Subject: [anonsec] Much ado about little?

From: Nicolas.Williams at sun.com (Nicolas Williams)
Date: Tue Nov 23 21:47:12 2004

So, since Sam Hartman proposed placing the BTNS work in PKI4IPSEC we've
been arguing about: whether that makes sense, whether or not
unauthenticated IPsec should rely on certificates and, to a lesser
extent, what the charter of either BTNS or PKI4IPSEC ought to read like.

The first of those, where to place this work, is the one that really
matters and which we need to reach consensus on.  Our ADs have to
sponsor a new WG, so if there be a BTNS WG it will be because we've
convinced them that there must be one.  So rather than bicker we should
aim to make cogent arguments that our ADs will buy, because they are the
ones that need convincing; in the process we had better convince
ourselves also.

Now, I want to briefly review these arguments from afar, without getting
into details.  Then I'll give my opinion.

One reason we've argued about the use or non-use of certificates in
unauthenticated IPsec is that for some here the use or non-use of certs
here would or should make a difference as to the appropriateness of
PKI4IPSEC as a forum for this work.  That and our weakness for
discussing technical details :)

So, frankly, it seems that the certs/no-certs argument is partly a proxy
for the more important matter of which forum to use to progress this
work.  I don't think it will settle that argument, nor do I think it
should.

And what are the arguments about that important question?  As I see them
they boil down to: whether the subject matter is appropriate for the
PKI4IPSEC WG vs. whether the PKI4IPSEC crowd is not already the one we
want or should want to work out the BTNS work with.  Other arguments
were put forward, and I sense unease about the safety of the mandate to
develop unauthenticated IPsec from opponents, but as I see it the
arguments about subject matter and PKI4IPSEC affinity vs. PKI4IPSEC as
the better forum given its participants as the substantive arguments.

===============

So, now, my opinion, which is that PKI4IPSEC is the right home for this
work not only because it has the right mix of experts, but also because
it will thus attract new regulars, Joe, for example, and myself, too,
all the while further exposing the heretofore regular participants of
PKI4IPSEC to concepts like channel bindings and IPsec APIs (which the
IPSP WG has been working on).  Nothing but good will come of it, a
synergy of talent with additional side benefits such as a lower cost to
the IETF and lower likelihood of obnoxious meeting scheduling conflicts.

As evidence that PKI4IPSEC has experts whom we want to have helping with
and reviewing our work I offer the fact that a number of them have been
posting here recently, and that some of them were at the BoF and made
comments there and did not oppose this work.  And they're talking about
how to design this, and even about channel bindings.  The synergy (and,
BTW, I strongly dislike that word -- whenever I see it used to justify
M&A activity I say run, don't walk, from the relevant companies' stocks,
so I do not use it lightly) has begun.

And who would now oppose unauthenticated IPsec anyways?  And if they
would oppose it in PKI4IPSEC, why wouldn't they also oppose a BTNS WG?
No, the BoF settled the matter of whether the IETF should proceed with
this work.  Let's now reach consensus on the last Layer 9 matter that
needs resolving so we no longer need resist the temptation to discuss
technical details, so we can do that which we are good at: engineering.

Cheers,

Nico
--

---

From: touch at ISI.EDU (Joe Touch)
Date: Tue Nov 23 22:16:16 2004

Nicolas Williams wrote:
> matters and which we need to reach consensus on.

<speaking as BOF chair>

That was the purpose of the query I posted already ;-) Direct replies to 
that message will help me collect and coallate positions on this issue 
to bring to the ADs in summary.

> Our ADs have to

A key part of this is understanding why the ADs suggested this work be 
part of PKI4IPSEC, some of which is related to the issue that "there 
should be only one WG at a time doing IPsec profiles". (not quoting the 
AD, just coining a phrase to refer to).

It isn't clear that the use/nonuse of certificates is relevant to that 
issue.

There are always the issues of 'shared expertise', 'avoiding scheduling 
conflicts', etc. It isn't clear that this argument is unique to PKI4IPSEC.

...
> IPSP WG has been working on).
...

That presumes that channel bindings and IPsec APIs are a key aspect of 
BTNS. The original charter didn't focus on channel bindings, and while 
we discussed the idea of (roughly speaking) 'not interfering with 
channel bindings', it isn't clear that BTNS is the right place to 
champion that issue.

Currently, channel bindings are part of the KITTEN WG, which is arguably 
a better place for that particular focus. To the extent that PKI4IPSEC 
needs interaction with bindings, that argues to merge it with KITTEN, 
not BTNS.

Right now, I'm engaged in further discussions with the ADs on this 
issue, where these discussions are delayed for a few weeks due to travel 
conflicts. I have already requested input from the members of the BOF on 
this issue, that I can bring to the ADs when discussions resume.

Joe
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 254 bytes
Desc: OpenPGP digital signature
Url : http://www.postel.org/pipermail/anonsec/attachments/20041123/5ca944ab/signature.bin

---

From: Nicolas.Williams at sun.com (Nicolas Williams)
Date: Wed Nov 24 08:08:48 2004

> to bring to the ADs in summary.

My intent was to pull back from the current discussions and re-focus.

> AD, just coining a phrase to refer to).

It would be good to inform this list of these reasons.

> channel bindings', it isn't clear that BTNS is the right place to 

No, I gave channel bindings as an example.

