Subject: Re: [Last-Call] Secdir last call review of draft-ietf-tls-exported-authenticator-13

From: Nick Sullivan <[email-masked]>
Date: Mon, 25 Jan 2021 20:33:45 -0500

The SHOULD here wasn't about TLS vs. QUIC, but rather about whether the
authenticator or authenticator request needs to be kept confidential. There
are potential situations where this isn't strictly necessary, so I think
SHOULD is appropriate.

I've updated the draft here:
https://tools.ietf.org/html/draft-ietf-tls-exported-authenticator-14

Best,
Nick

On Wed, Dec 9, 2020 at 10:43 PM Martin Thomson <[email-masked]> wrote:

> On Thu, Dec 10, 2020, at 14:30, Sean Turner wrote:
> > OLD:
> >
> >  The application layer protocol
> >  used to send the authenticator request SHOULD use TLS as its
> >  underlying transport to keep the request confidential
> >
> > NEW:
> >
> >  The application layer protocol
> >  used to send the authenticator request SHOULD use a secure
> >  channel with equivalent security to TLS, such as
> >  QUIC [ID.draft-ietf-quic-tls], as its underlying transport
> >  to keep the request confidential
>
> Hi Sean, Any reason this can't become a MUST now?  Once you require
> comparable channel security, a stronger requirement seems pretty reasonable.
>
> --
> last-call mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/last-call
>

---

From: "Martin Thomson" <[email-masked]>
Date: Thu, 28 Jan 2021 09:50:45 +1100

On Tue, Jan 26, 2021, at 12:33, Nick Sullivan wrote:
> authenticator or authenticator request needs to be kept confidential. 
> There are potential situations where this isn't strictly necessary, so 
> I think SHOULD is appropriate.

Works for me.  I've reviewed the change and while QUIC-TLS wouldn't have been my choice for citation, the text is good.