Subject: [jose] Ben Campbell's No Objection on draft-ietf-jose-cfrg-curves-05: (with COMMENT)

From: "Ben Campbell" <[email-masked]>
Date: Tue, 16 Aug 2016 19:15:52 -0700

Ben Campbell has entered the following ballot position for
draft-ietf-jose-cfrg-curves-05: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-jose-cfrg-curves/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I note that the reference to RFC7748 is a normative downref that does not
appear to be mentioned in the last call announcement. It’s not in the
downref registry, but since it's an algorithm spec, it probably should
be. I don't suggest any particular course of action; I merely bring it up
in case people hadn't already noticed.

---

From: Jim Schaad <[email-masked]>
Date: Tue, 16 Aug 2016 19:43:27 -0700

I don't know when it needs to be done, but the other down reference in the document is also an algorithm document which I hope will get into the registry as well when it is published.

Jim

> -----Original Message-----
> From: Ben Campbell [mailto:[email-masked]]
> Sent: Tuesday, August 16, 2016 7:16 PM
> To: The IESG <[email-masked]>
> Cc: [email-masked]; Jim Schaad <[email-masked]>;
> [email-masked]; [email-masked]; [email-masked]
> Subject: Ben Campbell's No Objection on draft-ietf-jose-cfrg-curves-05: (with
> COMMENT)
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> appear to be mentioned in the last call announcement. It’s not in the downref
> registry, but since it's an algorithm spec, it probably should be. I don't suggest
> any particular course of action; I merely bring it up in case people hadn't already
> noticed.
>

---

From: "Ben Campbell" <[email-masked]>
Date: Tue, 16 Aug 2016 22:46:55 -0500

On 16 Aug 2016, at 21:43, Jim Schaad wrote:

> I don't know when it needs to be done, but the other down reference in 
> the document is also an algorithm document which I hope will get into 
> the registry as well when it is published.

I agree . I didn't call that out because that one _was_ mentioned in the 
last call announcement.

Thanks,

Ben.

>> email
>> Please refer to 
>> https://www.ietf.org/iesg/statement/discuss-criteria.html

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 17 Aug 2016 12:39:11 -0400

On Tue, Aug 16, 2016 at 11:46 PM, Ben Campbell <[email-masked]> wrote:
>> I don't know when it needs to be done, but the other down reference in the
>> document is also an algorithm document which I hope will get into the
>> registry as well when it is published.
>
>

Sorry to chime in late.  I thought this was covered in the shepherd
report, but didn't realize there were 2 downrefs.  What do I need to
do at this point?  We don't need to do another last call anymore,
right?  Sorry I am not remembering the new procedure.

Thanks,
Kathleen

>>> downref

-- 

Best regards,
Kathleen

---

From: "Ben Campbell" <[email-masked]>
Date: Wed, 17 Aug 2016 11:43:28 -0500

> right?  Sorry I am not remembering the new procedure.

We have been discussing the relaxation of the (repeated) last call 
requirement, both in the IESG and in Barry's draft. I'm not sure that 
discussion has reached it's conclusion. I'm not sure what we should do 
in the interim (this my comment about not suggesting any particular 
course of action.)

By the way, I think both were mentioned in the shepherd write up, but 
not in the last call announcement.

Ben.

>>>> Subject: Ben Campbell's No Objection on 
>>>> draft-ietf-jose-cfrg-curves-05:
>>>> (with
>>>> COMMENT)
>>>>
>>>> registry, but since it's an algorithm spec, it probably should be. 
>>>> I
>>>> don't suggest
>>>> any particular course of action; I merely bring it up in case 
>>>> people
>>>> hadn't already
>>>> noticed.
>>>>
>>
>
>
>
> -- 
>
> Best regards,
> Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 17 Aug 2016 12:56:03 -0400

On Wed, Aug 17, 2016 at 12:43 PM, Ben Campbell <[email-masked]> wrote:
>>>> the
> discussion has reached it's conclusion. I'm not sure what we should do in
> the interim (this my comment about not suggesting any particular course of
> action.)
>
> By the way, I think both were mentioned in the shepherd write up, but not in
> the last call announcement.

OK, the shepherd report was there prior to last call, so hopefully
that is enough to not require a second last call?

Thanks,
Kathleen

-- 

Best regards,
Kathleen

---

From: joel jaeggli <[email-masked]>
Date: Wed, 17 Aug 2016 09:56:58 -0700

> right?  Sorry I am not remembering the new procedure.
If you belive that the downrefs to a particular document are accepted by
the community you waive them and do nothing.

   Once a specific down reference to a particular document has been
   accepted by the community (e.g., has been mentioned in several Last
   Calls), an Area Director may waive subsequent notices in the Last
   Call of down references to it.  This should only occur when the same
   document (and version) are being referenced and when the AD believes
   that the document's use is an accepted part of the community's
   understanding of the relevant technical area.  For example, the use
   of MD5 [RFC1321 <https://tools.ietf.org/html/rfc1321>] and HMAC [RFC2104 <https://tools.ietf.org/html/rfc2104>] is well known among
   cryptographers.

normative downrefs to external crypto specifications documented in informational RFCs are a normal and accepted part of the process.

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 17 Aug 2016 13:17:15 -0400

Thank you, Joel!

-- 

Best regards,
Kathleen

---

From: "Ben Campbell" <[email-masked]>
Date: Wed, 17 Aug 2016 12:50:38 -0500

On 17 Aug 2016, at 11:56, joel jaeggli wrote:

>    of MD5 [RFC1321 <https://tools.ietf.org/html/rfc1321>] and HMAC 
> [RFC2104 <https://tools.ietf.org/html/rfc2104>] is well known among
>    cryptographers.
>
> normative downrefs to external crypto specifications documented in 
> informational RFCs are a normal and accepted part of the process.

Hasn't that historically still been handled on a spec by spec basis?

---

From: joel jaeggli <[email-masked]>
Date: Wed, 17 Aug 2016 11:13:04 -0700

> Hasn't that historically still been handled on a spec by spec basis?
sure, but if you're not looking at the downref with an eye towards what
kind of reference it is then that detail is missing for the discussion.

the cfrg may have change control on draft-irtf-cfrg-eddsa but it doesn't
on the curves contained therein, so citiing a curve located there is
reference to an external specification.