Subject: [TLS] Barry Leiba's Discuss on draft-ietf-tls-session-hash-05: (with DISCUSS)

From: "Barry Leiba" <[email-masked]>
Date: Sat, 09 May 2015 15:52:48 -0700

Barry Leiba has entered the following ballot position for
draft-ietf-tls-session-hash-05: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-tls-session-hash/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

This is a DISCUSS purely because I want to discuss it; whatever the
result is, I will be clearing the DISCUSS, and not delaying the document
on this point:  The last paragraph of Section 4 makes me wonder whether
this should "update" 5246.  Basically, while this is an extension (which
wouldn't normally use "updates"), it's one that you're proposing as
standard behavior, and not really as an extension.

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 14 May 2015 09:52:16 +0100

Folks - I note this didn't get an answer. I don't recall that the WG
considered it, and I'm sure if it had the conclusion could have gone
either way (and a random choice would have been fine too:-) but can
you confirm or correct me on that please? If you can do it before the
telechat today (by ~1400 UTC) that'd be great.

Thanks,
S.

On 09/05/15 23:52, Barry Leiba wrote:
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Karthikeyan Bhargavan <[email-masked]>
Date: Thu, 14 May 2015 10:58:14 +0200

The session-hash draft has roughly the same impact as RFC5746, which says:
"Updates: 5246, 4366, 4347, 4346, 2246"

We would be happy to add this list or a subset.

Other RFCs affected by the current proposal are: rfc5929, rfc5705, rfc5746.

Should we note these in any way, other than as Informative References?

Best,
Karthik

---

From: Stephen Farrell <[email-masked]>
Date: Sat, 16 May 2015 18:46:38 +0100

Hiya,

First, I don't think there's much energy for this issue but we
should get it sorted and move on.

So, how about if we add that this updates 5246 and leave it at that?

The meaning there is that anyone who writes a new implementation
of 5246 really ought also do this too.

I don't think there's any possible harm to adding that and doing
so achieves whatever possible good effect there might be from the
addition of any "Updates" relationship.

If I hear nothing, I'll add an RFC editor note to that effect in
a few days and hopefully that'll be sufficient for Barry to clear
his discuss. (Barry, if not, please say what would work.)

Cheers,
S.

---

From: Barry Leiba <[email-masked]>
Date: Sun, 17 May 2015 07:29:44 +0100

That is a perfect answer, and I will clear my discuss now, and let you all
do the right thing, whatever you decide that is.

Barry

On Saturday, May 16, 2015, Stephen Farrell <[email-masked]>
wrote:

> > On 14 May 2015, at 10:52, Stephen Farrell <[email-masked]
> <javascript:;>> wrote:
> >
> >>
> >>> Please refer to
> https://www.ietf.org/iesg/statement/discuss-criteria.html
> >>> [email-masked] <javascript:;>

---

From: Nico Williams <[email-masked]>
Date: Mon, 18 May 2015 10:56:25 -0500

> "Updates: 5246, 4366, 4347, 4346, 2246"

+1 to updating RFC5246 and related.

> Should we note these in any way, other than as Informative References?

RFC5929 is affected in this way: by the effective addition of a security
consideration when used without the session hash extension.  So yes,
RFC5929 should be updated even though its channel binding definitions
won't change.

Nico
--