Subject: [Anima] Ted Lemon's Block on charter-ietf-anima-00-09: (with BLOCK)

From: "Ted Lemon" <[email-masked]>
Date: Thu, 02 Oct 2014 04:37:35 -0700

Ted Lemon has entered the following ballot position for
charter-ietf-anima-00-09: Block

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/charter-ietf-anima/

----------------------------------------------------------------------
BLOCK:
----------------------------------------------------------------------

The following exchange between Mark and Brian illustrates what I want out
of a BoF or External Review discussion:

Mark:

[...]

In any case, It's not hard to extrapolate from here that in a year's time
or so, if we continue on the current trajectory, homenet will have come
up with its own non-anima secure bootstrapping, and anima will have come
up with its own non-homenet distributed IPv6 prefix configuration.  

Brian:

Which we should try to coordinate, since I see no reason in
theory why there can't be common underlying mechanisms between
enterprise, carrier and SOHO. But I don't want to hear in 2 years
time that homenet is stuck because anima hasn't met its milestones.

Ted:

Right now Homenet has a solution for the distributed configuration
problem with a spec and at least one WIP implementation, and is working
seriously on the mutual authentication problem.   There may be some
synergy between what Homenet is trying to do and what ANIMA is trying to
do.   If there is, it would be a big win to coordinate the two groups'
activities.   It may also be that there is no synergy, and the efforts
are really effectively independent.

Before the working group is chartered, I would like to see some clarity
reached about this.   If there is synergy, I'd like there to be some
clear agreement about how to move forward so that ANIMA can achieve its
goals and Homenet can achieve its goals without either creating an
interop problem or stalling.

---

From: "Michael Behringer (mbehring)" <[email-masked]>
Date: Thu, 2 Oct 2014 12:49:36 +0000

My personal goal is that what we do in ANIMA is fully compatible with and ideally used in homenet. It would feel wrong to me to have an infrastructure that doesn't work in a homenet. 

The security bootstrap is a good example of what we can achieve, with reasonable effort. To me, address management is a *use case* for the ANIMA work. Actually, we ought to be able to map *any* distributed address management method on top of the autonomic infrastructure that we're trying to create in ANIMA. 

We should also look to use HNCP in ANIMA, for sure (and the charter allows that!). But according to my intro statement, what ANIMA does would have to work across all architectures. We need to look more closely at this, and see whether 1) HNCP works as is , or 2) we can create an HNCP++ that can scale to SP/Ent, or 3) we need a different approach in ANIMA. As long as we do proper due diligence we should be able to settle on the best of those 3 options. 

So, personally I think we can work out a charter that resolves those conflicts, step by step. 

Michael

> -----Original Message-----
> From: Anima [mailto:[email-masked]] On Behalf Of Ted Lemon
> Sent: 02 October 2014 13:38
> To: The IESG
> Cc: [email-masked]
> Subject: [Anima] Ted Lemon's Block on charter-ietf-anima-00-09: (with
> BLOCK)
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> 
> In any case, It's not hard to extrapolate from here that in a year's time or so,
> if we continue on the current trajectory, homenet will have come up with
> its own non-anima secure bootstrapping, and anima will have come up with
> its own non-homenet distributed IPv6 prefix configuration.
> 
> Brian:
> 
> Which we should try to coordinate, since I see no reason in theory why
> there can't be common underlying mechanisms between enterprise, carrier
> and SOHO. But I don't want to hear in 2 years time that homenet is stuck
> because anima hasn't met its milestones.
> 
> Ted:
> 
> Right now Homenet has a solution for the distributed configuration problem
> with a spec and at least one WIP implementation, and is working
> goals and Homenet can achieve its goals without either creating an interop
> problem or stalling.
> 
> 
> 
> 
> _______________________________________________
> Anima mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/anima

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 02 Oct 2014 14:15:15 +0100

On 02/10/14 13:49, Michael Behringer (mbehring) wrote:
> My personal goal is that what we do in ANIMA is fully compatible with
> and ideally used in homenet. It would feel wrong to me to have an
> infrastructure that doesn't work in a homenet.
> 
> The security bootstrap is a good example of what we can achieve, with
> reasonable effort.

FWIW, it is not clear to me that the reasonable requirements
for provisioning device security information (or bootstrapping
if we wanted to call it that) are the same.

In enterprise environments we see fewer larger vendors of devices.
In the home where we additionally have a large range of vendors
many of whom are tiny and leverage a lot of OSS and who could
perhaps not take part in the kind of provisioning infrastructure
that is quite reasonable for enterprises and their vendors.

I do think both want to end up in the same state, where devices
are authorised for connection to the network and where there is
some keying material usable for security, but I'd be surprised
if one approach to getting there worked the same way for both
homes and enterprises.

S.

---

From: "Leddy, John" <[email-masked]>
Date: Thu, 2 Oct 2014 13:50:13 +0000

My worry on this topic is that we are referring to ³the Home² and ³the
Enterprise².
It isn¹t that clear of a distinction.  This isn¹t just a simple L2 flat
home vs. a Fortune 1000 enterprise.

The home is getting more complex and includes work from home; IOT, home
security, hot spots, cloud services, policies, discovery etc.
Large numbers of SMB¹s look like more high end residential than they do
large enterprises.

It would be ideal to have a solution that spans the range of size and
complexity for both residential and enterprise.
Perhaps enabling features/capabilities where required.

Also, as far as IPV6 connectivity residential is probably ahead of
enterprises in adopting V6 centric architectures and services.
Residential doesn¹t have much of a choice, it just happens.

