Subject: [dane] How should draft-hoffman-dane-smime be written?

From: Paul Hoffman <[email-masked]>
Date: Tue, 4 Sep 2012 08:07:29 -0700

Greetings again. As those of you who were at the IETF meeting in Vancouver (or those who read the minutes at http://www.ietf.org/proceedings/84/minutes/minutes-84-dane) know, Jakob and I are unsure about how the WG might want our draft to look. The current version of the draft expires in a few days, so we have an opportunity to make major changes now.

From our presentation:
What should be in the doc?
1.  Copy whole DANE-for-TLS RFC and make needed changes
2.  Copy structure of DANE-for-TLS RFC and point to it but don’t copy much
3.  Say “we assume you read and understood DANE-for-TLS, and here are the relevant differences”

If the WG can come to rough consensus in the next few days, we'll try to get the changes in before the doc expires; otherwise, we'll do an uninteresting bump draft and make the content changes later.

--Paul hoffman

---

From: Richard Barnes <[email-masked]>
Date: Tue, 4 Sep 2012 11:27:37 -0400

Mostly 3.

The main difference is how TLSA records are located, right?  Something like "lhs._at.rhs" instead of "_port._proto.name".  The validation rules are PKIX-based, not TLS-based, so they can be re-used for S/MIME. 

So it seems like the S/MIME draft should just say something like:
1. Here's how you find a TLSA record for an email address (replaces Section 3 of RFC 6698)
2. Everything else is the same as in RFC 6698.

On Sep 4, 2012, at 11:07 AM, Paul Hoffman wrote:

> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane

---

From: "Jim Schaad" <[email-masked]>
Date: Tue, 4 Sep 2012 09:21:10 -0700

I would like to see selection 2 use.

I would not copy any of the internal structure of DANE records - just point.
But I am not sure at this point that much of the rest of the document is
going to be the same.  If it is, then it can be eliminated later.

Jim

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Richard Barnes
> Sent: Tuesday, September 04, 2012 8:28 AM
> To: Paul Hoffman
> Cc: IETF DANE WG list
> Subject: Re: [dane] How should draft-hoffman-dane-smime be written?
> 
> Mostly 3.
> 
> The main difference is how TLSA records are located, right?  Something
like
> "lhs._at.rhs" instead of "_port._proto.name".  The validation rules are
PKIX-
> based, not TLS-based, so they can be re-used for S/MIME.
> 
> 1. Here's how you find a TLSA record for an email address (replaces
Section 3
> of RFC 6698) 2. Everything else is the same as in RFC 6698.
> 
> 
> 
> 
> > Greetings again. As those of you who were at the IETF meeting in
> Vancouver (or those who read the minutes at
> http://www.ietf.org/proceedings/84/minutes/minutes-84-dane) know,
> Jakob and I are unsure about how the WG might want our draft to look. The
> current version of the draft expires in a few days, so we have an
opportunity
> to make major changes now.
> >
> > From our presentation:
> > 1.  Copy whole DANE-for-TLS RFC and make needed changes 2.  Copy
> > structure of DANE-for-TLS RFC and point to it but don't copy much 3.
> > Say "we assume you read and understood DANE-for-TLS, and here are the
> relevant differences"
> >
> > If the WG can come to rough consensus in the next few days, we'll try to
> get the changes in before the doc expires; otherwise, we'll do an
> uninteresting bump draft and make the content changes later.
> >
> > --Paul hoffman

---

From: James Cloos <[email-masked]>
Date: Tue, 04 Sep 2012 19:13:23 -0400

>>>>> "PH" == Paul Hoffman <[email-masked]> writes:

PH> From our presentation:
PH> What should be in the doc?
PH> 1.  Copy whole DANE-for-TLS RFC and make needed changes
PH> 2.  Copy structure of DANE-for-TLS RFC and point to it but don’t copy much
PH> 3.  Say “we assume you read and understood DANE-for-TLS, and here are the relevant differences”

I'm leaning about 129/127 in favour of 3 over 2.
(Or should that be for 11 over 10? :)

But please do not choose option 1!

-JimC
-- 
James Cloos <[email-masked]>         OpenPGP: 1024D/ED7DAEA6

---

From: "Matt Miller (mamille2)" <[email-masked]>
Date: Wed, 5 Sep 2012 01:46:41 +0000

> If the WG can come to rough consensus in the next few days, we'll try to get the changes in before the doc expires; otherwise, we'll do an uninteresting bump draft and make the content changes late…

I would prefer (3), but would accept consensus around (2).

- m&m

Matt Miller - <[email-masked]>
Cisco Systems, Inc.

---

From: Miek Gieben <[email-masked]>
Date: Wed, 5 Sep 2012 11:37:26 +0200

[ Quoting <[email-masked]> in "Re: [dane] How should draft-hoffman..." ]
> 2. Everything else is the same as in RFC 6698.

I'm in favor for that too. Keep it nice and short.

grtz Miek

---

From: Paul Wouters <[email-masked]>
Date: Wed, 5 Sep 2012 19:46:05 -0400 (EDT)

> 3.  Say “we assume you read and understood DANE-for-TLS, and here are the relevant differences”

3 preferred, 2 okay.

Paul

---

From: Olafur Gudmundsson <[email-masked]>
Date: Thu, 06 Sep 2012 09:35:04 -0400

>> the relevant differences”

+1

	Olafur

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 07 Sep 2012 14:44:03 -0700

>> are the relevant differences”

Ditto.  In some ways I worry about this becoming a repeating problem (I
think it will) and it would have made more sense to split the TLSA
document into logical pieces so you could say things like "go read this
and then apply these minor twiddles", and have the 'this' not be another
protocol-specific document like it is with TLSA.  So, you might think
that I'm thinking the right thing to do is 

  4. publish the TLSA document again in a multi-document, split-up
     fashion so it's more reusable.

But I don't think it's worth the work, so 3 is likely better.

-- 
Wes Hardaker                                     
My Pictures:  http://capturedonearth.com/
My Thoughts:  http://pontifications.hardakers.net/