Subject: [Pppext] Future of the PPP WG

From: Donald Eastlake <[email-masked]>
Date: Thu, 8 Sep 2011 18:24:24 -0400

Hi,

In case you were unaware, I am now the Chair of PPPEXT.

Generally, there has been little activity in this WG for some years.
Although I believe it serves a useful purpose in examining PPP
proposals, possibly that purpose could be served by just continuing
the mailing list. In any case, it seems likely that, if the situation
continues unchanged, the WG will be dissolved sometime early next
year.

In the process of producing RFC 6361, it became very apparent that the
PPP security RFCs, such as they are, meet few, if any, modern IETF
security guidelines. I believe that there should be an update of PPP
security or, if an effort to update them fails for some reason, then
at least old / inadequate / unimplemented PPP security RFCs should be
declared historic.

My suggestion is that PPPEXT re-Charter to include a goal such as the
above and I'm willing to try drafting a new Charter but welcome
suggestions and comments on all this.

One question is, should PPPEXT have a 1 hour meeting at the November
IETF meeting? I think that would be the best way to come to consensus
on this but obviously only if enough people would plan to actually
attend. So, I'd be interested in who is would attend and any opinions
for or against such a meeting.

Thanks,
Donald
=============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 155 Beaver Street, Milford, MA 01757 USA
 [email-masked]

---

From: Glen Zorn <[email-masked]>
Date: Fri, 09 Sep 2011 18:33:31 +0700

> In case you were unaware, I am now the Chair of PPPEXT.

Thanks for mentioning it!

> security guidelines. 

Would these be realistic guidelines (such as RFC 3552 (but do you
consider that 'modern')) or pie-in-the-sky "in my dream world this is
how it would work" guidelines (like RFC 4962)?

> I believe that there should be an update of PPP

Do you have a list of said RFCs?

> for or against such a meeting.

I would attend if I had no irreconcilable conflicts.

---

From: Mark Townsley <[email-masked]>
Date: Fri, 9 Sep 2011 14:00:53 +0200

>> for or against such a meeting.

PPPEXT hasn't met in, what, 10 years or more? The charter hasn't changed significantly since Thomas Narten was AD. I seriously doubt a physical meeting is worth having in what are already jam-packed IETF meetings.  If you have any PPP experts there, it will be because folks like Glen, James, and others happen to have moved on to other areas that require IETF presence. 

If you are dead set on a recharter (personally, I like the pppext charter, and pointed to it as a good example of a "dormant but useful" WG several times as AD) then round up the PPP guys that are still around and chat with them in the hallway and take it to the list. It could even be a fun bar outing, looking back on the good old 90s... perhaps we could get Craig and Karl Fox to dig up some memorabilia. 

But, please don't make Marcia deal with what to her will look like a brand new WG to deal with scheduling.

- Mark

> _______________________________________________
> Pppext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pppext

---

From: Donald Eastlake <[email-masked]>
Date: Fri, 9 Sep 2011 14:18:22 -0400

Hi Glen,

> how it would work" guidelines (like RFC 4962)?

I should think the PPPEXT WG would decided which guidelines, subject
to the constrains of getting documents through the IETF process :-)

> Do you have a list of said RFCs?

I don't think it is complete but how about the following to start with:

"The PPP Encryption Control Protocol (ECP)",
               RFC 1968, June 1996.
"PPP Challenge Handshake Authentication
               Protocol (CHAP)", RFC 1994, August 1996.
"The PPP Triple-DES Encryption Protocol (3DESE)", RFC 2420, September 1998.

> I would attend if I had no irreconcilable conflicts.

Unless there is significant support, I won't try to have a physical meeting.

