Subject: [p2p-sip] Concepts draft: Open Issue #3: Enrollment as a Peer/Client Protocol operation?

From: philip_matthews at magma.ca (Philip Matthews)
Date: Thu, 7 Dec 2006 12:48:35 -0500

Open issue #3: In version -03 of the Concepts  draft, I added some  
text that stated
that Enrollment of peers and resources/users was an operation  
supported by the Peer and Client Protocols.
However, a couple of weeks ago, Brian Rosen and Henry Sinnreich  
suggested that
we not standardize the protocol for obtaining credentials, but simply  
specify the acceptable
format of a credential.

Proposed Resolution: The authors propose to adopt Brian and Henry's  
view of the world.
Thus we propose to remove enrollment of peers and resources/users as  
operations supported
by the Peer and Client protocols, and state that the method of  
obtaining credentials is
not being standardized for now.

Comments?

- Philip

---

From: spencer at mcsr-labs.org (Spencer Dawkins)
Date: Fri, 8 Dec 2006 07:31:10 -0600

Hi, Philip,

Sort-of agree. Agree that we need to specify the acceptable format of a 
credential.

My understanding of this proposed resolution is basically

- we don't HAVE to specify the method of obtaining credentials now, and

- if we DO standardize the method of obtaining credentials, it's not likely 
to be part of the peer or client protocols, so would be done separately in 
any event.

Do you guys agree? If so, I'd like this understanding to be included in the 
document.

Thanks,

Spencer

> _______________________________________________
> p2p-sip mailing list
> p2p-sip at cs.columbia.edu
> https://lists.cs.columbia.edu/cucslists/listinfo/p2p-sip
>

---

From: bryan at ethernot.org (David A. Bryan)
Date: Fri, 8 Dec 2006 10:45:19 -0500

I think the idea was just to reduce the work, and not take on
something that could be much broader than P2PSIP only use. Both of
Spencer's statements below are true, and I'll add one more:

- if we DO standardize, it could be this is useful to others outside
P2PSIP and might even be some work we push into another WG.

David

---

From: philip_matthews at magma.ca (Philip Matthews)
Date: Fri, 8 Dec 2006 11:29:11 -0500

> Do you guys agree? If so, I'd like this understanding to be  

Personally, I don't have a strong opinion on this, and I don't think  
any of my
co-authors do either. We were simply influenced by the fact that (a)  
some people
in the group DO seem to have a strong opinion, and (b) the proposed  
resolution
reduces the scope of the initial work of the group, which focuses the  
group's efforts
more tightly.

I mostly agree with what you said above. However, is it really true  
that we would
not ever want to add this capability to the peer or client protocols?

- Philip

---

From: spencer at mcsr-labs.org (Spencer Dawkins)
Date: Fri, 8 Dec 2006 10:49:54 -0600

Hi, Philip,

Reply inline below...

Thanks!

Spencer

From: "Philip Matthews" <philip_matthews at magma.ca>

> Personally, I don't have a strong opinion on this, and I don't think  any 
> of my
> co-authors do either. We were simply influenced by the fact that (a)  some 
> people
> I mostly agree with what you said above. However, is it really true  that 
> we would

I liked David's additional statement, which was

"- if we DO standardize, it could be this is useful to others outside
   P2PSIP and might even be some work we push into another WG."

so, taking David's comment and your comment above into account, my list ends 
up as

- if we DO standardize the method of obtaining credentials, it may not
  be part of the peer and/or client protocol,

- and might developed in another working group, if the resulting
  standardized method would be useful outside P2PSIP.

Does this work for people?

Thanks,

Spencer

---

From: jani.hautakorpi at ericsson.com (Jani Hautakorpi (JO/LMF))
Date: Mon, 11 Dec 2006 15:28:04 +0200

Hi all,

> Does this work for people?

This makes sense and sounds good at least to me.

-- 
Jani

---

From: br at brianrosen.net (Brian Rosen)
Date: Fri, 15 Dec 2006 09:43:05 -0500

I don't think we need to standardize the method of obtaining credentials.

I believe we agreed we need to standardize at least one mandatory to
implement FORM of credentials, so we could use credentials obtained by an
unspecified mechanism

Brian

> -----Original Message-----
> From: p2p-sip-bounces at cs.columbia.edu [mailto:p2p-sip-
> bounces at cs.columbia.edu] On Behalf Of Jani Hautakorpi (JO/LMF)
> Sent: Monday, December 11, 2006 8:28 AM
> To: Spencer Dawkins
> Cc: P2P-SIP
> Subject: Re: [p2p-sip] Concepts draft: Open Issue #3: Enrollment as
> aPeer/Client Protocol operation?
> 
> Hi all,
> 
> Spencer Dawkins wrote:

---

From: hannes.tschofenig at siemens.com (Tschofenig, Hannes)
Date: Fri, 15 Dec 2006 16:14:55 +0100

Hi Brian, 

I personally think we need a way to obtain credentials -- not only for P2P SIP. Obviously, this would not be done in the P2P SIP working group. Hence, the approach suggested by you seems to be reasonable. 

Previous attemps to get credential enrollment work started in the IETF failed (e.g., EasyCert BoF). 
I contribute my thoughts to a working group called ENROLL. Here is an example of the type of documents I wrote: http://www.tschofenig.com/drafts/draft-tschofenig-enroll-next-steps-00.txt. The group also failed. 

