Subject: AW: [Ecrit] requirements

From: Tschofenig Hannes <[email-masked]>
Date: Tue, 22 Mar 2005 22:01:02 +0100

hi ken, 

> At the minneapolis-IETF, there were several presentations on proposed
> requirements that pertain to the ECRIT charter.  in addition, a person
> in the audience thought that prioritization should be part of the 
> effort...at which point several people seemed to run to the microphone
> to say words to the effect of "no, that is definitely not going to be 
> the case for ECRIT"
> 
> since this subject of prioritization also came up at the 
> washinton-ietf,
> I was wondering if it may be worthwhile advocating a statement in an
> ECRIT requirements document that *authorization* of the 
> service by users 
> is *not* a requirement.  negative statements can be just as 
> constructive
> as positive statements.

> 
> the need for authorization is one way I tend distinguish efforts that 
> fall within the scope of the IEPREP wg versus those that fall within
> ECRIT.  perhaps stating this in the next version of a unified(?)
> requirements document may be helpful.

authorization is a pretty broad term (and the same is true for
"prioritization"). we came across a few authorization issues in our
discussion at the ecrit working group meeting. maybe you can explain which
requirement you would like to see being outside the scope of ecrit (or in
scope for ieprep). 

ciao
hannes

> 
> -ken
> 
> 
> _______________________________________________
> Ecrit mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ecrit

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

---

From: "Ken Carlberg" <[email-masked]>
Date: Wed, 23 Mar 2005 08:56:28 -0500

> requirement you would like to see being outside the scope of 
> ecrit (or in scope for ieprep). 

I would not agree that authorization is a broad term within the confines
of the ietf, or for that matter the ecrit wg.  authorization has specific
meanings within the IETF (rfc-2906, AAA Authorization requirements is 
probably a good reference point).  But the point is taken that *how* 
authorization is applied within ecrit should be more specific.

I don't recall authorization issues being brought up at the last meeting.
There were discussions about authentication and integrity with respect to
location information, both those are different beasts.

just to loosely recap from my previous message, I think it would be 
beneficial in one of the requirements documents to state something to 
the effect that "solutions must not require authorization by (end) 
users to access 911/999/112-type services".  The keyword of "must"
versus "should" is something I'd leave to the prospective author(s).

-ken