Subject: Re: [Lwip] Magnus Westerlund's Discuss on draft-ietf-lwig-curve-representations-19: (with DISCUSS)

From: John Mattsson <[email-masked]>
Date: Wed, 17 Feb 2021 11:43:19 +0000

Argh,

>2020-11-18 14 Mohit Sethi Changing to proposed standard as requested by the COSE experts.

I think this might have been triggered by my comment on the COSE list. If that is the case, I would like to clarify that I am not a designated IANA COSE expert and I did not "request" this. I just pointed out that the requested numbers could not be assigned by an informational draft.

This is a curve that could benefit from a 1-2 byte COSE identifier, but it will probably also work very well with a 3 byte identifier. In some use cases like EDHOC it does not matter at all as the identifier is not sent on the wire.

>At a minimum, since this has been changed from Informational to Standards Track I think we >should have another IETF Last Call. 

Making this LWIG document standards track seems strange. The IESG writeup "only a few working group members were able to provide detailed reviews" seems to contradict the "has received significant community review" requirement for standards track.

I personally see no need to change the status of this document to standards track. If a 3 byte COSE identifiers are unacceptable it seems better to write a short standards track COSE draft for that part and publish the rest as informational.

Cheers,
John

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 17 Feb 2021 13:25:51 +0100

(Please see previous discussion at
<https://mailarchive.ietf.org/arch/msg/lwip/eTH8zXdP0xASswZnl9u6rKp75ms>)

> I personally see no need to change the status of this document to standards track. If a 3 byte COSE identifiers are unacceptable it seems better to write a short standards track COSE draft for that…

None of this is a hard show-stopper, but I fear that we are setting ourselves up for the wrong signaling here.

By limiting 1 to 255 (1+0 and 1+1-byte) to “Standards Action”, we made it hard for Informational Documents to allocate these code points.  Security Area specifications are often Informational though.  

We don’t want to create “second class” specifications by giving them 1+2-byte identifiers only, just because the habit in the Security area is to mark certain specifications as informational.  

We also don’t want to insert the thought into the heads of protocol designers that they need to avoid sending these identifiers at all because some important specifications only got 1+2-byte identifiers.

Hmm, how do we fix this.  

(1) We could ask IESG to do a variance here.  We could support that with a formal consensus call in COSE.

(2) We could write a short WG document changing this into a “IETF Review” with some admonition that the DE should be consulted.

Section 4.8 of RFC 8126 says:

   Examples:

      IPSECKEY Algorithm Types [RFC4025]
      TLS Extension Types [RFC5246]

So we are in good companionship with this.

But I don’t want to create another obstacle for lwig-curve-representations now, so maybe we could do 1 *and* 2.

Let’s decide this later today.

Grüße, Carsten

---

From: Mohit Sethi M <[email-masked]>
Date: Wed, 17 Feb 2021 14:07:29 +0000

Argh, the IESG writeup is a replica of my shepherd writeup (https://datatracker.ietf.org/doc/draft-ietf-lwig-curve-representations/shepherdwriteup/). I had noted that:

Since this draft is crypto-heavy only a few working group members were able to provide detailed reviews.

I had also noted the discrepancy between the requested values and the stream way before IETF last call was issued and before the current COSE experts objected:

The values requested require "Standards Action With Expert Review" however the requested RFC type is Informational.

When the draft was adopted to the working group, it did not have any registration requests (https://tools.ietf.org/html/draft-ietf-lwig-curve-representations-00#section-5). The question of whether LWIG is the right venue or not is something that many of us have struggled with over time. This was noted by me, Suresh (AD at the time of adoption) and Ben (when he saw the IoT directorate review in 2019: https://datatracker.ietf.org/doc/review-ietf-lwig-curve-representations-08-iotdir-early-migault-2019-10-25/).

In hindsight, another IETF last call after the change to standards track would have been nice regardless of whether it would have resulted in more review. But I think I have been following all the processes diligently and doing everything I can (and perhaps am supposed to) as a co-chair/document shepherd. If you have some feedback for improving things, I'm all ears.

--Mohit

On 2/17/21 1:43 PM, John Mattsson wrote:

Argh,

Cheers,
John

_______________________________________________
Lwip mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/lwip