Re: [OPSAWG] [TLS] CALL FOR ADOPTION: draft-reddy-opsawg-mud-tls

2020-09-14 Thread Eric Rescorla
I tend to agree with Ben Schwartz on this. I have two concerns about this draft: 1. It seems likely that it will lead to ossification. While it is true that devices can in theory update their MUD descriptions, as a practical matter expecting middleboxes to enforce certain properties of the TLS han

Re: [OPSAWG] [TLS] CALL FOR ADOPTION: draft-reddy-opsawg-mud-tls

2020-09-16 Thread Eric Rescorla
Taking a step back from details, ISTM that the whole design of this document is antithetical to extensibility: TLS is a protocol with a number of extension points. What this document does is allow an endpoint to restrict its use of a certain set of extension points. However, the language provided h

Re: [OPSAWG] [TLS] CALL FOR ADOPTION: draft-reddy-opsawg-mud-tls

2020-09-18 Thread Eric Rescorla
On Fri, Sep 18, 2020 at 3:12 PM Michael Richardson wrote: > > ekr> Taking a step back from details, ISTM that the whole design of this > ekr> document is antithetical to extensibility: > > I agree. It was my first reaction as well. > I then had another thought: there are dozens of entities out t

Re: [OPSAWG] [TLS] CALL FOR ADOPTION: draft-reddy-opsawg-mud-tls

2020-09-19 Thread Eric Rescorla
On Sat, Sep 19, 2020 at 3:07 PM Michael Richardson wrote: > > Eric Rescorla wrote: > ekr> As a thought example, consider a hypothetical TLS 1.4 which > decided to > ekr> adopt QUIC-style obfuscation of the CH and SH, putting the > obfuscated > ek

Re: [OPSAWG] [TLS] CALL FOR ADOPTION: draft-reddy-opsawg-mud-tls

2020-09-23 Thread Eric Rescorla
On Wed, Sep 23, 2020 at 2:51 AM tirumal reddy wrote: > Hi Ben, > > Please see inline > > On Tue, 22 Sep 2020 at 20:45, Ben Schwartz wrote: > >> I'm not able to understand the new text in Section 6. Are you saying >> that clients MUST include all the listed extensions/features, but MAY also >> i

[OPSAWG] Eric Rescorla's Discuss on draft-mm-wg-effect-encrypt-17: (with DISCUSS and COMMENT)

2018-02-07 Thread Eric Rescorla
Eric Rescorla has entered the following ballot position for draft-mm-wg-effect-encrypt-17: Discuss When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to

Re: [OPSAWG] Eric Rescorla's Discuss on draft-mm-wg-effect-encrypt-17: (with DISCUSS and COMMENT)

2018-02-26 Thread Eric Rescorla
Thanks for the updated draft. Some responses below. On Mon, Feb 19, 2018 at 12:11 PM, Kathleen Moriarty < kathleen.moriarty.i...@gmail.com> wrote: > > > > > DISCUSS > >session encryption that deployed more easily instead of no > >encryption. > > > > I think I understand what you are sayi

Re: [OPSAWG] Eric Rescorla's Discuss on draft-mm-wg-effect-encrypt-17: (with DISCUSS and COMMENT)

2018-02-28 Thread Eric Rescorla
On Tue, Feb 27, 2018 at 11:23 AM, Warren Kumari wrote: > On Mon, Feb 26, 2018 at 3:28 PM, Spencer Dawkins at IETF > wrote: > > Hi, Benoit, > > > > On Mon, Feb 26, 2018 at 2:15 PM, Benoit Claise > wrote: > >> > >> The way I see it, we're going to fix comments forever. > > > > > > Right. But my c

Re: [OPSAWG] Eric Rescorla's Discuss on draft-mm-wg-effect-encrypt-17: (with DISCUSS and COMMENT)

2018-02-28 Thread Eric Rescorla
On Tue, Feb 27, 2018 at 11:23 AM, Warren Kumari wrote: > On Mon, Feb 26, 2018 at 3:28 PM, Spencer Dawkins at IETF > wrote: > > Hi, Benoit, > > > > On Mon, Feb 26, 2018 at 2:15 PM, Benoit Claise > wrote: > >> > >> The way I see it, we're going to fix comments forever. > > > > > > Right. But my c

[OPSAWG] Eric Rescorla's Abstain on draft-mm-wg-effect-encrypt-22: (with COMMENT)

2018-02-28 Thread Eric Rescorla
Eric Rescorla has entered the following ballot position for draft-mm-wg-effect-encrypt-22: Abstain When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to

Re: [OPSAWG] Eric Rescorla's Discuss on draft-mm-wg-effect-encrypt-17: (with DISCUSS and COMMENT)

2018-02-28 Thread Eric Rescorla
gt; Kathleen > > Sent from my mobile device > > On Feb 28, 2018, at 9:45 AM, Eric Rescorla wrote: > > > > On Tue, Feb 27, 2018 at 11:23 AM, Warren Kumari wrote: > >> On Mon, Feb 26, 2018 at 3:28 PM, Spencer Dawkins at IETF >> wrote: >> > Hi, Benoi

Re: [OPSAWG] Eric Rescorla's Discuss on draft-mm-wg-effect-encrypt-17: (with DISCUSS and COMMENT)

2018-02-28 Thread Eric Rescorla
Thank you. -Ekr On Wed, Feb 28, 2018 at 9:06 AM, Warren Kumari wrote: > On Wed, Feb 28, 2018 at 11:49 AM, Eric Rescorla wrote: > > No worries. Looking forward to your thoughts on my comments. > > > > Me too! I've created a repo > (https://github.com/wkumari/

