[rfc-i] Signing RFCs

Dave CROCKER dhc at dcrocker.net
Wed Jun 29 11:26:21 PDT 2011



On 6/29/2011 9:54 AM, Kurt Zeilenga wrote:
> I have no problem with the RFC Editor, in response to a question about RFC
> XXX published on DATE Y, answering "Here's RFC XXX as published today" and
> simply not offering an opinion as to what was published on DATE Y.  For all
> the RFC Editor knows, the server could have temporarily published something
> else on that date, digital signatures or not.


The signing mechanism needs to contain some formal claims about the meaning of
the signature.  Otherwise, folks will confuse the actual meaning with what they
wish it meant.  (cf., DKIM)

There also ought to be a statement about what problems this is intended to
solve.  Otherwise there is no way to assess its likely utility.

Adding mechanisms to on-going critical operations, without either of the above
moves the RFC publishing process out of stable operations and into a different
place with a variety of less comfortable adjectives.

Doing stuff just because it seems like a good idea is marginal for
Internet-Drafts, but seems especially ill-advised for the RFC Series.

On the other hand, there are a variety of uses for a signature that seem
intuitively promising, so I don't really believe that the above constitutes much 
work.  Just diligence.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net


More information about the rfc-interest mailing list