Subject: [Ace] Alissa Cooper's No Objection on charter-ietf-ace-00-00: (with COMMENT)

From: "Alissa Cooper" <[email-masked]>
Date: Mon, 12 May 2014 16:20:17 -0700

Alissa Cooper has entered the following ballot position for
charter-ietf-ace-00-00: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/charter-ietf-ace/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

There is some lack of clarity in this charter about whether the group
wants to standardize One Solution to Rule them All, or multiple
solutions. It sounds mostly like one solution, except for the paragraph
that begins "Existing authentication and authorization protocols will be
used and re-applied ...." It would be good for the charter to clarify
this.

---

From: Likepeng <[email-masked]>
Date: Tue, 13 May 2014 16:39:54 +0000

>There is some lack of clarity in this charter about whether the group wants to standardize One Solution to Rule them All, or multiple solutions. It sounds mostly like one solution, except for the paragraph that begins "Existing authentication and authorization protocols will be used and re-applied ...." It would be good for the charter to clarify this.

I think it is better to have just one solution. Maybe it can't solve all the problem, but it improves the interoperability. If we have multiple solutions, we will have interoperability issues.

About the paragraph you mentioned, here is the change proposal:

OLD
Existing authentication and authorization protocols will be used and re-applied for use in constrained environments where applicable. This requires relevant specifications to be reviewed for suitability, selecting a subset of them and restricting the options within each of the specifications. Some functionality, however, may not be available in existing protocols and thus new standardization efforts may be required.
Leveraging existing work means the working group benefits from available security analysis, implementation, and deployment experience. Moreover, a standardized solution for federated authentication and authorization will help to stimulate the deployment of constrained devices that provide increased security.

NEW
Existing authentication and authorization protocols will be used where applicable to build the constrained-environment solution. This requires relevant specifications to be reviewed for suitability, selecting a subset of them and restricting the options within each of the specifications. Some functionality, however, may not be available in existing protocols, in which case the solution may also involve new protocol work. Leveraging existing work means the working group benefits from available security analysis, implementation, and deployment experience. Moreover, a standardized solution for federated authentication and authorization will help to stimulate the deployment of constrained devices that provide increased security.
END

Hope this clarifies.

Thanks,

Kind Regards
Kepeng

-----邮件原件-----
发件人: Ace [mailto:[email-masked]] 代表 Alissa Cooper
发送时间: 2014年5月13日 7:20
收件人: The IESG
抄送: [email-masked]
主题: [Ace] Alissa Cooper's No Objection on charter-ietf-ace-00-00: (with COMMENT)

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)

There is some lack of clarity in this charter about whether the group wants to standardize One Solution to Rule them All, or multiple solutions. It sounds mostly like one solution, except for the paragraph that begins "Existing authentication and authorization protocols will be used and re-applied ...." It would be good for the charter to clarify this.

_______________________________________________
Ace mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ace

---

From: Alissa Cooper <[email-masked]>
Date: Tue, 13 May 2014 11:10:02 -0700

On 5/13/14, 9:39 AM, "Likepeng" <[email-masked]> wrote:

>I think it is better to have just one solution. Maybe it can't solve all
>the problem, but it improves the interoperability. If we have multiple
>solutions, we will have interoperability issues.
>
>Existing authentication and authorization protocols will be used and
>re-applied for use in constrained environments where applicable. This
>requires relevant specifications to be reviewed for suitability,
>selecting a subset of them and restricting the options within each of the
>specifications. Some functionality, however, may not be available in
>existing protocols and thus new standardization efforts may be required.
>Leveraging existing work means the working group benefits from available
>security analysis, implementation, and deployment experience. Moreover, a
>standardized solution for federated authentication and authorization will
>help to stimulate the deployment of constrained devices that provide
>increased security.
>
>NEW
>Existing authentication and authorization protocols will be used where
>applicable to build the constrained-environment solution. This requires
>relevant specifications to be reviewed for suitability, selecting a
>subset of them and restricting the options within each of the
>specifications. Some functionality, however, may not be available in
>existing protocols, in which case the solution may also involve new
>protocol work. Leveraging existing work means the working group benefits
>from available security analysis, implementation, and deployment
>experience. Moreover, a standardized solution for federated
>authentication and authorization will help to stimulate the deployment of
>constrained devices that provide increased security.
>END

This looks better. Thanks.
Alissa