Subject: [dane] Questions from IESG review #2 - From Russ Housley

From: Warren Kumari <[email-masked]>
Date: Fri, 8 Jun 2012 17:08:40 -0400

Hi all,

There are a number of questions that came out of the IESG Evaluation on draft-ietf-dane-protocol-21 that we would like the WG input on…

I am not going to try summarize the discussions / views -- the discussions are short and / or subtle enough that you should read them yourself if you have an opinion / want more details.

Unless we hear SCOAT (Strong Clear Objections with Alternate Text) by Wednesday June 13th we will remove the old text.

----------------------------------------------------------------------------

Based on the briefing in the SAAG Session at IETF 83, I strongly
 suggest that this text be removed from Section 6.

At the time this is written, it is expected that there will be a new 
family of hash algorithms called SHA-3 within the next few years. 
It is expected that some of the SHA-3 algorithms will be mandatory
and/or recommended for TLSA records after the algorithms are fully
defined.  At that time, this specification will be updated.

-------------------------------------------

If folk disagree with removing this text, please read the SAAG minutes (http://www.ietf.org/proceedings/83/minutes/minutes-83-saag.txt), Tim's presentation on the SHA-3 Competition (http://www.ietf.org/proceedings/83/slides/slides-83-saag-0.pdf) and maybe the audio archives as well.

<no hat>
In case it wasn't obvious I too think this should be pulled. Speculating about the future gets us into tricky territory as does committing future folk to do stuff. If we mention that SHA-3 is coming and we'll rev the draft then, do we also need to mention SHA-4? SHA-17? SHA-33.3?  OMG, when will the madness stop?! ….Sorry, got a little carried away there….

</no hat>

W
-- 
American Non-Sequitur Society; 
we don't make sense, but we do like pizza!

---

From: Scott Schmit <[email-masked]>
Date: Sat, 9 Jun 2012 22:24:40 -0400

On Fri, Jun 08, 2012 at 05:08:40PM -0400, Warren Kumari wrote:
> Unless we hear SCOAT (Strong Clear Objections with Alternate Text) by
> Wednesday June 13th we will remove the old text.
> 
> In case it wasn't obvious I too think this should be pulled.
> Speculating about the future gets us into tricky territory as does
> committing future folk to do stuff. If we mention that SHA-3 is coming
> and we'll rev the draft then, do we also need to mention SHA-4?
> SHA-17? SHA-33.3?  OMG, when will the madness stop?! ….Sorry, got a
> little carried away there….
> 
> </no hat>

The reason this was originally included was due to a concern that
if we had too few or only one mandatory-to-implement hash algorithm,
implementers would not be inclined to code in algorithm agility.

See the thread around here:
https://www.ietf.org/mail-archive/web/dane/current/msg02165.html

Not saying that that's true or a good reason to keep the text, mind you,
but reminding the WG why this text was put into the draft in the first
place.

Personally, I'm ok with removing the paragraph--we still specify that
SHA-512 is a SHOULD, so any implementer worth their salt will be
algorithm-agile.  The rest will probably ignore that paragraph anyway.

-- 
Scott Schmit

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 9 Jun 2012 19:42:55 -0700

> algorithm-agile.  The rest will probably ignore that paragraph anyway.

Excellent logic. +1

--Paul Hoffman

---

From: Warren Kumari <[email-masked]>
Date: Thu, 14 Jun 2012 12:23:28 -0400

> Unless we hear SCOAT (Strong Clear Objections with Alternate Text) by Wednesday June 13th we will remove the old text.

Awesome, we heard no SCOAT, but we did hear a Scott, who provided useful background, and is cool with removing the text.\\

So, authors, please remove the old text.

W

For every complex problem, there is a solution that is simple, neat, and wrong.
                -- H. L. Mencken