Subject: [Lake] edhoc draft version to ask people to review...

From: Stephen Farrell <[email-masked]>
Date: Thu, 18 Nov 2021 14:04:50 +0000

Hiya,

As discussed at IETF112 we plan to try get external academic
reviews of EDHOC in the coming months. Mališa and others have
produced a nice overview of EDHOC to try help people do those
reviews (he'll circulate that in the next few days).

One issue though before we start trying to get people to do
such reviews is that we don't want to keep changing the draft
on them in the middle of their work.

So, assuming all goes well, (i.e. no immediate showstopper
security issues arising), our plan is to "freeze" work in
terms of keeping the same I-D for a few months, and in the
meantime process issues in github as they arise while we
wait to hopefully get some substantive security reviews.

So, a question for the WG is: what version or when should
we do that "freeze"?

We're at -12 now and have some issues for that so we could
decide to freeze the I-D for a few months and send out mails
asking for external review based on that.

Or, it might be better to allow the editors to resolve
more of the current issues we have now and freeze on -13
say.

Or, maybe there's a better plan.

We'd like to figure this out in the next few days so would
appreciate your responses before the end of tomorrow (Friday)
if that's possible. Our default if people don't respond is
to assume that freezing on -12 is ok and to go with that,
so no need to respond if you think that's the right plan.

Thanks,
Stephen.

---

From: Michael Richardson <[email-masked]>
Date: Thu, 18 Nov 2021 11:36:17 -0500

> on them in the middle of their work.

You want to declare an Implementation Draft :-)

    > more of the current issues we have now and freeze on -13

I think that editorial fixes are fine.
I don't think you should lock down the drafts from changes, but rather make
sure that there are no bits on the wire changes.

I can't speak to whether -12 or -13, but time-wise, it seems that maybe
Dec.31,2021 would be the right deadline.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Göran Selander <[email-masked]>
Date: Thu, 18 Nov 2021 17:21:15 +0000

Hi,

We have had quite a few versions of the draft between the last online IETF meetings. I think it is a good idea to have less versions now that there are no major changes proposed. I guess we would want to submit a new version for IETF 113 at the latest, or e.g. if there are some changes with impact on the protocol that we want to interop test. For now I'm fine with progressing the draft only on the github, and stick to version -12 which is ready for review.

Göran

From: Lake <[email-masked]> on behalf of Stephen Farrell <[email-masked]>
Date: Thursday, 18 November 2021 at 15:05
To: [email-masked] <[email-masked]>
Subject: [Lake] edhoc draft version to ask people to review...

Hiya,

Thanks,
Stephen.

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 23 Nov 2021 12:42:09 +0000

Hi all,

Given the stated default below and the modest feedback,
we guess it seems ok with the WG to stick with -12 for
the next 4 or so months as we try to get feedback and
analysis from the academic crypto folks based on that.
(If you disagree with that plan, please do say so and
tell us why.)

Meanwhile, sending reviews and raising issues on the
list and/or via GH are of course still most welcome,
and the editors can manage those as GH issues or PRs
as appropriate. And if we do turn up some reason for
a breaking-change during this period, we can discuss
it and see what's best.

Thanks,
S&M.