Subject: [Ace] Doodle for ACE virtual interim meeting in Oct

From: "Kepeng Li" <[email-masked]>
Date: Wed, 27 Sep 2017 09:44:29 +0800

Hi all,

According to our IETF 99 meeting minutes, we will hold an interim meeting on
certificate enrolment in constrained environments.
https://datatracker.ietf.org/meeting/99/materials/minutes-99-ace/

We proposed three options for the meeting time:
1. 17th Oct, Tuesday, GMT 13:00 ~ 14:00.
2. 18th Oct, Wednesday, GMT 13:00 ~ 14:00.
3. 19th Oct, Thursday, GMT 13:00 ~ 14:00.

Please indicate your available time from the doodle poll:
https://doodle.com/poll/ig3bhr7tfb2xh4u4
<http://doodle.com/poll/v6nbeggazekaq2ut>

Hannes and I will prepare the agenda and send out later. We may add other
topics to the agenda.

Thanks.

Kind Regards
Kepeng & Hannes

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 27 Sep 2017 11:23:11 -0400

Hello Kepeng,

The interim should also be to discuss the profiles as that was a
priority from the WG session in Prague.  Goran pulled together the
wiki, now it's up to the WG participants to check the wiki and amend
as needed to allow for a productive session.  Or did you plan on two
interims?  Timing is tight for that though.

Best regards,
Kathleen

-- 

Best regards,
Kathleen

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 27 Sep 2017 18:09:53 +0200

I agree with Kepeng that we also wanted to discuss the certificate
enrollment in addition to the Wiki.

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 27 Sep 2017 12:23:11 -0400

Sure, my response was to make it clear the wiki was to be discussed
though.  Will this all be on one call or two?  The announcement wasn't
clear and I'd like ot make sure the WG is ready for the profiles
discussion.

Best,
Kathleen

-- 

Best regards,
Kathleen

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 27 Sep 2017 18:34:39 +0200

Fair enough.

We either need to make it longer or pick two dates. I prefer the latter.

---

From: Göran Selander <[email-masked]>
Date: Wed, 27 Sep 2017 17:04:59 +0000

As I mentioned in a previous mail, I’m completely against giving priority
to non-charter items. Therefore the first interim meeting should be
focused on the ACE roadmap - the output from the Wiki activity. If we have
time to discuss certificate enrolment, that is fine. If we want a later
interim for the certificate enrolment discussion that is fine too, as long
as there is sufficient time is given to decide on the ongoing work.

Göran

On 2017-09-27 18:34, "Ace on behalf of Hannes Tschofenig"
<[email-masked] on behalf of [email-masked]> wrote:

>_______________________________________________
>Ace mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/ace

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 27 Sep 2017 13:29:03 -0400

Goran has a good point here.

Kathleen

-- 

Best regards,
Kathleen

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 27 Sep 2017 19:32:37 +0200

Yes, good point. We need to make progress with our chartered items first.

---

From: Shahid Raza <[email-masked]>
Date: Wed, 27 Sep 2017 20:10:36 +0000

Hello Hannes and Göran,

Pardon me if I am missing some (background) information here. If this (https://datatracker.ietf.org/wg/ace/charter/) is the ACE charter, it does not exclude the use of certificates to solve the authentication problem. And without solving the enrolment (process of certifying public keys), the use of certificates is not practical. For individual profiles (DTLS, OSCOAP, IPsec, etc. ) too, without certificate enrolment, the story to establish a secure session between RS and C is incomplete. Symmetric and raw-public keys are by definition pre- or manually shared; however, certificates are enrolled before use. I therefore consider certificate enrolment a part of complete "authentication and authorisation solution” and hence the charter.

Of course, we should discuss profiles first ;)

Best,
Shahid

On 27 Sep 2017, at 19:32, Hannes Tschofenig <[email-masked]<mailto:[email-masked]>> wrote:

Kathleen

On Wed, Sep 27, 2017 at 1:04 PM, Göran Selander
<[email-masked]<mailto:[email-masked]>> wrote:

Göran

On 2017-09-27 18:34, "Ace on behalf of Hannes Tschofenig"
<[email-masked]<mailto:[email-masked]> on behalf of [email-masked]<mailto:[email-masked]>> wrote:

Fair enough.

