Subject: Re: [Trans] [trans] #122 (rfc6962-bis): TLS server requirements

From: Stephen Kent <[email-masked]>
Date: Wed, 2 Mar 2016 11:14:31 -0500

Paul,

> On Mon, 29 Feb 2016, Stephen Kent wrote:
>
>> The issue was that 6962-bis does a partial job of describing TLS 
>> server behavior,
>> and that one way to fix this is to remove that description and 
>> provide a more
>> complete description in a separate doc. Your comment does not address 
>> this concern,
>> and I disagree with Paul's decision to accept your proposed wontfix 
>> resolution.
>
> Writing a separate document is fine, but out of scope for the bis
> document.
>
> Removing text in the bis document and moving it all to a separate 
> document
> that becomes a blocking normative reference to the bis document is not.
There is no need for 6962-bis document to cite a TLS server doc, if 6962-bis
focuses on CT log operation. You previously stated that 6962-bis cannot
be reduced in scope, but that turned out to not be true (based on any IETF
procedural constraints). So, moving the partial TLS server discussion to a
separate doc (e.g., 
https://datatracker.ietf.org/doc/draft-kseo-trans-ca-subject/ is
a start on this) does not cause the problem you stated.
>
> If you have proposed text that improves this section of the bis document,
> please share so we can discuss that.
https://datatracker.ietf.org/doc/draft-kseo-trans-ca-subject/ includes
text about TLS server requirements. It cites relevant sections of 6962-bis,
but it would be cleaner if these sections were either moved to that doc
or if they appeared in an appendix of 6962-bis.

Steve

---

From: Paul Wouters <[email-masked]>
Date: Wed, 2 Mar 2016 12:15:38 -0500 (EST)

On Wed, 2 Mar 2016, Stephen Kent wrote:

Steve,

> or if they appeared in an appendix of 6962-bis.

Since you are the one objecting to the current state of the section, you
would be the best person to write up a one paragraph summary text to be
discussed for inclusion in this section of the bis document.

Paul

---

From: Eran Messeri <[email-masked]>
Date: Fri, 4 Mar 2016 12:58:41 +0000

Having reviewed that section, I can't find requirements from CT-enabled TLS
servers that are not documented in it.

Steve, were there any particular roles/requirements of CT-enabled TLS
servers that you feel are missing?
The only amendment is appending "CT-aware" to "TLS servers" everywhere, but
it seems implied given the entire document is about CT...

On Wed, Mar 2, 2016 at 5:15 PM, Paul Wouters <[email-masked]> wrote:

> _______________________________________________
> Trans mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/trans
>

---

From: Stephen Kent <[email-masked]>
Date: Wed, 9 Mar 2016 09:57:44 -0500

Eran,

> Having reviewed that section, I can't find requirements from
> CT-enabled TLS servers that are not documented in it.
>
> The only amendment is appending "CT-aware" to "TLS servers"
> everywhere, but it seems implied given the entire document is about CT...

Karen Seo is the author of the Sever/CA doc, so this is a question best 
answered by her.

I injected my comments because I had not seen a message from her on this 
topic.

Since Karen's long-time significant other, Ray Tomlinson (the man who 
put "@" in e-mail addresses), passed away on Saturday morning, she may 
not be ready to deal with this now.

Steve