[lamps] Re: CMCbis: SECDIR & HTTP Directorate Reviews

[lamps] Re: CMCbis: SECDIR & HTTP Directorate Reviews - Input Requested

Mike Ounsworth <ounsworth+ietf@gmail.com> Thu, 25 September 2025 15:22 UTC

MIME-Version: 1.0
References: <14E7F2CB-2115-486F-BA37-07F14073D212@sn3rd.com> <CAKZgXHoRW0PHWM9vnLXo+NFx_U3VJq6cLyNrxy9Krpd1cdtR_Q@mail.gmail.com> <ME0P300MB07135566E6148862E06400DAEE1CA@ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM> <CH0PR11MB5739B9A09FB7265E5F0F64EA9F1CA@CH0PR11MB5739.namprd11.prod.outlook.com> <ME0P300MB07133AF9BFE0BB8B7AE30EC1EE1CA@ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM> <CH0PR11MB5739C563D79CEF48ADD8D99E9F1CA@CH0PR11MB5739.namprd11.prod.outlook.com> <89DB1F5D-8632-4B46-A955-796DEB15DBAF@sn3rd.com>
In-Reply-To: <89DB1F5D-8632-4B46-A955-796DEB15DBAF@sn3rd.com>
From: Mike Ounsworth <ounsworth+ietf@gmail.com>
Date: Thu, 25 Sep 2025 10:21:54 -0500
Message-ID: <CAKZgXHoJMSf=dRBcnB=2wn41TE4RpvtwhMxKdhgsm5DDgUrRLg@mail.gmail.com>
To: Sean Turner <sean@sn3rd.com>
Content-Type: multipart/alternative; boundary="0000000000007672fb063fa1bb9c"
Message-ID-Hash: XFG4RUUQ5WX6GL3EKJVHRVUAUMQMSNRD
CC: LAMPS <spasm@ietf.org>
Precedence: list
Subject: [lamps] Re: CMCbis: SECDIR & HTTP Directorate Reviews - Input Requested
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/zeLHayhjzOkdD_KPRaIRH-dZEDE>

Sean,

That all sounds reasonable to me.

On Thu, 25 Sept 2025 at 10:09, Sean Turner <sean@sn3rd.com> wrote:

> Hi! Jumping up to the top of this thread to address #2.
>
> tl;dr: I think what’s in the draft (via PRs [0]) will thread these needles
> (and the Directorate review needle).
>
> TLS is still not required, we don’t pick an HTTP version, and without
> 2119-language say consult RFC 9205 (Building Protocols with HTTP).  If you
> do need protections from eavesdropping TLS is there - also no
> 2119-language.  We (kind of cheat) on the HTTP version by referring to RFC
> 9110; RFC 9110 then refers to the HTTP/1.1, HTTP/2, and HTTP/3. If you
> choose to use TLS or if you pick an HTTP version (or implementation) that
> includes TLS or QUIC, then you need to follow BCP 195; if you’re using TLS
> 1.3/QUIC, don’t use 0-RTT, because POST is not idempotent. AND, the last
> bullet is a bit of waiver (no 2119-language) that says POST is what is used
> so only the rules that apply to POST are relevant.
>
> spt
>
> [0] https://github.com/lamps-wg/cmcbis/pulls
>
> On Sep 24, 2025, at 09:19, Mike Ounsworth <Mike.Ounsworth@entrust.com>
> wrote:
>
> Peter,
>
> I think we're not going to agree.
>
> I think "Does it need HTTP/2.0" is not the right way to look at it, but
> rather "Is there a good reason to restrict this to 1999 technology when the
> modern web is better optimized over more modern transport protocols?"
>
> Anyway, we've both said our piece. I'm going to let this thread lie.
>
> ---
>
> *Mike* Ounsworth
>
> ------------------------------
> *From:* Peter Gutmann <pgut001=40cs.auckland.ac.nz@dmarc.ietf.org>
> *Sent:* Wednesday, September 24, 2025 8:01 AM
> *To:* Mike Ounsworth <Mike.Ounsworth=40entrust.com@dmarc.ietf.org>; Mike
> Ounsworth <ounsworth+ietf@gmail.com>; Sean Turner <sean@sn3rd.com>
> *Cc:* LAMPS <spasm@ietf.org>
> *Subject:* [EXTERNAL] [lamps] Re: CMCbis: SECDIR & HTTP Directorate
> Reviews - Input Requested
>
>
> Mike Ounsworth <Mike.Ounsworth=40entrust.com@dmarc.ietf.org> writes:
>
> >I think it's fair to say that everybody implementing this standard MUST
> >support, at a minimum, HTTP/1.1, but I don't see any good reason to forbid
> >versions of HTTP newer than 1999 (RFC2616).
>
> The problem is that if you don't make noises about not using HTTP/2 then the
> near-universal response I've seen is "2 is bigger than 1, therefore we want 2"
> without having any idea why they want 2.  I'd be happy with something saying
> that /1 is the universal substrate so implementations should use /1, and if
> they want /2 then be very clear why they actually need /2.
>
> It's possible to construct artificial scenarios where you need to use /2 or /3
> or /42, but if the spec allows /2 then users will ask for /2 whether it makes
> any sense or not, and whether it's possible to give them /2 or not, purely
> because 2 > 1.
>
> Peter.
> _______________________________________________
> Spasm mailing list -- spasm@ietf.org
> To unsubscribe send an email to spasm-leave@ietf.org
>
> *Any email and files/attachments transmitted with it are intended solely
> for the use of the individual or entity to whom they are addressed. If this
> message has been sent to you in error, you must not copy, distribute or
> disclose of the information it contains.Please notify Entrust immediately
> and delete the message from your system.*
>
>
> _______________________________________________
> Spasm mailing list -- spasm@ietf.org
> To unsubscribe send an email to spasm-leave@ietf.org
>

[lamps] CMCbis: SECDIR & HTTP Directorate Reviews… Sean Turner
[lamps] Re: CMCbis: SECDIR & HTTP Directorate Rev… Mike Ounsworth
[lamps] Re: CMCbis: SECDIR & HTTP Directorate Rev… Mike Ounsworth
[lamps] Re: CMCbis: SECDIR & HTTP Directorate Rev… Peter Gutmann
[lamps] Re: CMCbis: SECDIR & HTTP Directorate Rev… Peter Gutmann
[lamps] Re: CMCbis: SECDIR & HTTP Directorate Rev… Salz, Rich
[lamps] Re: CMCbis: SECDIR & HTTP Directorate Rev… Mike Ounsworth
[lamps] Re: CMCbis: SECDIR & HTTP Directorate Rev… Sean Turner
[lamps] Re: CMCbis: SECDIR & HTTP Directorate Rev… Mike Ounsworth
[lamps] Re: CMCbis: SECDIR & HTTP Directorate Rev… Sean Turner