Subject: [lamps] WG Last Call for rfc6844bis

From: Russ Housley <[email-masked]>
Date: Thu, 11 Oct 2018 14:01:27 -0400

This is the LAMPS WG Last Call for "DNS Certification Authority Authorization (CAA) Resource Record" <draft-ietf-lamps-rfc6844bis-01>.
 
Please review the document and send your comments to the list by 22 October 2018.
 
If no concerns are raised, the document will be forwarded to the IESG with a request for publication as Proposed Standard.

Russ & Tim

---

From: Tim Hollebeek <[email-masked]>
Date: Thu, 11 Oct 2018 19:25:30 +0000

LAMPS chair hat off; CABF Validation Subcommittee (formerly, Validation
Working Group) hat on.

Recently at the CA/Browser Forum, allowing customers to use CAA  to limit
the validation methods that can be used for a domain has been identified
as one of the Forum's highest priorities.  I started a thread on the idea
back
in December:

https://mailarchive.ietf.org/arch/msg/spasm/Jse-FslACq3wair2B2_YSwpViNs

While CAs can potentially unilaterally implement this on their own outside 
the Forum with parameters (as in the acme-caa draft), uniformity throughout 
the industry would be desirable.  The Forum also has the ability to mandate 
implementation by a specific date.

This was discussed on this morning's Validation Subcommittee call, and it
was suggested we ask the group if there is interest in including this in RFC

6844-bis, or whether it would be preferable to handle it as a separate
draft.

-Tim

> -----Original Message-----
> From: Spasm <[email-masked]> On Behalf Of Russ Housley
> Sent: Thursday, October 11, 2018 2:01 PM
> To: SPASM <[email-masked]>
> Subject: [lamps] WG Last Call for rfc6844bis
> 
> This is the LAMPS WG Last Call for "DNS Certification Authority
Authorization
> (CAA) Resource Record" <draft-ietf-lamps-rfc6844bis-01>.
> 
> If no concerns are raised, the document will be forwarded to the IESG with
a
> request for publication as Proposed Standard.
> 
> Russ & Tim
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm

---

From: Ryan Sleevi <[email-masked]>
Date: Fri, 12 Oct 2018 08:12:41 +0900

> 6844-bis, or whether it would be preferable to handle it as a separate

Handle it as a separate draft, and recharter the WG If there is consensus
to adopt draft text. The charter we have does not include that effort, and
there are more ways to botch it then to get it right. It’s an extension, in
theory, so let it be defined as such in a separate document.

Personally, I believe such an extension would be better spec’d as
Informational (thus, at odds with 6844-bis, which is Standards Track),
because what the Forum “wants” is an extension whose namespace is defined
and maintained by the CA/Browser Forum, not the IETF or IANA, and not
designed to interoperate with other PKIs that use CPs other than the
Baseline Requirements. If members of the Forum want Lamps to adopt such
work, they should first work through what it is they want before asking
Lamps to recharter to consider their industry-specific use case.

So no, don’t add a rechartering discussion for WGLC just because some folks
had an extension they want to figure out.

---

From: Tim Hollebeek <[email-masked]>
Date: Fri, 12 Oct 2018 21:16:13 +0000

Your characterization of what the Forum “wants” is at odds with previous discussions in London, where working with IANA was explicitly called out as a goal.

It also is at odds with the unanimous consensus on the last validation call, where everyone agreed that working together with IETF on this was desirable.

-Tim

From: Ryan Sleevi <[email-masked]> 
Sent: Thursday, October 11, 2018 7:13 PM
To: Tim Hollebeek <[email-masked]>
Cc: Russ Housley <[email-masked]>; SPASM <[email-masked]>
Subject: Re: [lamps] WG Last Call for rfc6844bis

On Fri, Oct 12, 2018 at 4:25 AM Tim Hollebeek <[email-masked] <mailto:[email-masked]> > wrote:

Handle it as a separate draft, and recharter the WG If there is consensus to adopt draft text. The charter we have does not include that effort, and there are more ways to botch it then to get it right. It’s an extension, in theory, so let it be defined as such in a separate document.

