Subject: Re: [TLS] Revised TLS Charter

From: Joe Salowey <[email-masked]>
Date: Mon, 2 May 2011 08:13:52 -0700

On Apr 27, 2011, at 6:59 PM, Brian Smith wrote:

> Joe Salowey wrote:
>> Below is updated charter text reflecting feedback on the list. Please
>> indicate if you support this text or if you have issues with the text.
> 
> Are extensions that add/remove/reorder handshake records acceptable for TLS 1.2? If so, then I think the the proposed charter looks fine.
> 

[Joe] In most cases I would expect that add/remove/reorder handshake records would be a significant change and would require a charter update.  If the change had minimal impact it is possible that it could be made without updating the charter, but I would think that to be the exception rather than the rule.  

> Thanks,
> Brian
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: Martin Rex <[email-masked]>
Date: Tue, 3 May 2011 00:27:43 +0200 (MEST)

Joe Salowey wrote:
> Brian Smith wrote:
> > Are extensions that add/remove/reorder handshake records acceptable
> > for TLS 1.2? If so, then I think the the proposed charter looks fine.
> 
> [Joe] In most cases I would expect that add/remove/reorder handshake
> records would be a significant change and would require a charter update.
> If the change had minimal impact it is possible that it could be made
> without updating the charter, but I would think that to be the exception
> rather than the rule.  

Over the last couple of years (it looks like mid-of-2006) the TLS WG
never updated its charter for adopting new work, it seems, and there
were a number of documents since then. 

http://datatracker.ietf.org/wg/tls/

While I do think TLS WG should improve on updating its charter, I'm slightly
irritated by suggestions to become extreme in the other direction and anal
about new work items all of a sudden (-- unless there are too many
proposals and it becomes necessary to limit the WGs focus to work only
on a few of them at a time.)

-Martin

---

From: Joe Salowey <[email-masked]>
Date: Wed, 11 May 2011 15:04:50 -0700

> on a few of them at a time.)

[Joe]  The intent is to tighten up the charter so minor work items such, as cipher suites and extensions, are still in scope and major changes to the operation of the protocol are out of scope and require a charter revision.  This does not mean that we cannot discuss such changes in the working group, but before we add add work items to create documents for these changes we would need to update the charter.  While I can envision cases where updating the charter would be irritating I think in most cases where we have working group consensus to make the change it would be relatively easy.

---

From: Brian Smith <[email-masked]>
Date: Thu, 12 May 2011 13:41:18 -0700 (PDT)

Joe Salowey wrote:
> [Joe] The intent is to tighten up the charter so minor work items
> such, as cipher suites and extensions, are still in scope and major
> changes to the operation of the protocol are out of scope and require
> a charter revision. This does not mean that we cannot discuss such
> changes in the working group, but before we add add work items to
> create documents for these changes we would need to update the
> charter. While I can envision cases where updating the charter would
> be irritating I think in most cases where we have working group
> consensus to make the change it would be relatively easy.

There are a changes that we (Mozilla) are interested in implementing, documenting, and standardizing to improve handshake performance, and to improve the privacy and usability of client cert authentication (especially in Asia), so that more websites will adopt HTTPS. It seems counterproductive to change the charter now in such a way that would require us to debate whether we need to change the charter each time. I would like the charter to clearly indicate that significant changes at least in these areas (handshake performance and client cert authentication) are in scope.

Cheers,
Brian

---

From: Joe Salowey <[email-masked]>
Date: Fri, 13 May 2011 08:21:48 -0700

> There are a changes that we (Mozilla) are interested in implementing, documenting, and standardizing to improve handshake performance, and to improve the privacy and usability of client cert authen…
[Joe] Our security AD has requested that we tighten up the charter such that significant changes to the protocol require a charter update.  We can certainly discuss the topics you raise without a charter update.  It may be possible to publish documents for some of the things you want without a charter update.  For other things, in particular things that require significant change to the TLS state machine or other aspects of the protocol we are going to have to go through the process of updating the charter.   This does not have to be a heavyweight process, but it does require more review than just adding a working group milestone.   Since TLS is in widespread use in all areas of the IETF this ensures there is some cross area review before we initiate the work for a major change

---

From: Brian Smith <[email-masked]>
Date: Fri, 20 May 2011 00:42:05 -0700 (PDT)

Joe Salowey wrote:
> [Joe] Our security AD has requested that we tighten up the charter
> such that significant changes to the protocol require a charter
> update. We can certainly discuss the topics you raise without a
> charter update. It may be possible to publish documents for some of
> the things you want without a charter update. For other things, in
> particular things that require significant change to the TLS state
> machine or other aspects of the protocol we are going to have to go
> through the process of updating the charter. This does not have to be
> a heavyweight process, but it does require more review than just
> adding a working group milestone. Since TLS is in widespread use in
> all areas of the IETF this ensures there is some cross area review
> before we initiate the work for a major change

In the next couple of weeks, I could work on getting some drafts of extensions (and/or resurrect some old ones) that I would like to be considered on the standards track, which we (Mozilla and others) are likely to implement and deploy soon. At least two of these extensions do affect the state machine and most of the changes have already been discussed at length in the working group. I think this would be useful input for the decision of what to include in the initial revision of the charter, and would probably prevent some unnecessary future debates about it.

Cheers,
Brian

---

From: Sean Turner <[email-masked]>
Date: Wed, 25 May 2011 20:11:20 -0400

> In the next couple of weeks, I could work on getting some drafts of extensions (and/or resurrect some old ones) that I would like to be considered on the standards track, which we (Mozilla and othe…

I wanted to give everybody a heads up that I put the charter text Joe 
sent around on the telechat for tomorrow.  The current charter is really 
out of date and needs to be updated ASAP.

If the WG decides to adopt the items suggested by Brian then we can 
update the charter again (some WGs update their charters every time they 
finish a certain a draft).  Getting a charter through the IESG is not 
necessarily hard.  It can happen in a short time (like two weeks).  How 
long it takes to agree on the text to submit to the IESG is anybody's guess.

spt