Subject: Re: [homenet] [Anima] Ted Lemon's Block on charter-ietf-anima-00-09: (with BLOCK)

From: "Michael Behringer (mbehring)" <[email-masked]>
Date: Thu, 2 Oct 2014 12:49:36 +0000

My personal goal is that what we do in ANIMA is fully compatible with and ideally used in homenet. It would feel wrong to me to have an infrastructure that doesn't work in a homenet. 

The security bootstrap is a good example of what we can achieve, with reasonable effort. To me, address management is a *use case* for the ANIMA work. Actually, we ought to be able to map *any* distributed address management method on top of the autonomic infrastructure that we're trying to create in ANIMA. 

We should also look to use HNCP in ANIMA, for sure (and the charter allows that!). But according to my intro statement, what ANIMA does would have to work across all architectures. We need to look more closely at this, and see whether 1) HNCP works as is , or 2) we can create an HNCP++ that can scale to SP/Ent, or 3) we need a different approach in ANIMA. As long as we do proper due diligence we should be able to settle on the best of those 3 options. 

So, personally I think we can work out a charter that resolves those conflicts, step by step. 

Michael

> -----Original Message-----
> From: Anima [mailto:[email-masked]] On Behalf Of Ted Lemon
> Sent: 02 October 2014 13:38
> To: The IESG
> Cc: [email-masked]
> Subject: [Anima] Ted Lemon's Block on charter-ietf-anima-00-09: (with
> BLOCK)
> 
> Ted Lemon has entered the following ballot position for
> charter-ietf-anima-00-09: Block
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> 
> The document, along with other ballot positions, can be found here:
> http://datatracker.ietf.org/doc/charter-ietf-anima/
> 
> 
> 
> ----------------------------------------------------------------------
> BLOCK:
> ----------------------------------------------------------------------
> 
> The following exchange between Mark and Brian illustrates what I want out
> of a BoF or External Review discussion:
> 
> Mark:
> 
> [...]
> 
> In any case, It's not hard to extrapolate from here that in a year's time or so,
> if we continue on the current trajectory, homenet will have come up with
> its own non-anima secure bootstrapping, and anima will have come up with
> its own non-homenet distributed IPv6 prefix configuration.
> 
> Brian:
> 
> Which we should try to coordinate, since I see no reason in theory why
> there can't be common underlying mechanisms between enterprise, carrier
> and SOHO. But I don't want to hear in 2 years time that homenet is stuck
> because anima hasn't met its milestones.
> 
> Ted:
> 
> Right now Homenet has a solution for the distributed configuration problem
> with a spec and at least one WIP implementation, and is working
> seriously on the mutual authentication problem.   There may be some
> synergy between what Homenet is trying to do and what ANIMA is trying to
> do.   If there is, it would be a big win to coordinate the two groups'
> activities.   It may also be that there is no synergy, and the efforts
> are really effectively independent.
> 
> Before the working group is chartered, I would like to see some clarity
> reached about this.   If there is synergy, I'd like there to be some
> clear agreement about how to move forward so that ANIMA can achieve its
> goals and Homenet can achieve its goals without either creating an interop
> problem or stalling.
> 
> 
> 
> 
> _______________________________________________
> Anima mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/anima

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 02 Oct 2014 14:15:15 +0100

On 02/10/14 13:49, Michael Behringer (mbehring) wrote:
> My personal goal is that what we do in ANIMA is fully compatible with
> and ideally used in homenet. It would feel wrong to me to have an
> infrastructure that doesn't work in a homenet.
> 
> The security bootstrap is a good example of what we can achieve, with
> reasonable effort.

FWIW, it is not clear to me that the reasonable requirements
for provisioning device security information (or bootstrapping
if we wanted to call it that) are the same.

In enterprise environments we see fewer larger vendors of devices.
In the home where we additionally have a large range of vendors
many of whom are tiny and leverage a lot of OSS and who could
perhaps not take part in the kind of provisioning infrastructure
that is quite reasonable for enterprises and their vendors.

I do think both want to end up in the same state, where devices
are authorised for connection to the network and where there is
some keying material usable for security, but I'd be surprised
if one approach to getting there worked the same way for both
homes and enterprises.

S.

---

From: "Leddy, John" <[email-masked]>
Date: Thu, 2 Oct 2014 13:50:13 +0000

My worry on this topic is that we are referring to ³the Home² and ³the
Enterprise².
It isn¹t that clear of a distinction.  This isn¹t just a simple L2 flat
home vs. a Fortune 1000 enterprise.

The home is getting more complex and includes work from home; IOT, home
security, hot spots, cloud services, policies, discovery etc.
Large numbers of SMB¹s look like more high end residential than they do
large enterprises.

It would be ideal to have a solution that spans the range of size and
complexity for both residential and enterprise.
Perhaps enabling features/capabilities where required.

