Subject: Re: [websec] handling STS header field extendability

From: =JeffH <[email-masked]>
Date: Fri, 17 Aug 2012 15:55:15 -0700

Yoav Nir noted:
 >
 > As a reminder, the proposed resolution is as follows:
 >
 >  * Do not establish a registry now
 >       Let the first new header field specification establish it
 >
 >  * A client that gets an unknown field ignores it
 >       This means no mandatory-to-understand extensions

Thanks, Yoav.

I'd also noted that we need to decide on a IANA policy to declare. My original 
message is here..

   https://www.ietf.org/mail-archive/web/websec/current/msg01315.html

..and I suggested that, since HSTS is a security policy, I lean towards wanting 
to have relatively rigorous review applied to any registry and its contents 
created for HSTS directives and thus am thinking a policy of "IETF Review" is 
what we ought to state (for "FOO" in the below excerpt from -12 at the end of 
section 6.1)..

    Additional directives extending the semantic functionality of the STS
    header field can be defined in other specifications, with a registry
    (having an IANA policy definition of FOO [RFC5226]) defined for them
    at such time.

    NOTE:  Such future directives will be ignored by UAs implementing
           only this specification, as well as by generally non-
           conforming UAs.  See Section 14.1 "Non-Conformant User Agent
           Implications" for further discussion.

thanks,

=JeffH

---

From: Yoav Nir <[email-masked]>
Date: Sat, 18 Aug 2012 09:21:34 +0300

On Aug 18, 2012, at 1:55 AM, =JeffH wrote:

> I'd also noted that we need to decide on a IANA policy to declare.

Do we need to do this?  Assuming the proposed resolution achieves consensus (and there have been no nays yet), we're not setting up a registry. I don't think we get to set a policy for a registry we're not setting up.

> My original message is here..
> 

HSTS is a security policy. Suppose an extension requires that the certificate contain a logo. Is that security-relevant?  According to section 2 of RFC 5226, policies are made to avoid hoarding of resources (I don't think that's relevant here), and to make sure it makes sense. I think "expert review" would be OK, but I don't think we need to bother with deciding this now.

Yoav

---

From: Tobias Gondrom <[email-masked]>
Date: Sat, 18 Aug 2012 11:44:36 +0100

> Do we need to do this?  Assuming the proposed resolution achieves consensus (and there have been no nays yet), we're not setting up a registry. I don't think we get to set a policy for a registry w…

<hat="WG chair">
AFAIK from an administrative perspective, Yoav is right.
In general we set the IANA policy for registry updates at creation of 
the registry. So no need to do it here without the registry (assuming we 
don't create an IANA registry).

> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec

---

From: Barry Leiba <[email-masked]>
Date: Sat, 18 Aug 2012 20:56:02 -0400

>> Do we need to do this?  Assuming the proposed resolution achieves
>> consensus (and there have been no nays yet), we're not setting up a
>> registry. I don't think we get to set a policy for a registry we're not
>> setting up.
>
> <hat="WG chair">
> In general we set the IANA policy for registry updates at creation of the
> registry. So no need to do it here without the registry (assuming we don't
> create an IANA registry).

The point in this case is that this is a response to Ben's GenART
review, which suggested that we at least nail down the registration
policy at this point, lest someone come along later with an extension
and create the registry with, say, an FCFS policy (probably too
light), or perhaps with a Standards Action policy (arguably too
heavy).

The WG can validly disagree with Ben's review, and unless Russ (or
another AD) strongly agrees and uses it as a DISCUSS point, we're
done.  Even in that case, the WG can still argue against it and try to
convince the AD that it's OK not to do this... and, as Tobias point
out, we usually don't.

>>> I'd also noted that we need to decide on a IANA policy to declare.

"We need to decide on an IANA policy *or* explicitly decide that we
don't want to choose that now, and leave it to whoever creates the
registry later."

Apparently, we have at least two votes for the latter, from Yoav and Tobias.

Barry (with AD hat off, but handily tucked at the ready under his arm)

---

From: Tobias Gondrom <[email-masked]>
Date: Sun, 19 Aug 2012 09:23:05 +0100

> convince the AD that it's OK not to do this... and, as Tobias point
Thanks for the clarification.
> Barry (with AD hat off, but handily tucked at the ready under his arm)

<hat="individual">
Yes, I would vote not to specify an IANA policy for a registry we don't define here. I would be in favor of leaving that to when or if we create such a registry later. Though I don't have a strong opinion on this.

Tobias