Subject: [TLS] Meeting minuts posted

From: Eric Rescorla <[email-masked]>
Date: Mon, 27 Mar 2006 10:14:05 -0800

The TLS WG meeting minutes have been posted at:

http://www3.ietf.org/proceedings/06mar/minutes/tls.html

There's a temporary smart quote glitch which I've fixed but
the site hasn't updated yet.

Thanks very much for Al Arsenault for taking the minutes.

-Ekr

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Peter Sylvester <[email-masked]>
Date: Thu, 30 Mar 2006 17:08:07 +0200

Two procedural things:

- Could the minutes have some indication about how many persons were 
present?

- The minutes say:
"A show of hands indicated that while a number of people are interested 
in this item, only two were interested enough to agree to review the 
document and comment. Thus, this item will continue as an individual item."

It is unacceptable to make decision only based on the presence of people 
in a meeting.
According my understanding of working groups, the tls  mailing list are 
used to prepare
such decisions.

-- 
To verify the signature, see http://edelpki.edelweb.fr/ 
Cela vous permet de charger le certificat de l'autorité; 
die Liste mit zurückgerufenen Zertifikaten finden Sie da auch.

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 30 Mar 2006 07:17:01 -0800

> - Could the minutes have some indication about how many persons were

I don't remember anyone counting, but I would say arund 50.

> - The minutes say:
> "A show of hands indicated that while a number of people are
> interested in this item, only two were interested enough to agree to
> review the document and comment. Thus, this item will continue as an
> individual item."
>
> It is unacceptable to make decision only based on the presence of
> people in a meeting.
> According my understanding of working groups, the tls  mailing list
> are used to prepare
> such decisions.

My general practice is to post the minutes (that's been done)
and if people object to a decision that was made in the meeting,
then they can speak up at that point and we'll have a discussion.
I generally only explicitly ask for discussion on the list (as
with the TLS 1.2 issue) when the decision seems controversial.

In this particular case, there hadn't been much interest on
the list and since there wasn't much interest in the meeting,
so I didn't think *not* taking this work on would be particularly
controversial. Do you want to argue that the group should work
on this?

-Ekr

---

From: Peter Sylvester <[email-masked]>
Date: Thu, 30 Mar 2006 20:09:25 +0200

Thanks for the quick answer.
> I don't remember anyone counting, but I would say arund 50.
Good.
> with the TLS 1.2 issue) when the decision seems controversial.
This is the point. How do you measure this? The list is the audience.
Anyway, we will see what will happen now :-)
> controversial. Do you want to argue that the group should work
Yes. Here some starter;

I didn't wrote earlier to the list because I expected a presentation at 
the meeting
and I was too busy to comment the current text.

It is known that authorisation statements can be carried somewhere at 
higher levels
like in web services , or even in a HTTP context in an additional header 
similar to
what certain appliances/proxies do with client certs when they map https 
to http.

If one would only look at HTTP, one would need to define a header to
carry this information, in a GLOBAL way, i.e. adding something to
Authentication: Enhanced-withauthorisation,base64 of the assertion

The possibility to use a "separate channel" in TLS looks attractive to 
me, i.e.
a clear separation of the security infomation and the application data.

Concerning the actual text: It seems that since version 0 there are 
considerable
changes, so I haven't really read evrything. So now just some remarks

- Should'nt draft-santesson-tls-supp-00.txt be merged with the text? At
  least subparts?

- The beginning of chapter 2 should probably have all text removed until
  "This document specifies the use .."

- A suggestion to fill in something into the extensions. Asking for 
assertions
  looks somehow similar to what is done with the CertificateRequest. It 
seems
  useful to have some kind of names lists indicating something about the
  entities authorities that provide the assertions (using a reasonable 
default).

- A partner may not be able to resolve an URL, should this be negotiable?
   Or at least, one should announce which type of assertion one will 
provide.

Have fun.

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 30 Mar 2006 11:03:04 -0800

> This is the point. How do you measure this? The list is the audience.

I measure it by discussion on the list and the sense I get from
the meeting. Given that there were basically no comments on the
list on this topic I didn't feel a need to call it out explicitly.
Since you seem to have found it in the minutes just fine, I don't really
see a problem.

>> controversial. Do you want to argue that the group should work

Wait. These are arguments about the material, not about whether
the WG should work on it. Do you have an argument for why this
should be worked on in the TLS WG? Do others agree?

-Ekr