Also, as far as IPV6 connectivity residential is probably ahead of
enterprises in adopting V6 centric architectures and services.
Residential doesn¹t have much of a choice, it just happens.

2cents, John

On 10/2/14, 9:15 AM, "Stephen Farrell" <[email-masked]> wrote:

>homenet mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/homenet
>

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 03 Oct 2014 10:35:46 +1300

> We should also look to use HNCP in ANIMA, for sure (and the charter allows that!). But according to my intro statement, what ANIMA does would have to work across all architectures. We need to look…

Exactly. We have a model for the discovery/negotiation protocol which is
certainly different from HNCP right now, but it is *not* written in stone.
However, today HNCP has a defined scope and has some limitations, so
if we converge, it would have to lose the H ("home") and gain some other
properties. I don't believe we can commit to that in the charter but of
course we can commit to investigate it.

   Brian

> .

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 03 Oct 2014 10:47:50 +1300

On 03/10/2014 04:12, Kathleen Moriarty wrote:
> On Thu, Oct 2, 2014 at 9:15 AM, Stephen Farrell <[email-masked]>
> wrote:
> 
>>
> This is where we would have overlap with SACM and I2NSF.  I've spoken in
> Ops and Dan R has helped to try to recruit some folks to help in SACM.  It
> would be good to not solve this in multiple places.  SACM and I2NSF are
> de-conflicting what they cover.  Provisioning and assessing security
> information is part of those efforts already, hence my questions on the
> charter as well.
> 
> There is a push in the vendor space for this type of automation and I'm all
> for it, let's just coordinate on it so we don't wind up with too many ways
> to do it.

Absolutely. It isn't surprising that Anima proponents are proposing
specific approaches to security (or anything else), but there is an
overriding sentence in the charter:

"Where suitable protocols, models or methods exist, they will be preferred over
creating new ones. "

Clerarly that calls for coordination and awareness.

   Brian

> I'd like to see this discusses more, but maybe it's not in this group?
> 
> Thanks,
> Kathleen
> 
>> S.
>>
>>
> 
> 
> 
> ------------------------------------------------------------------------
>

---

From: Dave Taht <[email-masked]>
Date: Thu, 2 Oct 2014 15:19:51 -0700

> My worry on this topic is that we are referring to ³the Home² and ³the

I have always approached homenet as a place to get standards that also work for
small business. Small business is the place (IMHO) where much of an
ipv6 revolution
could start to happen.

> home vs. a Fortune 1000 enterprise.

+1

> Large numbers of SMB¹s look like more high end residential than they do

+1

> Residential doesn¹t have much of a choice, it just happens.

Comcast's rollout has been quite impressive. Gfiber's also.
Others, not so much.

-- 
Dave Täht

https://www.bufferbloat.net/projects/make-wifi-fast

---

From: Sheng Jiang <[email-masked]>
Date: Fri, 3 Oct 2014 01:08:36 +0000

I am fully agree with Brian and Kathleen. It is well understood that the new WG would study on existing solutions and ongoing proposals to make sure it is necessary to create new mechanisms. Coordination and awareness is essential for the ANIMA group.

Best regards,

Sheng
________________________________________
From: homenet [[email-masked]] on behalf of Brian E Carpenter [[email-masked]]
Sent: 03 October 2014 5:47
To: Kathleen Moriarty
Cc: Michael Behringer (mbehring); The IESG; [email-masked]; Stephen Farrell; [email-masked]; Ted Lemon
Subject: Re: [homenet] [Anima] Ted Lemon's Block on charter-ietf-anima-00-09: (with BLOCK)

   Brian

---

From: "Michael Behringer (mbehring)" <[email-masked]>
Date: Fri, 3 Oct 2014 07:12:03 +0000

> From: homenet [mailto:[email-masked]] On Behalf Of Stephen
> Farrell
> Sent: 02 October 2014 15:15
> To: Michael Behringer (mbehring); Ted Lemon; The IESG
> Cc: [email-masked]; [email-masked]
> FWIW, it is not clear to me that the reasonable requirements for
> provisioning device security information (or bootstrapping if we wanted to
> call it that) are the same.
> 
> In the home where we additionally have a large range of vendors many of
> whom are tiny and leverage a lot of OSS and who could perhaps not take
> part in the kind of provisioning infrastructure that is quite reasonable for
> enterprises and their vendors.
> 
> I do think both want to end up in the same state, where devices are
> authorised for connection to the network and where there is some keying
> material usable for security, but I'd be surprised if one approach to getting
> there worked the same way for both homes and enterprises.

Good points, thanks Stephen. I don't think we have clear answers at this point, but this is the job of the ANIMA group (together with the groups that were mentioned) to figure out whether there should be a single approach, and if so, what it should be. 
 
Personally my starting point is "let's try whether a joint approach works", but clearly there is no guarantee. 

Michael

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 2 Oct 2014 11:12:48 -0400

Thanks,
Kathleen

-- 

Best regards,
Kathleen