Subject: [stir] Please keep to minute review and charter discussion

From: Russ Housley <[email-masked]>
Date: Tue, 6 Aug 2013 12:56:30 -0400

Once we get chartered, we will need to discuss many of these topics, but I'd like to focus out energy on getting a working group chartered.

---

From: Hadriel Kaplan <[email-masked]>
Date: Tue, 6 Aug 2013 13:29:20 -0400

Afaik, your current charter questions are:

Q1) What are the population sizes we expect in the long-term, and what impact does this have on the charter text?

My answer: No impact on charter text. There's a thread on population sizes, but afaict the answer is "at least medium but possibly BIG".

-------------------------

Q2) The privacy document is fairly straight forward if you only consider the use of a STIR credential in the in-band and an out-of-band mechanisms.  However, it gets much more complicated if one considers other potential uses (and abuses) of this credential in other protocol environments.  Do you have any thoughts on this?  Do you have proposed charter text?

My answer: Something along the lines of what Brian said makes sense, tempered by Henning's response. (how's that for being cryptic? :)  
The proposed charter text you just emailed out a minute ago makes sense to me.

-------------------------

Q3) The threat document is quite different if it cover an in-band mechanism or both an in-band and an out-of-band mechanism.  Do you have any thoughts on this?  Do you have proposed charter text?

My answer: we do have to enumerate the threats we're concerned with or not, and having a separate doc makes sense per Steve's referenced BGP doc.

I propose the following charter text, adding milestone of: "Nov 2013 Submit A document describing threats to the in-band mechanism for Informational"

If we can include the out-of-band threats in that, great - and that should be our stretch objective - but if we can't then we add another milestone later.  The above milestone description does not preclude going beyond.

-------------------------

Anything else?

-hadriel

On Aug 6, 2013, at 12:56 PM, Russ Housley <[email-masked]> wrote:

> _______________________________________________
> stir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/stir

---

From: Russ Housley <[email-masked]>
Date: Tue, 6 Aug 2013 13:31:39 -0400

Yes.

During the BOF, Steve Kent said that he would like to see both a threat model and a privacy analysis as deliverables early in this process.  What do others think?

If you support creation of one of these documents, then answer these two questions.
(1) are you willing to help write one of them?
(2) are you willing to help review one of them?

Russ

---

From: Hadriel Kaplan <[email-masked]>
Date: Tue, 6 Aug 2013 13:36:36 -0400

> (1) are you willing to help write one of them?

Yes but not as main author/editor - I already have two individual drafts submitted that I need to update, and two more new ones coming to a theater near you.

Yes.

-hadriel

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 6 Aug 2013 10:37:24 -0700

On Tue, Aug 6, 2013 at 10:31 AM, Russ Housley <[email-masked]> wrote:

> Yes.
>
> During the BOF, Steve Kent said that he would like to see both a threat
> model and a privacy analysis as deliverables early in this process.  What
> do others think?
>

I mostly agree with Steve.

1. We should do a threat model as an early deliverable.
2. We should attempt to do some initial privacy goals as guidelines
early in the process.
3. Once we have more concrete proposals we should do a privacy
assessment against the goals in #2.

I am willing to help write all of these.

-Ekr

If you support creation of one of these documents, then answer these two
> questions.
> > Q1) What are the population sizes we expect in the long-term, and what
> impact does this have on the charter text?
> >
> > My answer: No impact on charter text. There's a thread on population
> sizes, but afaict the answer is "at least medium but possibly BIG".
> >
> >
> > Q2) The privacy document is fairly straight forward if you only consider
> the use of a STIR credential in the in-band and an out-of-band mechanisms.
>  However, it gets much more complicated if one considers other potential
> uses (and abuses) of this credential in other protocol environments.  Do
> you have any thoughts on this?  Do you have proposed charter text?
> >
> > My answer: Something along the lines of what Brian said makes sense,
> tempered by Henning's response. (how's that for being cryptic? :)
> > Q3) The threat document is quite different if it cover an in-band
> mechanism or both an in-band and an out-of-band mechanism.  Do you have any
> thoughts on this?  Do you have proposed charter text?
> >
> > My answer: we do have to enumerate the threats we're concerned with or
> not, and having a separate doc makes sense per Steve's referenced BGP doc.
> >
> > I propose the following charter text, adding milestone of: "Nov 2013
> Submit A document describing threats to the in-band mechanism for
> Informational"
> >
> > If we can include the out-of-band threats in that, great - and that
> should be our stretch objective - but if we can't then we add another
> milestone later.  The above milestone description does not preclude going
> beyond.
> >
> >> Once we get chartered, we will need to discuss many of these topics,
> but I'd like to focus out energy on getting a working group chartered.

---

From: Eric Burger <[email-masked]>
Date: Thu, 8 Aug 2013 19:54:24 -0400

And like Hadriel, I am willing to review.

---

From: Janet P Gunn <[email-masked]>
Date: Fri, 9 Aug 2013 11:21:30 -0400

I am also willing to review.

Janet

> During the BOF, Steve Kent said that he would like to see both a 
> threat model and a privacy analysis as deliverables early in this 
> process.  What do others think?
> 
> > Q1) What are the population sizes we expect in the long-term, and 
> what impact does this have on the charter text?
> >
> > My answer: No impact on charter text. There's a thread on 
> population sizes, but afaict the answer is "at least medium but possibly 
BIG".
> > Q2) The privacy document is fairly straight forward if you only 
> consider the use of a STIR credential in the in-band and an out-of-
> band mechanisms.  However, it gets much more complicated if one 
> considers other potential uses (and abuses) of this credential in 
> other protocol environments.  Do you have any thoughts on this?  Do 
> you have proposed charter text?
> >
> > My answer: Something along the lines of what Brian said makes 
> sense, tempered by Henning's response. (how's that for being cryptic? :)
> mechanism or both an in-band and an out-of-band mechanism.  Do you 
> have any thoughts on this?  Do you have proposed charter text?
> >
> > My answer: we do have to enumerate the threats we're concerned 
> with or not, and having a separate doc makes sense per Steve's 
> referenced BGP doc.
> >
> > I propose the following charter text, adding milestone of: "Nov 
> 2013 Submit A document describing threats to the in-band mechanism 
> for Informational"
> >
> > If we can include the out-of-band threats in that, great - and 
> that should be our stretch objective - but if we can't then we add 
> another milestone later.  The above milestone description does not 
> preclude going beyond.
> >
> >> Once we get chartered, we will need to discuss many of these 
> topics, but I'd like to focus out energy on getting a working group 
chartered.
> [attachment "smime.p7s" deleted by Janet P Gunn/USA/CSC]