Subject: Re: [Ieprep] draft-ietf-ieprep-requirements-00.txt

From: Fred Baker <[email-masked]>
Date: Wed, 10 Jul 2002 18:20:21 -0400

At 04:47 PM 7/10/2002 -0500, Beard, Cory wrote:
>So what is the difference between a glittering generality and a high
>level requirement?

Let me answer with an example.

If you tell me "must be able to authenticate 100,000 users at 1000 
authentications per second with essentially zero probability of a false 
authentication", I can propose a number of potential implementations, and I 
can tell you whether I achieved that. If you tell me "must 
cryptographically authenticate using the AES...", you have specified a 
solution, and I can't propose an alternative such as one-time passwords. If 
you tell me "must be able to authenticate folks", I dunno, is it OK if I 
call their wives and ask them to come look at the guy and vouch that he's 
their respective husband?

I need to know what problem needs to be solved, and I need to be able to 
tell whether I have solved it. The statement needs to be sufficiently 
open-ended to allow creativity in solving it, and needs to be realistic, 
but it needs to be specific enough so that if I produce a solution that 
solves the statement, it will in fact make you happy with the resulting system.

I'm looking for a set of statements that tell me
(a) what problem needs to be solved
(b) enough discussion so that I can directly understand the alternatives 
and trade-offs
(c) no early binding to a solution
(d) what, if I don't achieve it, makes a proposed solution untenable

_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep