Subject: Re: [Acme] Minutes and verifying some decisions

From: Joseph Lorenzo Hall <[email-masked]>
Date: Mon, 1 Aug 2016 17:38:15 -0400

On Thu, Jul 28, 2016 at 5:27 PM, Eric Rescorla <[email-masked]> wrote:
>
> On Thu, Jul 28, 2016 at 11:03 PM, Richard Barnes <[email-masked]> wrote:
>>
>> On Thu, Jul 28, 2016 at 4:24 PM, Salz, Rich <[email-masked]> wrote:
>>>
>>> *  For 156, keep nonces
>>
>> I seem to recall also agreeing to close #156, since nonces are not a
>> scarce resource for servers, but I don't see this reflected in the minutes.
>> Any objections to that?
>
> This is my understanding of the discussion in Berlin as well

Ugh, sorry that part of the minutes is a bit of a mess, my
apologies... here's the bit where I neglected to note no objections in
the room to keeping nonces:

----
...
    RLB: dininclined to drop nonces and thus not remove replay protection.

    DECISION:  For 156, keep nonces

    EKR: nonces are not a big deal for servers.
...
----

-- 
Joseph Lorenzo Hall
Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE 200, Washington DC 20005-3497
e: [email-masked], p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871

---

From: Ron <[email-masked]>
Date: Fri, 5 Aug 2016 13:02:14 +0930

On Thu, Jul 28, 2016 at 08:24:13PM +0000, Salz, Rich wrote:
> * Request to the mailing list "hey, if you have a post-v1-WGLC, tell
>   us or this may not exist further!"
> 
> That last item deserves some more explanation. We expect to enter WG
> last call before IETF-97 in Seoul in November.  If there are items you
> think we should work on after that, please bring them up here once we
> enter WGLC; which is to say around September.  We might need to
> re-charter, or we might want to just stay together to handle errata
> and IETF last call, or we might want to say say we're done and
> disband.

Are people really planning to take this to WGLC without there being
any operational implementation of this specification - or do people
believe there will actually be tested implementations of it, with
time to properly assess them, before November?

I'd love for us to stop completely reinventing large parts of this
asap, but given how many issues have shaken out so far when people
go to actually implement this, and the slow progress on implementing
some parts of it, and the limited responses to some of the problems
raised ...  setting this all in stone before November seems ...

 ambitious?

---

From: Richard Barnes <[email-masked]>
Date: Fri, 5 Aug 2016 09:04:39 -0400

> raised ...  setting this all in stone before November seems ...

It is ambitious, but I think not unachievable.  Jacob and I are trying to
finish up an "implementation draft" soon, and I believe Let's Encrypt
intends to start implementing pretty quickly thereafter.  I've already
begun a toy implementation (github.com/bifurcation/rocket-skates), and
haven't run into any issues so far.

--Richard

>
>
> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
>

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Sat, 6 Aug 2016 09:55:22 -0700

I agree with Jon that November seems early to go into last call. We will
probably have an updated spec available for use with Let's Encrypt by
then, and some clients will probably have upgraded, but I don't know if
we'll have enough operational experience to conclude that it's solid.