Best,
Kathleen

On Wed, Sep 27, 2017 at 12:09 PM, Hannes Tschofenig
<[email-masked]<mailto:[email-masked]>> wrote:
I agree with Kepeng that we also wanted to discuss the certificate
enrollment in addition to the Wiki.

Best regards,
Kathleen

On Tue, Sep 26, 2017 at 9:44 PM, Kepeng Li
<[email-masked]<mailto:[email-masked]>> wrote:
Hi all,

According to our IETF 99 meeting minutes, we will hold an interim
meeting on
certificate enrolment in constrained environments.
https://datatracker.ietf.org/meeting/99/materials/minutes-99-ace/

Hannes and I will prepare the agenda and send out later. We may add
other
topics to the agenda.

Thanks.

Kind Regards
Kepeng & Hannes

_______________________________________________
Ace mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ace

_______________________________________________
Ace mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ace

---

From: "Kepeng Li" <[email-masked]>
Date: Thu, 28 Sep 2017 09:14:13 +0800

OK. 

So we will pick up two dates according to the doodle poll result.

The first one will be used to discuss ACE roadmap, the output from the
Wiki activity.

The second one will be used to discuss certificate enrolment in
constrained environments.

Please fill out the doodle poll before next Monday, 2nd Oct.
https://beta.doodle.com/poll/ig3bhr7tfb2xh4u4

Thanks,

Kind Regards
Kepeng

在 28/09/2017, 1:32 AM， "Hannes Tschofenig" <[email-masked]> 写
入:

>>>>>>> <[email-masked]> wrote:
>>>>>>>> Hi all,
>>>>>>>>

---

From: Michael StJohns <[email-masked]>
Date: Thu, 28 Sep 2017 13:21:18 -0400

> Goran has a good point here.

Actually - I don't think he does.   If there is a sufficiently 
interested group of people that want to talk certificate enrollment and 
there is a chair available and willing then do an interim on that.  If 
there is a group of sufficiently interested group of people that want to 
talk about the roadmap then do an interim on that.  If ACE doesn't want 
to have such an interim then perhaps it still gets done as a virtual 
BOF.  But this has as much legitimacy as any of the other ACE work items.

Virtual interims have another more common name - teleconferences. 
They're cheap to hold.

Don't hold the certificate stuff hostage to the roadmap stuff and don't 
confuse a F2F interim with a virtual interim with respect to providing a 
false either or choice.

The IETF is bottom up - we work on what the members are interested in 
working on.  It's not a great idea holding one idea hostage as a means 
of trying to get work done on something else.

Later, Mike

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 28 Sep 2017 13:42:46 -0400

Hi Mike,

I had specifically reached out to the chairs asking for a virtual interim on the profiles and was surprised by that not being listed.  This was a result of agreement at the face to face.  It's not that one is being held hostage, Kepeng has already offered to run 2 separate sessions within the same week.  Maybe you missed a message?

Best,
Kathleen 

Sent from my iPhone

> On Sep 28, 2017, at 1:21 PM, Michael StJohns <[email-masked]> wrote:
> 
> Actually - I don't think he does.   If there is a sufficiently interested group of people that want to talk certificate enrollment and there is a chair available and willing then do an interim on that.  If there is a group of sufficiently interested group of people that want to talk about the roadmap then do an interim on that.  If ACE doesn't want to have such an interim then perhaps it still gets done as a virtual BOF.  But this has as much legitimacy as any of the other ACE work items.
> 
> Virtual interims have another more common name - teleconferences. They're cheap to hold.
> 
> Don't hold the certificate stuff hostage to the roadmap stuff and don't confuse a F2F interim with a virtual interim with respect to providing a false either or choice.
> 
> The IETF is bottom up - we work on what the members are interested in working on.  It's not a great idea holding one idea hostage as a means of trying to get work done on something else.
> 
> Later, Mike
> 
>> 
>> Kathleen
>>

---

From: Göran Selander <[email-masked]>
Date: Fri, 29 Sep 2017 04:54:44 +0000

Hi Mike,

I don’t disagree with your general reasoning, applied to a normally
working WG.