2cents, John

On 10/2/14, 9:15 AM, "Stephen Farrell" <[email-masked]> wrote:

>homenet mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/homenet
>

---

From: Toerless Eckert <[email-masked]>
Date: Thu, 2 Oct 2014 07:22:40 -0700

Fully agreed. But does this imply that we will make most progress by
blocking out a working group that is actively chartered to look at
the problems in the market segments Homenet is not addressing ?

If the BLOCK is meant to suggest a charter improvements for anima to
better define our mutual desire to share whatever is applicable and
not reinvent unnecessarily, then where is the proposed charter text change ? 

Cheers
    Toerless

P.S.: Also, if i may throw in some random tidbit of technology thoughts:

I love home networks (and the WG for it), because it is the best place
for IPv6 to eliminate IPv4 and start creating fresh, better IP
network. I have a lot of doubt that we are anywhere close to going that
route especially in larger enterprises, so the address management for
IPv4 in those networks is going to be a crucial requirement where i don't
think homenet could (or should) be any big help. And i am not sure if i would
want to hold my breath for a lot of IPv4 adress complexity reduction in
IoT either. But certainly autonomic processes cold rather help than hurt
in that matter.

-- 
---
Toerless Eckert, [email-masked]

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 2 Oct 2014 11:12:48 -0400

> if we wanted to call it that) are the same.

This is where we would have overlap with SACM and I2NSF.  I've spoken in
Ops and Dan R has helped to try to recruit some folks to help in SACM.  It
would be good to not solve this in multiple places.  SACM and I2NSF are
de-conflicting what they cover.  Provisioning and assessing security
information is part of those efforts already, hence my questions on the
charter as well.

> that is quite reasonable for enterprises and their vendors.

There is a push in the vendor space for this type of automation and I'm all
for it, let's just coordinate on it so we don't wind up with too many ways
to do it.

> if one approach to getting there worked the same way for both

I'd like to see this discusses more, but maybe it's not in this group?

Thanks,
Kathleen

-- 

Best regards,
Kathleen

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 03 Oct 2014 10:35:46 +1300

> We should also look to use HNCP in ANIMA, for sure (and the charter allows that!). But according to my intro statement, what ANIMA does would have to work across all architectures. We need to look…

Exactly. We have a model for the discovery/negotiation protocol which is
certainly different from HNCP right now, but it is *not* written in stone.
However, today HNCP has a defined scope and has some limitations, so
if we converge, it would have to lose the H ("home") and gain some other
properties. I don't believe we can commit to that in the charter but of
course we can commit to investigate it.

   Brian

> .

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 03 Oct 2014 10:47:50 +1300

> for it, let's just coordinate on it so we don't wind up with too many ways

Absolutely. It isn't surprising that Anima proponents are proposing
specific approaches to security (or anything else), but there is an
overriding sentence in the charter:

"Where suitable protocols, models or methods exist, they will be preferred over
creating new ones. "

Clerarly that calls for coordination and awareness.

   Brian

> ------------------------------------------------------------------------
>

---

From: Dave Taht <[email-masked]>
Date: Thu, 2 Oct 2014 15:19:51 -0700

> My worry on this topic is that we are referring to ³the Home² and ³the

I have always approached homenet as a place to get standards that also work for
small business. Small business is the place (IMHO) where much of an
ipv6 revolution
could start to happen.

> home vs. a Fortune 1000 enterprise.

+1

> Large numbers of SMB¹s look like more high end residential than they do

+1

> Residential doesn¹t have much of a choice, it just happens.

Comcast's rollout has been quite impressive. Gfiber's also.
Others, not so much.

-- 
Dave Täht

https://www.bufferbloat.net/projects/make-wifi-fast

---

From: Sheng Jiang <[email-masked]>
Date: Fri, 3 Oct 2014 01:08:36 +0000

I am fully agree with Brian and Kathleen. It is well understood that the new WG would study on existing solutions and ongoing proposals to make sure it is necessary to create new mechanisms. Coordination and awareness is essential for the ANIMA group.

Best regards,

Sheng
________________________________________
From: homenet [[email-masked]] on behalf of Brian E Carpenter [[email-masked]]
Sent: 03 October 2014 5:47
To: Kathleen Moriarty
Cc: Michael Behringer (mbehring); The IESG; [email-masked]; Stephen Farrell; [email-masked]; Ted Lemon
Subject: Re: [homenet] [Anima] Ted Lemon's Block on charter-ietf-anima-00-09: (with BLOCK)

   Brian

---

From: "Michael Behringer (mbehring)" <[email-masked]>
Date: Fri, 3 Oct 2014 07:12:03 +0000

> From: homenet [mailto:[email-masked]] On Behalf Of Stephen
> Farrell
> Sent: 02 October 2014 15:15
> To: Michael Behringer (mbehring); Ted Lemon; The IESG
> Cc: [email-masked]; [email-masked]
> FWIW, it is not clear to me that the reasonable requirements for
> provisioning device security information (or bootstrapping if we wanted to
> call it that) are the same.
> 
> In the home where we additionally have a large range of vendors many of
> whom are tiny and leverage a lot of OSS and who could perhaps not take
> part in the kind of provisioning infrastructure that is quite reasonable for
> enterprises and their vendors.
> 
> I do think both want to end up in the same state, where devices are
> authorised for connection to the network and where there is some keying
> material usable for security, but I'd be surprised if one approach to getting
> there worked the same way for both homes and enterprises.

Good points, thanks Stephen. I don't think we have clear answers at this point, but this is the job of the ANIMA group (together with the groups that were mentioned) to figure out whether there should be a single approach, and if so, what it should be. 
 
Personally my starting point is "let's try whether a joint approach works", but clearly there is no guarantee. 

Michael