Thanks,
Donald

---

From: Donald Eastlake <[email-masked]>
Date: Fri, 9 Sep 2011 14:26:04 -0400

Hi Mark,

Actually I wrote the following:

>> attend. So, I'd be interested in who would attend and any opinions
> PPPEXT hasn't met in, what, 10 years or more? The charter hasn't changed
> significantly since Thomas Narten was AD. I seriously doubt a physical
> meeting is worth having in what are already jam-packed IETF meetings.  If
> you have any PPP experts there, it will be because folks like Glen, James,
> and others happen to have moved on to other areas that require IETF
> presence.

I don't have any particular problem operating PPPEXT without meetings,
if that is what people want, either under the current charter or an
expanded charter to do some security stuff.

> If you are dead set on a recharter (personally, I like the pppext charter,
> and pointed to it as a good example of a "dormant but useful" WG several
> times as AD) then round up the PPP guys that are still around and chat with
> them in the hallway and take it to the list. It could even be a fun bar
> outing, looking back on the good old 90s... perhaps we could get Craig and
> Karl Fox to dig up some memorabilia.

Well, it caused some difficulties with the TRILL over PPP draft that
the current charter prohibits the WG producing any documents, which
seems to also rule out the WG updating any security documents.
Furthermore, I believe that our AD is inclined to shut down the WG if
the current situation doesn't change.

> new WG to deal with scheduling.

Everything has benefits and costs. That it takes some effort to
schedule a meeting for a group that has not met in a long time does
not seem like the exclusively controlling factor to me.

Thanks,
Donald

---

From: Mark Townsley <[email-masked]>
Date: Sat, 10 Sep 2011 01:51:01 +0200

OK, I stand corrected. I was thinking of the charter that had existed before and during my tenure as AD:

http://tools.ietf.org/wg/pppext/charters?item=charter-pppext-2006-07-03.txt

It seems a few sentences were added in 2009, in particular the unfortunate text that says: 

"The group is not expected to create new specifications, and if a need for such work comes up, a recharter is required."

This looks like Jari's handiwork, he just loves to recharter WGs ;-)

With this new sentence, yes, it looks like pppext is unnecessarily hamstrung from advancing enhancements that the group does *not* think are of questionable value. 

- Mark

---

From: William Allen Simpson <[email-masked]>
Date: Fri, 09 Sep 2011 21:10:47 -0400

> With this new sentence, yes, it looks like pppext is unnecessarily hamstrung from advancing enhancements that the group does *not* think are of questionable value.
Ha!  You nailed it in one!!!

# Date: Mon, 18 May 2009 15:35:24 +0300
# From: Jari Arkko <[email-masked]>
# Subject: [Pppext] Charter update
#

And my response was:

$ Date: Tue, 19 May 2009 17:53:22 -0400
$ From: William Allen Simpson <[email-masked]>
$ Subject: Re: [Pppext] Charter update
$
$ Jari Arkko wrote:
$ > The Point-to-Point Protocol (PPP, RFC 1661) is a mature protocol with a
$ > large number of subprotocols, encapsulations and other extensions. The
$ > PPPEXT working exists to provide a forum for asking clarifications
$ > about the existing specifications and to defend against enhancements
$ > of questionable value. The group is not expected to create new
$ > specifications, and if a need for such work comes up, a recharter is
$ > required. The group may, however, advance existing specifications
$ > to the next level in the standards track, if a need for that comes up.
$ >
$ Seems OK, other than "not expected to create new specifications".
$
$ Recent security research has rather obsoleted the ancient authentication
$ and encryption specifications. Every once in awhile, I've been thinking
$ about writing some replacement transforms....
$
$ How about changing to: "... new specifications, other than replacing or
$ updating authentication, confidentiality, and improved key management
$ specifications. If a need for other additional work arises, ...."
$
$ Another thing that group probably ought to discuss is formally retiring
$ some of the ancient Proposed work as Historic.
$
$ Admittedly, we gave up on advancing things like IPCP, as IPv4 was supposedly
$ ready to be replaced (for the past 15 years). Ha!
$

---

From: Thomas Narten <[email-masked]>
Date: Fri, 09 Sep 2011 21:26:59 -0400

Donald Eastlake <[email-masked]> writes:

> In any case, it seems likely that, if the situation continues
> unchanged, the WG will be dissolved sometime early next year.