Personally, I believe such an extension would be better spec’d as Informational (thus, at odds with 6844-bis, which is Standards Track), because what the Forum “wants” is an extension whose namespace is defined and maintained by the CA/Browser Forum, not the IETF or IANA, and not designed to interoperate with other PKIs that use CPs other than the Baseline Requirements. If members of the Forum want Lamps to adopt such work, they should first work through what it is they want before asking Lamps to recharter to consider their industry-specific use case.

So no, don’t add a rechartering discussion for WGLC just because some folks had an extension they want to figure out.

-Tim

> From: Spasm <[email-masked] <mailto:[email-masked]> > On Behalf Of Russ Housley
> To: SPASM <[email-masked] <mailto:[email-masked]> >
Authorization
a
> [email-masked] <mailto:[email-masked]> 
_______________________________________________
Spasm mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/spasm

---

From: Ryan Sleevi <[email-masked]>
Date: Sat, 13 Oct 2018 06:37:36 +0900

On Sat, Oct 13, 2018 at 6:16 AM Tim Hollebeek <[email-masked]>
wrote:

> Your characterization of what the Forum “wants” is at odds with previous
> discussions in London, where working with IANA was explicitly called out as
> a goal.
>
>
Yes, to register the appropriate strings to be associated with an
Informational or CA/Browser Forum maintained document.

It also is at odds with the unanimous consensus on the last validation
> call, where everyone agreed that working together with IETF on this was
> desirable.
>

That’s cool and all, but that’s not how the CA/Browser Forum measures
consent (via Ballot), and that’s not at odds with what I suggested. Write a
draft, recognize the use cases, and if it to be published in IETF at all,
do it as Informational.

In any event, you’re talking about something not on the charter, and doing
it as soon as WGLC starts - and suggesting delay - is poor choice. Does
6844bis address what Lamps was chartered to do? Yes. Does any of your
hypothetical proposal require change to those mechanisms? No. So let’s stop
talking about it in WGLC, focus on the charter and the question asked, and
once there’s something more to discuss, revisit charter revisions and
consensus. But don’t hold up 6844bis to add features to a document designed
to be independently extensible.

>
>
> -Tim
>
>
>
> *From:* Ryan Sleevi <[email-masked]>
> *Sent:* Thursday, October 11, 2018 7:13 PM
> *To:* Tim Hollebeek <[email-masked]>
> *Cc:* Russ Housley <[email-masked]>; SPASM <[email-masked]>
> *Subject:* Re: [lamps] WG Last Call for rfc6844bis
>
>
>
>
>
>
>
> <https://clicktime.symantec.com/a/1/5rpFBqLhTdzu7asMo_-hyYt9-ROTcfJFipkvDJeWLro=?d=MOSPKz9IsX45BNXV-2Y9WUxSSbjbT6KbeBPjG9Uqd-9LoMLTo7L0CYWfW1TOA6DHaEx77jQiY4nM3aORGvs6lEpjUxh40AeENJvZ8SOCZf0Vvd7XnQv-_Hq9Tc5sZDudGkl7Q5PgOzKDKRuU0NF_alaq2vlbS6FxasK3WZDXdRT0M7ongu2XxE143uzc0uek7RezaaA2FvPxzoPuKe2RG-2P1AIRkaM12PC2LPNf8s0V-GQ-CSo1K5laCSRthrcKeL0iichxvcpQmiRwNaK-l_Ex6ajRfaJMAe2C-viv-SRr_9c5p_Wf__HhS5-t4pGzrIwFHO2Rct7wLPjVqCPXzAPuPFj022NG7uuqMZmYgH1mtqQkwROhiDvfAPTkSTztPa6QPzLevszlfMQ3aYVJ5bf4Pg%3D%3D&u=https%3A%2F%2Fmailarchive.ietf.org%2Farch%2Fmsg%2Fspasm%2FJse-FslACq3wair2B2_YSwpViNs>
>
> So no, don’t add a rechartering discussion for WGLC just because some
> folks had an extension they want to figure out.
>
>
>
>
> -Tim
>
> <https://clicktime.symantec.com/a/1/STrHQSx73Sb45xv7Y14pDSX5GabcwkZb-sd6zeIJhQY=?d=MOSPKz9IsX45BNXV-2Y9WUxSSbjbT6KbeBPjG9Uqd-9LoMLTo7L0CYWfW1TOA6DHaEx77jQiY4nM3aORGvs6lEpjUxh40AeENJvZ8SOCZf0Vvd7XnQv-_Hq9Tc5sZDudGkl7Q5PgOzKDKRuU0NF_alaq2vlbS6FxasK3WZDXdRT0M7ongu2XxE143uzc0uek7RezaaA2FvPxzoPuKe2RG-2P1AIRkaM12PC2LPNf8s0V-GQ-CSo1K5laCSRthrcKeL0iichxvcpQmiRwNaK-l_Ex6ajRfaJMAe2C-viv-SRr_9c5p_Wf__HhS5-t4pGzrIwFHO2Rct7wLPjVqCPXzAPuPFj022NG7uuqMZmYgH1mtqQkwROhiDvfAPTkSTztPa6QPzLevszlfMQ3aYVJ5bf4Pg%3D%3D&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fspasm>
> <https://clicktime.symantec.com/a/1/STrHQSx73Sb45xv7Y14pDSX5GabcwkZb-sd6zeIJhQY=?d=MOSPKz9IsX45BNXV-2Y9WUxSSbjbT6KbeBPjG9Uqd-9LoMLTo7L0CYWfW1TOA6DHaEx77jQiY4nM3aORGvs6lEpjUxh40AeENJvZ8SOCZf0Vvd7XnQv-_Hq9Tc5sZDudGkl7Q5PgOzKDKRuU0NF_alaq2vlbS6FxasK3WZDXdRT0M7ongu2XxE143uzc0uek7RezaaA2FvPxzoPuKe2RG-2P1AIRkaM12PC2LPNf8s0V-GQ-CSo1K5laCSRthrcKeL0iichxvcpQmiRwNaK-l_Ex6ajRfaJMAe2C-viv-SRr_9c5p_Wf__HhS5-t4pGzrIwFHO2Rct7wLPjVqCPXzAPuPFj022NG7uuqMZmYgH1mtqQkwROhiDvfAPTkSTztPa6QPzLevszlfMQ3aYVJ5bf4Pg%3D%3D&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fspasm>
>
>

