Missing normative references?

[edeykholt]

Section 7. Normative references -- does not list any. Shouldn't KERI and CESR be listed?

[m00sey]

They aren't specifications yet so no, they can't be used as normative references (under certain SDO rules)

[darrellodonnell]

Are there really zero normative references (i.e. excluding KERI and CESR)?

[pfeairheller]

According to our ISO expert, normative references are only for existing ISO specs and since none of these are currently ISO specs we aren't listing them in Normative for now.

If we have different rules for when something becomes a normative spec in ToIP, we need to document that and document the process for how specs need to change when being passed to ISO.

[darrellodonnell]

ISO specifications often refer to non-ISO standards/specifications in a normative way. It is hard to point to examples as ISO is a pay-to-play SDO, but an example is the OpenChain specification (ISO/IEC 18974:2023), which has many normative references. This one isn't yet a formal ISO Standard - but it is close, as it is an ISO PAS.

https://github.com/OpenChain-Project/Security-Assurance-Specification/blob/main/Security-Assurance-Specification/ISO-18974/en/ISO-18974.md

[talltree]

I too was stunned to see the statement, "There are no normative references." While it may be an ISO convention to not include any non-ISO specs as normative, the vast majority of standards in the Internet community are coming from IETF or W3C, and if you try to publish a specification there without normative references, you won't get anywhere. So I would strongly recommend following the IETF and W3C precedent in the ToIP version of this specification and then revising it as required for ISO.

[SmithSamuelM]

In a meeting yesterday with Kevin we decided to move the IETF and W3C reference to the normative section for ToIPand then move them back for ISO. Although for foundational specifications like CESR the number of normative references is quite small.