Care to elaborate on this? Or did I miss something?

> suggestions and comments on all this.

Is there any evidence that the participants on this list have *any*
(and I do mean *any*) energy to do any such work? And would anyone
even care? (By that, are there still folk doing PPP implementations
that would read such documents?)

This WG's current charter seems to be very realistic and pragmatic
given the state of both PPP and the WG. We should not be updating the
charter to add items that will in practice never get done, no matter
how much we might like to see such work getting done (in an ideal
world).

> for or against such a meeting.

If the purpose of such a meeting is to talk about rechartering, I see
no evidence that such time would be well spent.

Thomas

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 10 Sep 2011 03:37:18 GMT

> From: Thomas Narten <[email-masked]>

>            (By that, are there still folk doing PPP implementations

A more accurate way to say that is that this WG should not be turned
into a vanity press for old folks trying to prove we're not irrelevant.

If there is real and substantial work to be done, then it should be
proposed before changing the charter in sufficient detail to convince
honest and well informed third parties that and how the charter should
be changed.

Observations that the security of PPP protocols might be improved
would be valid but entirely insufficient.  Significant needs and
potential fixes must be proposed before starting yet another
multi-year PPP project that would not finish before IPv4 address
exhaustion finally makes IPv6 real.

 ...

Personally I think PPP insecurity was never a very pressing problem,
because link layer security never mattered as much as security at
higher layers.

Besides, other link layer protocols such as 802.11 that are more
popular (measured by nodes using them) and less secure (as commonly
deployed) make the insecurity of PPP links moot.  What bad guy would
bother attacking a PPP/DSL link when a radio can get bits on and
off the same PPP link easier and with fewer traces?

Link layer encryption, authentication, and authorization don't
matter a lot if you have end-to-end confidentiality, authentication,
authorization, non-repudiation, etc.  On the other hand, if you
haven't secured things end-to-end, then link layer security is 
snake oil.

If you've the least connection to today's operational security
community, you know that the worst that could happen with a link layer
attack is trivial compared what happens now in higher layers.  Even
if this WG could fix PPP security this decade, wouldn't the effort
of the rest of the IETF in reviewing, advancing, and shuffling our
documents be better spent in the higher layers?  Recall BPG security,
what DigiNotar and Comodo prove about PKI (that we all knew many years
ago), old style insecure DNS, DNSSEC vulnerabilities analogous to the
PKI problems, the RIR issues, and so forth and so on and on.

It would be nice to fix nasty messes such as PPPoE, but that ship
has also sailed.

Vernon Schryver    [email-masked]

---

From: Glen Zorn <[email-masked]>
Date: Sat, 10 Sep 2011 12:30:50 +0700

On 9/10/2011 1:18 AM, Donald Eastlake wrote:

...

> "The PPP Triple-DES Encryption Protocol (3DESE)", RFC 2420, September 1998.

OK, I guess the crux of my previous question (which I apparently did not
express well) is whether or not the proposed updates are solely or at
least primarily editorial in nature (e.g., bringing the Security
Considerations section into line with the recommendations of RFC 3552).
 Of the documents you mention, I suspect that RFC 1968 & RFC 2420 could
probably be changed any way we want to, since AFAIK there are no actual
deployments of either (I request correction!) but we can't go changing
the way that CHAP works.

...

---

From: Bernard Aboba <[email-masked]>
Date: Fri, 9 Sep 2011 22:44:02 -0700

> If the purpose of such a meeting is to talk about rechartering, I see> no evidence that such time would be well spent.

[BA] +1
After such a long hiatus, I do not think it is wise to attempt to re-activate this WG. 
However, I might consider attending a "PPP Reunion Night" where we play music from the 90s, and reminisce about dialup modems.

