Subject: [TLS] Reserve or close HashAlgorithm and SignatureAlgorithm registries?

From: Sean Turner <[email-masked]>
Date: Fri, 4 May 2018 15:54:03 -0400

The open issue in draft-ietf-tls-iana-registry-updates is whether we should close the registries or simply reserve the remaining values.  I’ve submitted the following PR to simply reserve the values and point to the SignatureScheme registry for 1.3 values:
https://github.com/tlswg/draft-ietf-tls-iana-registry-updates/pull/75
I did this because a) closing a registry is really just symbolic; a draft (or the IESG) can later reopen the registry, and b) At least person has indicated they might want code points for a TLS1.2 implementation.  Regardless of what we do we should point to the SignatureScheme registry for 1.3, but I just don’t really see the point in “closing” the registry.  If this PR makes you really sad please let us know.

Please note that the gh editor’s copy also includes the IESG-related changes.  I’d characterize most of them as good catches (e.g., cached_info was missing) and consistency (e.g., some of the DE language was not consistent).

I’d also like to point out that IANA specifically asked about the DE doing such a minimal review and we let them know that yes in some cases it was going to be just that.  But, this also made us consider adding the text that was in the security considerations and elsewhere to every DE-related note.  It is clearer now what the DE will do in the notes in case people don’t want to take the time to review this draft, which is actually what I think happens in most cases.

spt

---

From: Russ Housley <[email-masked]>
Date: Fri, 4 May 2018 16:24:29 -0400

I think that reserving them is the right thing for now.  TLS 1.2 and earlier will take a while to disappear, so the ability to assign more values if there is a huge surprise seems prudent.

Russ

> On May 4, 2018, at 3:54 PM, Sean Turner <[email-masked]> wrote:
> 
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: Hubert Kario <[email-masked]>
Date: Mon, 07 May 2018 10:58:10 +0200

On Friday, 4 May 2018 21:54:03 CEST Sean Turner wrote:
> The open issue in draft-ietf-tls-iana-registry-updates is whether we should
> close the registries or simply reserve the remaining values.  I’ve
> submitted the following PR to simply reserve the values and point to the
> SignatureScheme registry for 1.3 values:
> https://github.com/tlswg/draft-ietf-tls-iana-registry-updates/pull/75 I did
> this because a) closing a registry is really just symbolic; a draft (or the
> IESG) can later reopen the registry, and 

every IETF protocol is just symbolic, there is no IETF police ;)

> b) At least person has indicated
> they might want code points for a TLS1.2 implementation. 

then they can ask for SignatureScheme codepoints that follow the TLS 1.2 usage 
patterns, but even in TLS 1.2 you couldn't ask for ecdsa+md5, so the separate 
registries weren't a reflection of reality anyway

either way, I don't feel strongly about it, it's mostly a semantic difference

-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic