Subject: [Sidrops] Barry Leiba's No Objection on draft-ietf-sidrops-https-tal-07: (with COMMENT)

From: Barry Leiba via Datatracker <[email-masked]>
Date: Sun, 07 Apr 2019 21:49:12 -0700

Barry Leiba has entered the following ballot position for
draft-ietf-sidrops-https-tal-07: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-sidrops-https-tal/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I realize that this document inherits the text in Section 3 from RFC 6490, but
can you tell me why there are SHOULDs and not MUSTs?  Why would one NOT do it
the way Section 3 specifies?

Then I’ll ask the same question for the new https text in Section 4, especially
about TLS certificate and host name validation.

---

From: Tim Bruijnzeels <[email-masked]>
Date: Tue, 9 Apr 2019 17:08:24 +0200

Dear Barry,

> On 8 Apr 2019, at 06:49, Barry Leiba via Datatracker <[email-masked]> wrote:

The first half of section 3 specifies how an RP uses the TAL to download and validate a TA certificate. In my opinion the SHOULD in the first sentence could be a MUST.

The remainder of the section deals with strategies regarding downloading fresh copies, and choosing which of the (equivalent) URIs to use. In practice I believe that most if not all RP implementations fetch TA certificates on each validation run and the expiration time of the certificate is generally ignored - this does not conflict with the SHOULDs because generally these validation runs happen with a frequency of 10 mins, or hours at must - so it's much sooner. Furthermore some RPs choose to only try one URI to keep their code complexity low.

In short I don't remember clearly from the time that RFC7730 was discussed, but I don't think that there was consensus in the WG for a more formal and MUST-y specification for RP use. So, I think the SHOULDs reflect that.

> about TLS certificate and host name validation.

Yes, and good point. Pete Resnick raised a similar point and I replied to him yesterday. Are your okay with discussing this point in that thread?

Thank you

Tim

---

From: Barry Leiba <[email-masked]>
Date: Tue, 9 Apr 2019 11:13:38 -0400

Hi, Tim; thanks for the response.

> Yes, and good point. Pete Resnick raised a similar point and I replied to him yesterday. Are
> your okay with discussing this point in that thread?

Yes, indeed.  And as my comment was not a DISCUSS, I'll go farther and
let you and Pete simply work it out, and be happy with the result.
Thanks again.

Barry