---

From: Mark Townsley <[email-masked]>
Date: Sat, 10 Sep 2011 11:33:04 +0200

> However, I might consider attending a "PPP Reunion Night" where we play music from the 90s, and reminisce about dialup modems. 

Now *that* sounds like a good use of time of which I would happily attend :-)

In addition to the 90s music, I think this would have to be our theme song...

http://www.freesound.org/people/Jlew/sounds/16475/

- Mark

---

From: Glen Zorn <[email-masked]>
Date: Sun, 11 Sep 2011 14:13:16 +0700

On 9/10/2011 4:33 PM, Mark Townsley wrote:

>> However, I might consider attending a "PPP Reunion Night" where we
>> play music from the 90s, and reminisce about dialup modems. 
> 

Well, this is all good fun, in a US/Euro-centric kind of way, but it
would be good to remember that in a very large part of the world our
"theme song" is a still a vital part of the Internet & is likely to
remain so for a considerable period of time.  This email will make the
first hop of its journey over (the much maligned) PPPoE, for example;
not everybody lives in advanced countries such as S. Korea (the
connectivity of which should make both the French and Americans hang
their heads in shame).  In short, PPP is far from obsolete.

...

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 11 Sep 2011 14:22:55 GMT

> From: Glen Zorn <[email-masked]>

> their heads in shame).  In short, PPP is far from obsolete.

I don't think the thrust of that claim is entirely accurate.  Do people
outside advanced countries use dialup modems or wireless?  Have you
noticed the lack of modems and serial ports on modern portable computers?
That you can still buy a USB modem doesn't make PPP less obsolete than
floppy disks.  Last month I bought a USB modem so that I can dial with
my new portable, but that is mostly sign of my failure to move with
the times.  The salesman wasn't clear about what I wanted, and I didn't
find a lot of choices.  Somewhere I also have a USB floppy drive.

How would reissuing PPP RFCs with new security boilerplate help
anyone except the authors of the new RFCs?  What would people working
on PPP code do differently if the PPP RFCs had modern security
sections?  How many people are working on implementations of PPPoE
or any other flavor of PPP code?

If moving the never deployed PPP RFCs to Historic and reissuing the
rest with new security sections were all that would happen, it would
be only a dubious effort.  But there would be irresistible pressures
to to fix CHAP, MP, and even IPCP.  The replacements, delivered after
years of wrangling (and no implementations), would be as ill considered
as PAP, PPPoE, and the recently proposed IS-IS security fix.  If against
all likelihood they were eventually deployed, they'd be discovered to
be as insecure as many of the wireless security schemes and cause
interoperabilty problems as the PPPoE MTU still does.

The primary defense against those "improvements" would the fact
that no one (especially not the new RFC authors) would implement
them and fewer would deploy them.

Once upon a time, the IETF produced protocols to fill clear and
present user needs and demands.  Ostensibly fixing PPP with new
security words is the sort of idle hands standards committee
exercise that destroyed the ISO OSI protocol suite.

---

From: Glen Zorn <[email-masked]>
Date: Sun, 11 Sep 2011 23:16:02 +0700

On 9/11/2011 9:22 PM, Vernon Schryver wrote:

> I don't think the thrust of that claim is entirely accurate.  

Upon what do you base that claim?

> Do people
> outside advanced countries use dialup modems or wireless?  

I won't claim to know what _all_ the people outside technologically
advanced countries use (I'll just leave that to you ;-).  However, here
in Thailand, in Cambodia and Laos lots of people have still use dial-up
(though they may be using a mobile phone as a modem).

> Have you

Actually, no: the last one I bought (~6 months ago) had a built-in modem
and an Ethernet port.  My new Android tablet has only Bluetooth & WiFi,
but it's really more of a phone than a computer IMHO.

> or any other flavor of PPP code?

Chill out, Vern, I'm not suggesting that our esteemed Chair's idea is
anything like a good one; I was merely responding to I perceived as the
rather patronizing tone of the emails in question.