---

From: Tim Hollebeek <[email-masked]>
Date: Fri, 12 Oct 2018 21:44:41 +0000

I actually support not holding up 6844bis and doing it as a separate draft, but people on the call wanted me to find out what the non-CABF LAMPS participants thought.

I don’t think extensions to CAA are outside the scope of the charter, or the 6844bis effort for that matter.  Which is why I was willing to ask and see how the group would like to handle it.

Also, I was asked by the chair to bring it up during the WGLC, so it is inappropriate for you to try to shut down the discussion.

-Tim

From: Ryan Sleevi <[email-masked]> 
Sent: Friday, October 12, 2018 5:38 PM
To: Tim Hollebeek <[email-masked]>
Cc: Russ Housley <[email-masked]>; Ryan Sleevi <[email-masked]>; SPASM <[email-masked]>
Subject: Re: [lamps] WG Last Call for rfc6844bis

On Sat, Oct 13, 2018 at 6:16 AM Tim Hollebeek <[email-masked] <mailto:[email-masked]> > wrote:

Yes, to register the appropriate strings to be associated with an Informational or CA/Browser Forum maintained document.

That’s cool and all, but that’s not how the CA/Browser Forum measures consent (via Ballot), and that’s not at odds with what I suggested. Write a draft, recognize the use cases, and if it to be published in IETF at all, do it as Informational.

In any event, you’re talking about something not on the charter, and doing it as soon as WGLC starts - and suggesting delay - is poor choice. Does 6844bis address what Lamps was chartered to do? Yes. Does any of your hypothetical proposal require change to those mechanisms? No. So let’s stop talking about it in WGLC, focus on the charter and the question asked, and once there’s something more to discuss, revisit charter revisions and consensus. But don’t hold up 6844bis to add features to a document designed to be independently extensible.

-Tim

From: Ryan Sleevi <[email-masked] <mailto:[email-masked]> > 
Sent: Thursday, October 11, 2018 7:13 PM
To: Tim Hollebeek <[email-masked] <mailto:[email-masked]> >
Cc: Russ Housley <[email-masked] <mailto:[email-masked]> >; SPASM <[email-masked] <mailto:[email-masked]> >
Subject: Re: [lamps] WG Last Call for rfc6844bis

-Tim

Authorization
a

---

From: Stephen Farrell <[email-masked]>
Date: Sat, 13 Oct 2018 02:56:47 +0100

Hiya,

On 12/10/18 22:44, Tim Hollebeek wrote:
> Also, I was asked by the chair to bring it up during the WGLC, 

Sorry, the chair of what? lamps? some cabforum thing? I'm not
clear what you meant.