Nico
--

---

From: Nicolas.Williams at sun.com (Nicolas Williams)
Date: Wed Nov 24 08:25:47 2004

> No, I gave channel bindings as an example.

Predictably we're once again arguing about things that aren't relevant
to the matter at hand.  I don't care to argue over where channel
bindings work belongs -- that's settled.  It's unfortunate that Joe
misread the above in such a way as to kick off that discussion instead
of focusing on where the BTNS work belongs.

Nico
--

---

From: touch at ISI.EDU (Joe Touch)
Date: Wed Nov 24 09:28:50 2004

Nicolas Williams wrote:
| On Tue, Nov 23, 2004 at 10:14:49PM -0800, Joe Touch wrote:
|
|>
|>Nicolas Williams wrote:
|>
|>>So, since Sam Hartman proposed placing the BTNS work in PKI4IPSEC we've
|>>been arguing about: whether that makes sense, whether or not
|>>unauthenticated IPsec should rely on certificates and, to a lesser
|>>extent, what the charter of either BTNS or PKI4IPSEC ought to read like.
|>>
|>>The first of those, where to place this work, is the one that really
|>>matters and which we need to reach consensus on.
|>
|><speaking as BOF chair>
|>
|>That was the purpose of the query I posted already ;-) Direct replies to
|>that message will help me collect and coallate positions on this issue
|>to bring to the ADs in summary.
|
| My intent was to pull back from the current discussions and re-focus.

That was the point of the post I sent asking for positions.

|>>Our ADs have to
|>>sponsor a new WG, so if there be a BTNS WG it will be because we've
|>>convinced them that there must be one.  So rather than bicker we should
|>>aim to make cogent arguments that our ADs will buy, because they are the
|>>ones that need convincing; in the process we had better convince
|>>ourselves also.
|>
|>A key part of this is understanding why the ADs suggested this work be
|>part of PKI4IPSEC, some of which is related to the issue that "there
|>should be only one WG at a time doing IPsec profiles". (not quoting the
|>AD, just coining a phrase to refer to).
|
| It would be good to inform this list of these reasons.

Once I have the discussions with the ADs, I will.

|>It isn't clear that the use/nonuse of certificates is relevant to that
|>issue.
|>
|>There are always the issues of 'shared expertise', 'avoiding scheduling
|>conflicts', etc. It isn't clear that this argument is unique to PKI4IPSEC.
|>
|>...
|>
|>>So, now, my opinion, which is that PKI4IPSEC is the right home for this
|>>work not only because it has the right mix of experts, but also because
|>>it will thus attract new regulars, Joe, for example, and myself, too,
|>>all the while further exposing the heretofore regular participants of
|>>PKI4IPSEC to concepts like channel bindings and IPsec APIs (which the
|>>IPSP WG has been working on).
|>
|>...
|>
|>That presumes that channel bindings and IPsec APIs are a key aspect of
|>BTNS. The original charter didn't focus on channel bindings, and while
|>we discussed the idea of (roughly speaking) 'not interfering with
|>channel bindings', it isn't clear that BTNS is the right place to
|>champion that issue.
|
| No, I gave channel bindings as an example.

Whether channel bindings is a key aspect of BTNS, or whether BTNS is
just "not incompatible with channel bindings" (as proposed at the BOF by
Sam) may be a contributing factor as to where BTNS stands in relation to
the other WGs.

It would be useful to clarify that issue.

Joe

---

From: touch at ISI.EDU (Joe Touch)
Date: Wed Nov 24 09:32:41 2004

Nicolas Williams wrote:
| On Wed, Nov 24, 2004 at 10:07:31AM -0600, Nicolas Williams wrote:
|
|>On Tue, Nov 23, 2004 at 10:14:49PM -0800, Joe Touch wrote:
|>
|>>Nicolas Williams wrote:
|>>
|>>>So, now, my opinion, which is that PKI4IPSEC is the right home for this
|>>>work not only because it has the right mix of experts, but also because
|>>>it will thus attract new regulars, Joe, for example, and myself, too,
|>>>all the while further exposing the heretofore regular participants of
|>>>PKI4IPSEC to concepts like channel bindings and IPsec APIs (which the
|>>>IPSP WG has been working on).
|>>
|>>...
|>>
|>>That presumes that channel bindings and IPsec APIs are a key aspect of
|>>BTNS. The original charter didn't focus on channel bindings, and while
|>>we discussed the idea of (roughly speaking) 'not interfering with
|>>channel bindings', it isn't clear that BTNS is the right place to
|>>champion that issue.
|>
|>No, I gave channel bindings as an example.
|
| Predictably we're once again arguing about things that aren't relevant
| to the matter at hand.  I don't care to argue over where channel
| bindings work belongs -- that's settled. It's unfortunate that Joe
| misread the above in such a way as to kick off that discussion instead
| of focusing on where the BTNS work belongs.

See my other post. If it's not clear how channel bindings and BTNS is an
issue that impacts where this work belongs, we should continue that
clarification off-list.

Joe

---

From: Nicolas.Williams at sun.com (Nicolas Williams)
Date: Wed Nov 24 09:43:47 2004

On Wed, Nov 24, 2004 at 09:30:18AM -0800, Joe Touch wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> 
> Nicolas Williams wrote:

I wasn't addressing that at all -- I gave it as an example of the
synergy I mentioned, that having PKI4IPSEC folks talking about channel
bindings is evidence that the synergy of talent I posited was coming to
fruition.  Please re-read my post.