---

From: Mark Townsley <[email-masked]>
Date: Sun, 11 Sep 2011 18:43:54 +0200

> their heads in shame).  In short, PPP is far from obsolete.

Obsolete? No. Stable, mature, and in no need of tinkering with? Yes. 

I find listening to the modem training nostalgic (teenage years running BBS systems, not to mention building access servers at IBM and Cisco). I was just guessing others do here as well. This list is not representative of the entire world of Internet users. 

Last time I ran into this same sound in real life was just this summer, using an ATM machine at a gas station in Wisconsin. So, yes, of course all this stuff is still in use, and not just outside the US/Euro-zone. Didn't mean to suggest otherwise.

So, let's chill, and if we do have a PPP get-together and we can both be there, I'll happily buy you the first round ;-)

- Mark

---

From: Donald Eastlake <[email-masked]>
Date: Mon, 12 Sep 2011 00:00:11 -0400

Hi Mark,

On Fri, Sep 9, 2011 at 7:51 PM, Mark Townsley <[email-masked]> wrote:
> "The group is not expected to create new specifications, and if a need for
> such work comes up, a recharter is required."

Not only is that a problem for security documents, if any are desired,
but it tripped up RFC 6361 that ended up having a four week IETF Last
Call to fix the problem.

Thanks,
Donald

> With this new sentence, yes, it looks like pppext is unnecessarily hamstrung
> from advancing enhancements that the group does *not* think are of
> questionable value.
> - Mark
>
>
> But, please don't make Marcia deal with what to her will look like a brand
>
> new WG to deal with scheduling.
>

---

From: Ignacio Goyret <[email-masked]>
Date: Mon, 12 Sep 2011 07:17:00 -0700

>outside advanced countries use dialup modems or wireless?

Actually, a *lot* of people still use dialup modems and in most cases,
they don't even notice. One simple example: many point-of-sale devices
(pretty much everywhere on the planet, including the US) do a quick
V.21/V.22/V.23 dialup call to authorize a credit or debit card charge.

And guess what: pretty much all of them use good, ol' PPP.

Another device which is not as well spread in the US but is available
in many, many countries is a little USB device that links up to 3G
networks, allowing full IP traffic. Guess what: they also use PPP and
the same dialup framework (even if there are no weeee-weeee, hiss-hiss
sounds).

BTW, as a simple reference, I happen to be right now in a country
that would clearly fall in the "outside advanced countries" and,
paraphrasing Glen, this email will start its trip using PPP over 3G.

Cheers to all,
-Ignacio

---

From: William Allen Simpson <[email-masked]>
Date: Mon, 12 Sep 2011 11:05:15 -0400

> And guess what: pretty much all of them use good, ol' PPP.
Let us not forget PPP over SONET/SDH is taking this traffic across the
pond(s)....

---

From: Jacni Qin <[email-masked]>
Date: Tue, 13 Sep 2011 11:53:39 +0800

Hi Donald,

> suggestions and comments on all this.

Besides security, there are also other efforts and active documents, such
as,
draft-boucadair-pppext-portrange-option-08
draft-freedman-pppext-ipv6-6rd-00
draft-hu-pppext-ipv6cp-extensions

And for example, we are working revision of
"draft-hu-pppext-ipv6cp-extensions" to report
the progress (e.g., the implementations, trials in pratical networks) by
now.

> for or against such a meeting.

I'll be there if there is one.

Cheers,
Jacni

---

From: Jacni Qin <[email-masked]>
Date: Tue, 13 Sep 2011 11:54:09 +0800

On Sat, Sep 10, 2011 at 11:37 AM, Vernon Schryver <[email-masked]> wrote:

> Actually, we are trying to get things done in real world to smooth the path
to IPv6, which seems
to be welcome by some ISPs, since, there is a gap in the case of PPP for
IPv6.
I know it may have been discussed, and a suggestion was given, but some ISPs
whose access networks are 90% based on PPP, and who are planning to deploy
IPv6 for their comercial services, are not convinced.

