Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Suggested FAQ changes #2

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Suggested FAQ changes #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions FAQ.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,27 +2,31 @@

This page holds answers to frequently asked questions in the TLS WG. Pull requests to maintain this page are highly encouraged.

## What is in scope for the TLS WG?
## What's in scope for the this WG?

The TLS working group concerns itself with the maintenance of the core TLS protocol. This includes the TLS and DTLS specification, plus any extensions that have wide applicability to TLS usage.

## What is out of scope for the TLS WG?
## What's out of scope?

Anything not in the previous question, though there are a few things in particular:

1. Certificates or Certification Authorities: The [IETF LAMPS](https://datatracker.ietf.org/wg/lamps/documents/) WG does some maintenance on certificates. Concerns about the Web PKI should be taken to the [CA/Browser Forum](https://cabforum.org/).
2. Cryptographic primitives: The [IRTF Crypto Forum Research Group (CFRG)](https://irtf.org/cfrg) is one venue that you can discuss standardizing new primitives.
3. Application or domain-specific extensions to TLS: The working group usually only considers extensions to the protocol that are widely applicable. If your extension is specific to an application or deployment, the working group might not consider adopting the work. You are still encouraged to discuss such work, particularly if you are not sure. The working group has many people with considerable expertise in this area.

## I have a proposal for the TLS WG — what is the best way to see if others are interested in it?
## I have an idea the TLS WG — what is the best way to see if others are interested in it?

There are several things you can do to gauge interest. First, it might help to look through the WG archives for related ideas. If the same proposal was brought to the group and rejected, understanding the rationale for said decision is an important piece of historical data to consider. Have circumstances changed since that decision such that the idea is now practical?

If there are no obviously related drafts, the next step is write up the idea in an Individual Draft and submit it to the working group for discussion. Be sure to carefully motivate the problem in consideration and clearly describe the proposed solution. If applicable, also discuss the extent to which the proposal’s security properties have been studied or formally analyzed. It’s common to submit new ideas without any sort of analysis.

## What do I need to register codepoints for TLS ciphersuites, extensions, etc.?
## How do I register codepoints for TLS ciphersuites, extensions, etc.?

RFC 8446 and 8447 describe new processes by which IANA codepoints are allocated for TLS. See [RFC8447](https://tools.ietf.org/html/rfc8447) for more details on this process. Importantly, RFC 8447 changed some codepoint registration policies to Specification Required. This means registrations are permitted given (1) a permanent and readily available public specification describing the registration (extension, ciphersuite, etc.), such as an Internet Draft, and (2) review by the TLS designated experts, who may be reached at tls-reg-review@ietf.org. The Expert Review policy only requires sign-off from the TLS designated experts.
All registrations require an Expert Review; the panel of experts can be
reached at tls-reg-review@ietf.org. Some registrations are also Specification Required, which means a permanent readily-available document describing the document. Note that an Internet-Draft, even an expired one, is acceptable (although there is some discussion within the IETF about changing that). Also, the current
panel of experts is inclined to require some form of documentation for all registrations.

See [RFC8447](https://tools.ietf.org/html/rfc8447) for more details on this process.

The following list enumerates all items whose policy is Expert Review.

Expand Down Expand Up @@ -82,3 +86,4 @@ No, it does not require review by the TLS WG. However, we encourage authors to s

If your proposal introduces new cryptographic algorithms or mechanisms, or even uses existing mechanisms, consider reaching out to the [IRTF Crypto Forum Research Group (CFRG)](https://irtf.org/cfrg) for consultation.

If your proposal describes how to use TLS in a particular application, consider reaching out to the [Using TLS in Applications Working Group (UTA-WG)](https://datatracker.ietf.org/wg/uta) for consultation.