Subject: [Gen-art] Gen-ART LC review of draft-ietf-tls-chacha20-poly1305-04

From: "Roni Even" <[email-masked]>
Date: Wed, 30 Mar 2016 00:00:10 +0300

I am the assigned Gen-ART reviewer for this draft. For background on
Gen-ART, please see the FAQ at
<http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>.

Please resolve these comments along with any other Last Call comments you
may receive.

Document:  draft-ietf-tls-chacha20-poly1305-04

Reviewer: Roni Even

Review Date:2016-3-28

IETF LC End Date: 2016-4-9

IESG Telechat date: 

Summary: This draft is almost ready for publication as a standard track
RFC.

Major issues:

I am wondering why this is a standard track document and not informational
since the registration requirements are specification required.  (RFC5246)

I am also wondering why this document updates RFC5246 and RFC6347 

Minor issues:

Nits/editorial comments:

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 29 Mar 2016 22:31:15 +0100

Hi Roni, and gen-art (other cc's dropped)

So, a gen-art question to the gen-art reviewers :-)

What is the criterion for major issue?

I'd not have thought that the issues below (which do deserve
a response) would be such a big deal. I do get that various
collections of IETFers will disagree about such, but I'd hope
that gen-art would/could normalise it's opinion, and if this
is the result, I'm surprised.

Thanks,
S.

---

From: Robert Sparks <[email-masked]>
Date: Tue, 29 Mar 2016 16:50:57 -0500

> What is the criterion for major issue?
The judgement of the reviewer.

You might find more of what you're looking for at
<https://trac.tools.ietf.org/area/gen/trac/wiki>
but you will not find any "normalization" and I don't think any
should be sought.

Most of the genart reviewers are aware of the discuss criteria, and (due 
to also being active document editors themselves) the fashion for what's 
important to to a given IESG.

That's about as normalized as I think it's appropriate to get.
> _______________________________________________
> Gen-art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/gen-art

---

From: Paul Kyzivat <[email-masked]>
Date: Wed, 30 Mar 2016 09:49:47 -0400

[Changing the subject line]

> What is the criterion for major issue?

I have also wondered about this.
So far I have just been "winging" it, but I continue to wonder each time.

	Thanks,
	Paul

---

From: Paul Kyzivat <[email-masked]>
Date: Wed, 30 Mar 2016 09:50:48 -0400

I should have read all my mail before replying.

---

From: "Joel M. Halpern" <[email-masked]>
Date: Wed, 30 Mar 2016 10:16:16 -0400

Fundamentally, no, it is NOT normalized.  It is the reviewers judgment 
of the importance.

I try to use a measure that says that if I were an AD, I would think 
this was blocking before I mark things as Major.  But that is just me. 
And is still a judgment call.

And, in case it got lost in the shuffle, remember that no gen-art 
comment is blocking unless the IETF Chair decides it is.  Sometimes, he 
takes reviewer majors and makes them no-obj, and sometimes he takes 
reviewer minor and makes them discuss.  He is the one who decides, not 
the reviewer.

Yours,
Joel

---

From: "Roni Even" <[email-masked]>
Date: Wed, 30 Mar 2016 17:21:13 +0300

Hi,
Adding  Alissa to the thread
We had a similar issue with draft-ietf-avtcore-aria-srtp .  The result was to downgrade from Standard to Informational.
This required to go back to the WG.

I also noted that there is some text in section one that looks like a  recommendation  which will look like endorsing this cypher suite by the IETF. 

"Therefore, a new stream cipher to replace RC4 and address all the
   previous issues is needed.  It is the purpose of this document to
   describe a secure stream cipher for both TLS and DTLS that is
   comparable to RC4 in speed on a wide range of platforms and can be
   implemented easily without being vulnerable to software side-channel
   attacks."

This will be less strong if the document is Informational

So to me it looked like a major issue.

Roni

> -----Original Message-----
> From: Stephen Farrell [mailto:[email-masked]]
> Sent: Wednesday, March 30, 2016 12:31 AM
> To: Roni Even
> Cc: [email-masked]
> Subject: Re: Gen-ART LC review of draft-ietf-tls-chacha20-poly1305-04
> 
>

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 30 Mar 2016 15:26:28 +0100

Hi Roni,

> I also noted that there is some text in section one that looks like a  recommendation  which will look like endorsing this cypher suite by the IETF.
This cipher came from CFRG (in IRTF) and I think there is a desire to 
endorse it for use in TLS.