There're still works need to be done.

Cheers,
Jacni

---

From: Jacni Qin <[email-masked]>
Date: Tue, 13 Sep 2011 11:54:47 +0800

> the same dialup framework (even if there are no weeee-weeee, hiss-hiss
Right, the PPP/PPPoE has much wider scope of applications,
For example, in my place, even in the context of LAN, xPON access, my ISPs
still chose PPPoE instead of "IPoE", since it's far from deliverable for
commercial services.
Actually the protocols (e.g. DHCPv6, SLAAC) are all good enough, but from
operational
perpective, I mean for example AAA, that mode is not mature.

> paraphrasing Glen, this email will start its trip using PPP over 3G.
You got the point, me too, I'm using PPP over UMTS to send this message. ;-)

Cheers,
Jacni

---

From: Jacni Qin <[email-masked]>
Date: Tue, 13 Sep 2011 11:55:01 +0800

hi,

> their heads in shame).  In short, PPP is far from obsolete.
+1

Cheers,
Jacni

---

From: Donald Eastlake <[email-masked]>
Date: Tue, 27 Sep 2011 15:31:49 -0400

There will not be a PPPEXT meeting in Taiwan.

Probably next week, I'll review this thread and post my conclusions.

Thanks,
Donald

---

From: Glen Zorn <[email-masked]>
Date: Wed, 28 Sep 2011 11:20:04 +0700

> Probably next week, I'll review this thread and post my conclusions.

Actually, there is one useful thing that this WG could do before its
demise: update or obsolete RFC 3818 so that necessary work can be done
when it (the WG) is gone.

...

---

From: Mark Townsley <[email-masked]>
Date: Wed, 28 Sep 2011 08:37:26 +0200

> There will not be a PPPEXT meeting in Taiwan.

And a "get-together" of PPP old-far^H^H^Htimers?

- Mark

---

From: James Carlson <[email-masked]>
Date: Wed, 28 Sep 2011 08:32:18 -0400

> when it (the WG) is gone.

Please clarify: an update in what way?  The existing document requires
"IETF Consensus" for a certain set of protocol numbers in order to
ensure that any work that's done has meaningful review.  I think this is
a good thing, and certainly should not be considered "obsolete."

In the absence of an IETF PPPEXT WG, I'd expect that any "necessary
work" in these areas would be done in the context of (and likely in
service to) some other working group, with others outside that group
solicited for comment as needed.  "PPPEXT" then becomes as necessary to
the process as would be an "ICMPEXT" group.

If anything, I think RFC 3818 should be strengthened, not abandoned.

-- 
James Carlson         42.703N 71.076W         <[email-masked]>

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 28 Sep 2011 13:48:04 GMT

> when it (the WG) is gone.

RFC 3818 does nothing but require that IANA demand IETF consensus (not
necessarily consensus in this WG) before assigning new numbers in some
address spaces.  So how would changing RFC 3818 be useful and to whom?
How would replacing RFC 3818 help users and implementors of PPP related
protocols, as opposed to helping people with personal needs to be RFC
authors?

If future necessary work can't get IETF consensus to replace RFC
3818 when the need arises, then its necessarity is not a proper
concern of the IETF.

Changing RFC 3818 would only slightly ease publiccation of ill
considered ideas driven not by technical needs but by misunderstanding,
hurt feelings, or vanity like the majority of PPP related IDs for
the last 10 years.

---

From: William Allen Simpson <[email-masked]>
Date: Thu, 29 Sep 2011 07:18:21 -0400

> when it (the WG) is gone.
Glen, what needs to be changed?  I didn't pay any particular attention
to it at the time, but this really looks like a one-off RFC to update
some kind of IANA considerations.  It doesn't appear to be idiotic.

Anything new will have new IANA considerations.