman-email-deep/
and RFCs 2595 & 6125, below are my thoughts and some suggestions:

UTA deliverables are intended to serve as the go-to security guides for applications' developers and providers/operators. Navigating through numerous IETF RFCs (and drafts) in order to implement a specific protocol or deploy a service can be a very challenging task. Therefore, it would be very helpful to start with a new (preferably a joint) draft submitted to UTA that

(1) Introduces the existing RFCs that are directly related to "using TLS with email protocols" explaining their scope and how they relate to each other
(2) Outlines the topics that need to be covered by the new (single) RFC in a way consistent as much as possible with deliverable #2 outline
(3) Includes the material from the prior drafts as agreed by the author(s) (while referencing the existing RFCs and deliverable #2 as needed).

I personally think that having a structure similar to that of Sections 2 & 3 of draft-moore-email-tls would be the easiest for the UTA audience to read and implement. The guidelines and requirements are grouped first per audience: developers vs. operators, and then by an application client ("user agent") vs. an application server.

On a separate note, the email drafts (and RFCs) use a number of definitions that we should bring to general attention and harmonize (or at least agree upon): in addition to the (in)famous opportunistic TLS, we have implicit TLS, [explicit] TLS, pinning, etc.

I wonder whether the authors are planning to present multiple drafts, just a subset, or merge the material before London. The latter would help greatly to move the effort forward.

BTW Note that the cut-off date for all drafts (including -00) for London is this Friday, Feb 14th (not Monday as in the past).
Thanks,
Orit.  

> -----Original Message-----
> From: Alexey Melnikov [mailto:[e-mail]]
> Sent: Thursday, February 06, 2014 4:54 AM
> To: Orit Levin (LCA)
> Cc: [e-mail]; Pete Resnick; Barry Leiba
> Subject: Re: [Uta] Proposed list of deliverables
> 
> On 24/01/2014 23:20, Orit Levin (LCA) wrote:
> > All, Thank you very much for your feedback and discussion. We
> > encourage authors of existing drafts (and drafts in writing) to send
> > us preliminary agenda requests for presentation in London. To speed up
> > the WG progress, we would like to ask the authors of overlapping
> > drafts to work together in an attempt to merge the documents before
> > the submission deadline. Note that for a presented draft to become
> > considered as the basis for a WG ID, the document will need to be
> > scoped and targeted towards one of the proposed "deliverables".
> 
> I would like to request adoption of draft-melnikov-email-tls-certs-01,
> which satisfy a part of the your deliverable 3.
> 
> > Leif and Orit - the chairs.
> >> -----Original Message-----
> >> From: Orit Levin (LCA)
> >> Sent: Friday, January 17, 2014 10:25 PM
> >> To: '[e-mail]'
> >> Cc: Pete Resnick; Barry Leiba
> >> Subject: Proposed list of deliverables
> >>
> >> Below is the list of deliverables for your consideration:
> >>
> >> 1. A threat analysis document containing a collection of known security
> >> breaches to application protocols due to poor use of TLS (Likely an
> >> Informational RFC)
> >> 2. Applications' independent document recommending best existing and
> future
> >> practices for using TLS (Likely a BCP or a Proposed Standard RFC)
> >> 3. A set of documents, each describing best existing and future practices
> for
> >> using TLS with a specific application protocol, i.e., SMTP, POP, IMAP,
> XMPP,
> >> HTTP 1.1, etc. (Case-by-case likely a BCP or a Proposed Standard RFC)
> >> 4. A document discussing (and potentially defining) how to apply the
> >> opportunistic encryption approach (preliminary outlined in draft-farrelll-
> mpls-
> >> opportunistic-encrypt-00.txt) to TLS. (Category TBD)
> >>
> >> Please, send your feedback to the list (including short +1s to indicate
> that the
> >> direction makes sense to you).
> >>
> >> Thanks,
> >> Leif and Orit - the chairs.