How familiar are you with the inner working and progress of the
authorization-related work in ACE since, say, IETF 96, and the role of the
chair during this time?

(And now I’m not talking about the multicast security discussion, but the
fact that that discussion took place actually also fits into the bigger
picture.)

It is one of the beauties with the IETF is that people can come into the
discussion and share their experience, thanks for that.

It would be even more helpful if we can focus on the specific issues of
this WG. Welcome to bring your terrier into the pit or learn about the
mongrels already there.

Thanks
Göran

---

From: Ludwig Seitz <[email-masked]>
Date: Fri, 29 Sep 2017 09:21:13 +0200

> of trying to get work done on something else.

Mike, I don't believe that discussing new ideas and making progress on 
chartered items is mutually exclusive, but we should still try to 
separate them, in order to avoid going getting side-tracked.

There are some chartered milestones that have been unduly delayed, so 
I'm really in favor of giving them some precedence, in case resources 
(such as meeting time) are limited.

/Ludwig

-- 
Ludwig Seitz, PhD
Security Lab, RISE SICS
Phone +46(0)70-349 92 51

---

From: Michael StJohns <[email-masked]>
Date: Fri, 29 Sep 2017 13:25:54 -0400

> I had specifically reached out to the chairs asking for a virtual interim on the profiles and was surprised by that not being listed.  This was a result of agreement at the face to face.  It's not…

Hi Kathleen -

No - I hadn't missed the message.  In fact it's part of the chain 
below.  I think that doing two sessions is a reasonable resolution.

Hannes had already suggested two sessions when Goran made his comment.  
I was responding to Goran's.    While I appreciate Goran's frustration 
with the slow pace of things in ACE, I also appreciate that we can only 
do what people are willing to spend time doing and I was also giving 
voice to my perception that there really isn't a good common 
understanding of what's acceptable as an ACE work item.

The original ACE charter was somewhat compact and I would have been 
happy had the group completed the last two items on the currently 
approved charter and closed up shop.  Instead the group as a whole 
decided to adopt a bunch more items without amending the charter setting 
somewhat of a precedent.  Now we've started down the path of profiles 
which are also non-charter items.  I'm confused as to why these are any 
different with respect to working group consideration than an item on 
certificate enrollment? (I'm not sure I would buy the argument that the 
profiles are "mechanisms suitable for resource access in constrained 
environments"  and that "certificate enrollment" is not)

So perhaps its time to pause the group and focus all our efforts on 
re-chartering and hold off on all new items including the whole 
profiling wiki stuff?  At the same time pruning the list of Active and 
Related IDs for the group to something manageable?

Mike

---

From: Göran Selander <[email-masked]>
Date: Fri, 29 Sep 2017 17:50:12 +0000

Hi Mike,

Inline

On 2017-09-29 19:25, "Ace on behalf of Michael StJohns"
<[email-masked] on behalf of [email-masked]> wrote:

>> I had specifically reached out to the chairs asking for a virtual
>>interim on the profiles and was surprised by that not being listed.
>>This was a result of agreement at the face to face.  It's not that one
>>is being held hostage, Kepeng has already offered to run 2 separate
>>sessions within the same week.  Maybe you missed a message?
>>
>> Best,
>> Kathleen
>
>Hi Kathleen -
>
>do what people are willing to spend time doing

Does that include what chairs are willing to spend time doing?

> and I was also giving
>which are also non-charter items.

>  I'm confused as to why these are any

The ACE framework (draft-ietf-ace-oauth-authz) does not specify an
complete solution, only the part how OAuth 2.0 is adapted to IoT. The ACE
profiles are providing the missing part, namely how client and resource
server communicate and process the messages, but these depend on the
technology supported by the devices, and in case of IoT we have to accept
that different deployment settings may require different protocols bring
used. This is the reason for the profiles.

In other words we are simply not done with what this WG is chartered for.
The “Authentication and Authorization Solution” is not identical with the
ACE framework. The discussion now is not if profiles should be adopted,
but which profiles and in which order.

Göran