Subject: [anonsec] Why use self-signed certs at all?

From: Atul.Sharma at nokia.com ([email-masked])
Date: Fri Nov 19 12:36:20 2004

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On
> Behalf Of ext Nicolas Williams
> Sent: Friday, November 19, 2004 2:21 PM
> To: Discussions of anonymous Internet security.
> Subject: Re: [anonsec] Why use self-signed certs at all?
> 
> 
> On Fri, Nov 19, 2004 at 02:11:59PM -0500, [email-masked] wrote:
> > 
> > I agree self signed certificates provide no more trust than
> > a secret and increase the complexity.
> > 
> > If the secrets have life-time then SAs can be reestablished during
> > its lifetime....same as during a cert's lifetime.
> > 
> > Besides, I do not feel that a use of self-signed certs forces BTNS
> > into PKI4IPSEC realm. Self-signed certs is not PKI, so why force
> > BTNS into a PKI-specific work? It sounds bizarre to me.
> 
> First, the proposal from Sam was to re-charter PKI4IPSEC, so please
> let's stop arguing over whether its charter fits BTNS or not -- if we
> agree to place BTNS there then the charter *will* fit it.
> 
> Some reasons: overlap of attendees, cost to the IETF of spinning up a
> new WG, risk of scheduling conflicts, etc...

I would like to say a few things on that:

* The cost to IETF did not seem to matter in creation of PKI4IPSEC, when
  it could have been done under IPSEC working group. But now it is an issue.

* PKI4IPSEC will come end-of-life and BTNS will start. For most part there
  will be only one functional working group to address the issue. I do not
  see a dramatic increase in cost to IETF.

* Joe Touch should have a say in where this work fits in, as he brought in
  the proposal. It does not seem fair that you recharter and rename PKI4IPSEC, 
  and usurp Joe's proposal. He should be given due reward for the work he has 
  done, in the way most appropriate to him and IETF.

I can say more. But I will stop here.

Atul

---

From: Nicolas.Williams at sun.com (Nicolas Williams)
Date: Fri Nov 19 12:47:49 2004

>   it could have been done under IPSEC working group. But now it is an issue.

The IPsec WG supposedly will never meet again -- it was, essentially,
replaced with a new one.

>   done, in the way most appropriate to him and IETF.

I don't agree.  Partly because I first argued for unauthenticated IPsec
quite a while ago.  But, much more importantly, neither Joe nor I have
any special standing on this -- there is a process by which IETF WGs get
chartered or re-chartered.  The IETF processes do not "reward," though
we may feel proud of our accomplishments -- the authors listed in IETF
documents often aren't really the original authors or even authors of
much of their documents' text, they may just be editors; we have
acknowledgements sections in I-Ds/RFCs for, well, acknowledgements.

Nico
--

---

From: touch at ISI.EDU (Joe Touch)
Date: Fri Nov 19 12:48:20 2004

[email-masked] wrote:
...
>   done, in the way most appropriate to him and IETF.

<bof hat OFF, speaking as individual>

FWIW, I don't care where the work happens or what the name of the WG is, 
so long as it is productive and helps the work move forward. My concerns 
about moving this to PKI4IPSEC are related to this, not whether we have 
a separate group or not.

Also, I don't consider the arguments about "charters" being 
stone-chiseled accurate; we've been talking about PKI4IPsec's 
rechartering, and it's entirely possible that the work would get 
rechartered within that WG once it starts. I've seen it happen in other 
WGs, notably in the VPN space, which is part of my concern here.

IMO, if it is overwhelmingly important that this work is done (as seen 
by unanimous consensus at the BOF), that alone warrants a separate WG or 
at least serious consideration about having a place that can focus on 
BTNS issues as primary, rather than secondary.

Joe
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 254 bytes
Desc: OpenPGP digital signature
Url : http://www.postel.org/pipermail/anonsec/attachments/20041119/bc1426ba/signature.bin

---

From: kent at bbn.com (Stephen Kent)
Date: Fri Nov 19 15:37:22 2004

>   it could have been done under IPSEC working group. But now it is an issue.

I think the IPsec WG held its last meeting before pki4ipsec started

>   see a dramatic increase in cost to IETF.

and you base this prediction on ???

Steve

---

From: Nicolas.Williams at sun.com (Nicolas Williams)
Date: Fri Nov 19 15:41:21 2004

On Fri, Nov 19, 2004 at 12:46:55PM -0800, Joe Touch wrote:
> >  the proposal. It does not seem fair that you recharter and rename 
> >  PKI4IPSEC, and usurp Joe's proposal. He should be given due reward for 
> >  the work he has done, in the way most appropriate to him and IETF.
> 

Me too.

> WGs, notably in the VPN space, which is part of my concern here.

What is , effectively, for us, chiseled in stone is the IETF process.

Just as PKI4IPSEC's charter could someday be amended to leave BTNS in
the cold, so could a BTNS WG be concluded without having achieved
anything of note.

What's more, the process for concluding a WG is more light-weight than
the re-chartering process, so, if you really are afraid that
unauthenticated IPsec could get killed for political reasons then
placing it in an existing, *busy* WG may do more to protect it than
spinning up a new WG would.

> BTNS issues as primary, rather than secondary.

I could make a similar argument then that this work belongs in the
KITTEN WG.  I won't.

Nico
--