Ciao
Hannes

-----Urspr?ngliche Nachricht-----
Von: p2p-sip-bounces at cs.columbia.edu [mailto:p2p-sip-bounces at cs.columbia.edu] Im Auftrag von Brian Rosen
Gesendet: Freitag, 15. Dezember 2006 15:43
An: 'Jani Hautakorpi (JO/LMF)'; 'Spencer Dawkins'
Cc: 'P2P-SIP'
Betreff: Re: [p2p-sip] Concepts draft: Open Issue #3: Enrollmentas aPeer/Client Protocol operation?

Brian

---

From: hsinnrei at adobe.com (Henry Sinnreich)
Date: Fri, 15 Dec 2006 08:59:46 -0800

Hannes,

> Previous attempts to get credential enrollment work started in the IETF failed

I believe attempts to standardize enrollment will continue to fail, since just as any other applications it is subject to competition and it should stay this way.

Enrollment has nothing to do with interoperability over the Internet and is better discussed at trade shows or in industry consortiums IMHO.

Thanks, Henry

-----Original Message-----
From: p2p-sip-bounces at cs.columbia.edu [mailto:p2p-sip-bounces at cs.columbia.edu] On Behalf Of Tschofenig, Hannes
Sent: Friday, December 15, 2006 9:15 AM
To: Brian Rosen; Jani Hautakorpi (JO/LMF); Spencer Dawkins
Cc: P2P-SIP
Subject: Re: [p2p-sip] Concepts draft: Open Issue #3:Enrollmentas aPeer/Client Protocol operation?

Hi Brian, 

Ciao
Hannes

-----Urspr?ngliche Nachricht-----
Von: p2p-sip-bounces at cs.columbia.edu [mailto:p2p-sip-bounces at cs.columbia.edu] Im Auftrag von Brian Rosen
Gesendet: Freitag, 15. Dezember 2006 15:43
An: 'Jani Hautakorpi (JO/LMF)'; 'Spencer Dawkins'
Cc: 'P2P-SIP'
Betreff: Re: [p2p-sip] Concepts draft: Open Issue #3: Enrollmentas aPeer/Client Protocol operation?

Brian

---

From: hannes.tschofenig at siemens.com (Tschofenig, Hannes)
Date: Fri, 15 Dec 2006 22:36:10 +0100

Hi Henry, 

Interesting view.

I am sure we have different things in mind when we use the term enrollment. 

Let me give you a specific example: I have a long-term password and I would like to use different protocols that use public key based techniques to secure the protocol operation. 

Now imagine that there is a protocol that allows me to perform a password-based authentication exchange once (which might require more roundtrips to be secure) and then a short-lived public/private key pair is created that can later be used for usage with other protocols. 

We already have some protocols. In the SIP area we have SIP CERT. In the 3GPP we have the Generic Bootstrapping Architecture. Kerberos could be seen as one such protocol. These protocols have different properties and their advantages and disadvantages. 

Does this sound like a reasonable thing?  

Ciao
Hannes
 
-----Urspr?ngliche Nachricht-----
Von: Henry Sinnreich [mailto:hsinnrei at adobe.com] 
Gesendet: Freitag, 15. Dezember 2006 18:00
An: Tschofenig, Hannes; Brian Rosen; Jani Hautakorpi (JO/LMF); Spencer Dawkins
Cc: P2P-SIP
Betreff: RE: [p2p-sip] Concepts draft: Open Issue #3:Enrollmentas aPeer/Client Protocol operation?

Hannes,

Thanks, Henry

-----Original Message-----
From: p2p-sip-bounces at cs.columbia.edu [mailto:p2p-sip-bounces at cs.columbia.edu] On Behalf Of Tschofenig, Hannes
Sent: Friday, December 15, 2006 9:15 AM
To: Brian Rosen; Jani Hautakorpi (JO/LMF); Spencer Dawkins
Cc: P2P-SIP
Subject: Re: [p2p-sip] Concepts draft: Open Issue #3:Enrollmentas aPeer/Client Protocol operation?

Hi Brian, 

Ciao
Hannes

-----Urspr?ngliche Nachricht-----
Von: p2p-sip-bounces at cs.columbia.edu [mailto:p2p-sip-bounces at cs.columbia.edu] Im Auftrag von Brian Rosen
Gesendet: Freitag, 15. Dezember 2006 15:43
An: 'Jani Hautakorpi (JO/LMF)'; 'Spencer Dawkins'
Cc: 'P2P-SIP'
Betreff: Re: [p2p-sip] Concepts draft: Open Issue #3: Enrollmentas aPeer/Client Protocol operation?

Brian

---

From: philip_matthews at magma.ca (Philip Matthews)
Date: Mon, 18 Dec 2006 10:53:56 -0500

Hannes:

Despite your frustration at trying to get the IETF to standardize a  
method of obtaining credentials, it sounds like you still support the  
idea that standardizing this is out-of-scope for P2PSIP (at least for  
now).
Am I correct?

- Philip

On 15-Dec-06, at 10:14 , Tschofenig, Hannes wrote:

> Hi Brian,
>
> I personally think we need a way to obtain credentials -- not only  
> for P2P SIP. Obviously, this would not be done in the P2P SIP  
> working group. Hence, the approach suggested by you seems to be  
> reasonable.
>
> I contribute my thoughts to a working group called ENROLL. Here is  
> an example of the type of documents I wrote: http:// 
> www.tschofenig.com/drafts/draft-tschofenig-enroll-next- 
> steps-00.txt. The group also failed.
>
> Ciao
> Hannes
>
> Von: p2p-sip-bounces at cs.columbia.edu [mailto:p2p-sip- 
> bounces at cs.columbia.edu] Im Auftrag von Brian Rosen
>>> so, taking David's comment and your comment above into account,  
>>> my list
>> ends
>>> up as
>>>