Re: [OPSAWG] Eric Rescorla's Discuss on draft-mm-wg-effect-encrypt-17: (with DISCUSS and COMMENT)

2018-03-14 Thread Eric Rescorla
meeting unless I hear a clear signal that there is > something that you *cannot* live with. > > Thank you again for your Abstain and all of your comments on the document, > W > > On Mon, Mar 5, 2018 at 10:58 AM, Warren Kumari wrote: > > On Wed, Feb 28, 2018 at 9:45 AM, Eri

Re: [OPSAWG] Eric Rescorla's Discuss on draft-mm-wg-effect-encrypt-17: (with DISCUSS and COMMENT)

2018-03-14 Thread Eric Rescorla
t;, 2017. You seem to have lost the authors names here. On Wed, Mar 14, 2018 at 8:04 AM, Warren Kumari wrote: > > On Wed, Mar 14, 2018 at 10:12 AM Eric Rescorla wrote: > >> Hi Warren, >> >> I am on travel today, but I expect to read this today or Frid

Re: [OPSAWG] Eric Rescorla's Discuss on draft-mm-wg-effect-encrypt-17: (with DISCUSS and COMMENT)

2018-03-18 Thread Eric Rescorla
re all > new comments and have been responded to and addressed. > > I requested that the updated version be posted pending approval. > Responses inline. > > On Wed, Mar 14, 2018 at 8:36 PM, Eric Rescorla wrote: > > I have reviewed the new version. Thanks for incorporating m

[OPSAWG] Eric Rescorla's Discuss on draft-ietf-opsawg-mud-20: (with DISCUSS and COMMENT)

2018-04-15 Thread Eric Rescorla
Eric Rescorla has entered the following ballot position for draft-ietf-opsawg-mud-20: Discuss When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https

[OPSAWG] Eric Rescorla's Discuss on draft-ietf-opsawg-mud-20: (with DISCUSS and COMMENT)

2018-04-15 Thread Eric Rescorla
Eric Rescorla has entered the following ballot position for draft-ietf-opsawg-mud-20: Discuss When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https

Re: [OPSAWG] Eric Rescorla's Discuss on draft-ietf-opsawg-mud-20: (with DISCUSS and COMMENT)

2018-04-15 Thread Eric Rescorla
On Sun, Apr 15, 2018 at 10:28 AM, Eliot Lear wrote: > Hi Eric, > > On 15.04.18 13:32, Eric Rescorla wrote: > > Eric Rescorla has entered the following ballot position for > draft-ietf-opsawg-mud-20: Discuss > > When responding, please keep the subject line intact

Re: [OPSAWG] Eric Rescorla's Discuss on draft-ietf-opsawg-mud-20: (with DISCUSS and COMMENT)

2018-04-16 Thread Eric Rescorla
redential for some device made by that manufacturer. So, I'm actually left wondering how that feature is intended to work. I regret not catching this earlier, but perhaps you could explain? Thanks, -Ekr On Sun, Apr 15, 2018 at 11:27 PM, Eliot Lear wrote: > Hi Eric, > > Trimming

Re: [OPSAWG] Eric Rescorla's Discuss on draft-ietf-opsawg-mud-20: (with DISCUSS and COMMENT)

2018-04-16 Thread Eric Rescorla
On Mon, Apr 16, 2018 at 6:55 AM, Eliot Lear wrote: > Hi Eric, > On 16.04.18 14:25, Eric Rescorla wrote: > > Hi Eliot, > > Thanks for continuing the conversation. My question is how this fits into > the system as a whole. > > ISTM that there are two ways in which

Re: [OPSAWG] Fwd: New Version Notification for draft-ietf-opsawg-mud-21.txt

2018-05-18 Thread Eric Rescorla
Eliot, The certificate part seems basically right (I think you should require specific KeyUsage bits). Maybe I missed it, but I didn't see anything about the level of trust you should have in cases where you can't reliably tie the endpoint's transmissions to its certificate. -Ekr On Fri, May 1

Re: [OPSAWG] Fwd: New Version Notification for draft-ietf-opsawg-mud-21.txt

2018-05-18 Thread Eric Rescorla
On Fri, May 18, 2018 at 11:56 AM, Eliot Lear wrote: > Hi EKR, > > > On 18.05.18 19:57, Eric Rescorla wrote: > > Eliot, > > The certificate part seems basically right (I think you > should require specific KeyUsage bits). > It's in there: > > It is ex

Re: [OPSAWG] Fwd: New Version Notification for draft-ietf-opsawg-mud-21.txt

2018-05-22 Thread Eric Rescorla
On Fri, May 18, 2018 at 12:52 PM, Eliot Lear wrote: > > > On 18.05.18 20:59, Eric Rescorla wrote: > > > > On Fri, May 18, 2018 at 11:56 AM, Eliot Lear wrote: > >> Hi EKR, >> >> >> On 18.05.18 19:57, Eric Rescorla wrote: >> > Eliot, &g

[OPSAWG] Eric Rescorla's No Objection on draft-ietf-opsawg-mud-24: (with COMMENT)

2018-06-05 Thread Eric Rescorla
Eric Rescorla has entered the following ballot position for draft-ietf-opsawg-mud-24: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to

Re: [OPSAWG] TSVWG WGLC: draft-ietf-tsvwg-transport-encrypt-08, closes 23 October 2019

2019-11-04 Thread Eric Rescorla
On Mon, Nov 4, 2019 at 5:44 PM Peter Gutmann wrote: > I actually think it's a pretty good summary, and delivers exactly what's > promised in the title. OTOH I can also see that it's going to get > bikeshedded > to death, and will probably never be editable into a form where people > won't > comp