---

From: Alissa Cooper <[email-masked]>
Date: Wed, 30 Mar 2016 08:48:27 -0700

> On Mar 30, 2016, at 7:21 AM, Roni Even <[email-masked]> wrote:
> 
> Hi,

I suspect the issue with aria — that it was nationally defined — does not apply in this case.
Alissa

---

From: "Roni Even" <[email-masked]>
Date: Wed, 30 Mar 2016 19:49:14 +0300

Hi, 
The issue with ARIA was that it was not international standard and as far as I can see from the references this one is not either. 
The IETF RFC for it is informational.

Roni 

> From: Alissa Cooper [mailto:[email-masked]]
> Sent: Wednesday, March 30, 2016 6:48 PM
> To: Roni Even
> Cc: Stephen Farrell; [email-masked]
> > We had a similar issue with draft-ietf-avtcore-aria-srtp .  The result was to
> downgrade from Standard to Informational.
> > I also noted that there is some text in section one that looks like a
> recommendation  which will look like endorsing this cypher suite by the IETF.
> >
> >> I'd not have thought that the issues below (which do deserve a
> >> response) would be such a big deal. I do get that various collections
> >> of IETFers will disagree about such, but I'd hope that gen-art
> >> would/could normalise it's opinion, and if this is the result, I'm
> >> surprised.
> >>
> >> Thanks,
> >> S.
> >>
> >>> Please resolve these comments along with any other Last Call
> >>> comments
> >> you
> >>> may receive.
> >>>
> >>> Summary: This draft is almost ready for publication as a standard
> >>> track RFC.
> >>>
> >>>
> >>>
> >>>
> >>>
> >>>
> >>>
> >>> Major issues:
> >>>

---

From: Alissa Cooper <[email-masked]>
Date: Wed, 30 Mar 2016 12:07:59 -0700

> On Mar 30, 2016, at 9:49 AM, Roni Even <[email-masked]> wrote:
> 
> Hi, 

Just giving my opinion here, will let the sec people provide an authoritative answer since they raised the issue. But to my mind there is quite a difference between a national standard (defined and standardized by a national government) and “not an international standard.” “Not an international standard” is a much broader category (e.g., I would claim that IETF standards are global, but not international, standards). I thought the objection was to the national standard.

I haven’t looked closely at this draft and have no opinion on its status, just reflecting my memory of the aria draft.

Alissa

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 31 Mar 2016 08:40:02 +1300

> So far I have just been "winging" it, but I continue to wonder each time.

IMHO, you should put yourself in the General AD's shoes. Would you definitely
hold up the document for this (i.e. a solid DISCUSS)? Would publishing it
as-is be actively misleading or harmful? Then it's major.

Would you possibly place a DISCUSS, which you would very likely drop as
soon as an author or the sponsoring AD explained the point or said "sure,
we'll fix that"? Or would you simply issue a COMMENT and ballot
No Objection? Then it's minor.

Are you just saving some work for the RFC Editor? Then it's a nit.

YMMV, as all these are judgment calls in the end.

Should we add something on this point to the guidelines at
http://wiki.tools.ietf.org/area/gen/trac/wiki ?

   Brian

---

From: Robert Sparks <[email-masked]>
Date: Wed, 30 Mar 2016 16:45:35 -0500

> http://wiki.tools.ietf.org/area/gen/trac/wiki ?
I think that would be helpful.
I'd also look for a way to point to 
<https://www.ietf.org/iesg/statement/discuss-criteria.html>

---

From: "Roni Even" <[email-masked]>
Date: Thu, 31 Mar 2016 00:52:24 +0300

Hi Brian,
I like your clarification
Roni

> From: Gen-art [mailto:[email-masked]] On Behalf Of Brian E
> Carpenter
> Sent: Wednesday, March 30, 2016 10:40 PM
> To: Paul Kyzivat; [email-masked]
> Subject: Re: [Gen-art] What is the criterion for major issue?
> 
> IMHO, you should put yourself in the General AD's shoes. Would you
> definitely hold up the document for this (i.e. a solid DISCUSS)? Would
> publishing it as-is be actively misleading or harmful? Then it's major.
> 
> we'll fix that"? Or would you simply issue a COMMENT and ballot No
> Objection? Then it's minor.
>