Subject: [Dime] AD review of draft-ietf-dime-local-keytran-09

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Mon, 16 May 2011 16:14:28 +0200

Hi, 

I have reviewed draft-ietf-dime-local-keytran-09. The document is in
good shape, I have a small number of issues which seem simple to respond
and fix if necessary, so I suggest that you do it before submitting the
document to IETF Last Call. 

Technical Issues are marked T and Editorial issues are marked E. 

Technical:

T1: Is there any special reason for skipping decimal value (4) in the
enumeration in Section 3.1.1? If there is none I suggest to move RSA-KEM
from (5) to (4). 

T2: Are there any special recommendations for the experts who will be in
charge in the future with the "Expert Review" policy as per [RFC5226]
for AVP types? For example is it recommended to assign AVPs only for
cryptographic key material defined in IETF standard track documents? 

T3. In section  5.2: 

   'once values have been assigned, they MUST NOT be deleted, replaced,
modified or deprecated.' 

It is not clear why we do not allow for values to be deprecated.
Assuming that a cryptographic delivery method was deprecated, why would
not marking the AVP as deprecated be allowed, as long as the value
cannot be deleted, replaced or modified? 

Editorial: 

E1: Why is RSA-KEM not expanded and explained in Section 2.2. -
Technical Terms and Acronyms?

Thanks and Regards,

Dan

---

From: Glen Zorn <[email-masked]>
Date: Tue, 24 May 2011 21:28:52 +0700

> enumeration in Section 3.1.1? If there is none I suggest to move RSA-KEM

OK.

> for AVP types? 

Do you mean values for the Key-Type AVP?  No such recommendations would
come from me; we had originally specified the policy as "First Come,
First Served"
(http://www.potaroo.net/ietf/all-ids/draft-wu-dime-local-keytran-03.txt)
on the simple theory that anybody who wanted to register, use & deploy
e.g. rot13 would get what they deserved ;-).  IIRC, one of the dime
Chairs suggested the expert review policy, so maybe they have some
suggestions.

...

> cannot be deleted, replaced or modified? 

Sure, why not.

> Technical Terms and Acronyms?

Would you like the whole thing expanded or just KEM?

...

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Wed, 25 May 2011 13:34:33 +0200

Hi Glen, 

Thank you for your answer. 

Please see in-line answers. I deleted the issues that were fully agreed.

Regards,

Dan 

> -----Original Message-----
> From: Glen Zorn [mailto:[email-masked]]
> 

...

> >
> > T2: Are there any special recommendations for the experts who will
be
> > in charge in the future with the "Expert Review" policy as per
> > [RFC5226] for AVP types?
> 

[[DR]] Can you please clarify this with the chairs? If the policy is
"Expert Review" criteria for reviewing requests for new Key-Type AVP
values should be specified. 

...

> Would you like the whole thing expanded or just KEM?
[[DR]] RFC 5990 explains KEM (in the Abstract actually). This would be
probably sufficient, although I would bet that even in the security
community not everybody knows the names beyond R, S and A. 

...

---

From: Glen Zorn <[email-masked]>
Date: Thu, 26 May 2011 12:11:35 +0700

On 5/25/2011 6:34 PM, Romascanu, Dan (Dan) wrote:

...

> values should be specified. 

I would prefer to change the policy to "Specification Required" because
this seems to be all that is really necessary for interoperability.

> community not everybody knows the names beyond R, S and A. 

OK, added definitions of both "RSA" and "RSA-KEM".

...

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Thu, 26 May 2011 09:06:14 +0200

> Sent: Thursday, May 26, 2011 8:12 AM
> To: Romascanu, Dan (Dan)
> Cc: [email-masked]
> Subject: Re: [Dime] AD review of draft-ietf-dime-local-keytran-09
> 
> >> on the simple theory that anybody who wanted to register, use &
> >> deploy e.g. rot13 would get what they deserved ;-).  IIRC, one of
> the
> >> dime Chairs suggested the expert review policy, so maybe they have
> >> some suggestions.
> >>
> >> ...
> >

[[DR]] The WG needs to agree on this change. I would like to hear the
opinions of other WG participants and of the chair(s). 

Dan

---

From: jouni korhonen <[email-masked]>
Date: Thu, 26 May 2011 10:25:38 +0300

Hi,

> opinions of other WG participants and of the chair(s). 

From my experience "specification required" policy is a good choice, especially if the specification is mostly intended to be used in other SDOs outside IETF. If e.g. some SDO has a reason to use some specific key type in their system, which might be really dud from IETF point of view, what we are to block such use? At least proper documentation is out there anyway.

- Jouni (as the WG participant and the "other" chair)

> 
> Dan 
> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dime