> so it
> is inappropriate for you to try to shut down the discussion.
Hmm. An odd assertion for an IETF WG chair to make on that WG's
list.

But somewhat closer to the actual discussion: IMO the cabforum
is substantially unrepresentative for it's claimed scope so I'm
always skeptical of its claims (even though many seem sane). And
there's also a fine history of people liking yet more PKI related
but not-useful specs, so I'm also skeptcal of all proposed new
work for this WG. For me, that implies there ought be a more than
usually high burden for folks wanting new stuff standardised in
this space.

So, FWIW, I'd prefer see better justification for adopting changes
such as those proposed.

Cheers,
S.

---

From: Sean Turner <[email-masked]>
Date: Mon, 15 Oct 2018 11:48:47 -0400

My thinking is that if the fixes to CAA are done we should not wait to publish those while we figure out what to do wither these “new” things.  I.e., ship this draft if it is ready and do the “new” things in a separate draft.

spt

> On Oct 11, 2018, at 15:25, Tim Hollebeek <[email-masked]> wrote:
>

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 15 Oct 2018 16:18:48 +0000

>    My thinking is that if the fixes to CAA are done we should not wait to publish those while we figure out what to do wither these “new” things.  I.e., ship this draft if it is ready and do the “n…
  
Strongly agree.

And I am glad to hear that CA/Browser Forum is interested in helping write RFC's :)

Thanks for raising the issue, Tim.

---

From: Tim Hollebeek <[email-masked]>
Date: Tue, 16 Oct 2018 02:52:42 +0000

Yes, I realized after I sent the email that "chair" is ambiguous.

I was referring to Russ.

-Tim

> From: Stephen Farrell <[email-masked]>
> Sent: Friday, October 12, 2018 9:57 PM
> To: Tim Hollebeek <[email-masked]>; Ryan Sleevi <ryan-
> [email-masked]>
> Cc: SPASM <[email-masked]>; Russ Housley <[email-masked]>
> Sorry, the chair of what? lamps? some cabforum thing? I'm not clear what you
> meant.
>
> > so it
> Hmm. An odd assertion for an IETF WG chair to make on that WG's list.
>
> But somewhat closer to the actual discussion: IMO the cabforum is
> substantially unrepresentative for it's claimed scope so I'm always 
> skeptical of
> its claims (even though many seem sane). And there's also a fine history of
> people liking yet more PKI related but not-useful specs, so I'm also 
> skeptcal of
> all proposed new work for this WG. For me, that implies there ought be a 
> more
> than usually high burden for folks wanting new stuff standardised in this 
> space.
>
> So, FWIW, I'd prefer see better justification for adopting changes such as 
> those
> proposed.
>
> Cheers,
> S.

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Thu, 18 Oct 2018 10:04:09 -0700

Just to add my voice to the choir: I don't think we should try to 
squeeze new things into 6844bis, but should work on getting it finalized.

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Thu, 25 Oct 2018 14:53:23 -0700

> If no concerns are raised, the document will be forwarded to the IESG with a request for publication as Proposed Standard.

It's now 25 October 2018 and AFAICT no unaddressed concerns have been 
raised. Time to forward the document to IESG?

Thanks,
Jacob

---

From: Tim Hollebeek <[email-masked]>
Date: Fri, 26 Oct 2018 19:10:58 +0000

I think so.

-Tim

> From: Spasm <[email-masked]> On Behalf Of Jacob Hoffman-
> Andrews
> Sent: Thursday, October 25, 2018 5:53 PM
> To: [email-masked]
> a request for publication as Proposed Standard.
>

---

From: Russ Housley <[email-masked]>
Date: Fri, 26 Oct 2018 17:39:44 -0400

Jacob:
> It's now 25 October 2018 and AFAICT no unaddressed concerns have been raised. Time to forward the document to IESG?

I agree.  A shepherd write-up is the next step.  Either Tim or I will work on that.

Russ