Subject: RE: [RPSEC] Chrater Question

From: "Dennis Beard" <[email-masked]>
Date: Wed, 13 Nov 2002 09:37:45 -0500

Thank you Russ for clarifying the three WG/Charter positions that we have in
front of us going into Atlanta.  To keep focused, those baseline positions
are:

1.  We should have one generic threats and one generic requirements draft.
2.  We should also have protocol specific recommendations (or requirements?)
drafts, as we can get them done.
3.  We shouldn't have protocol specific requirements drafts, but only one
generic requirements draft.

E-mail chains are convenient, but they tend to take us off track.  As
co-chairs, the best service you can provide is to nail down the charter
principals and ensure that any related drafts support the principal goals.
Same way with the e-mail threads - help us stay focused.  

Regards,

Dennis

-----Original Message-----
From: Russ White [mailto:[email-masked]] 
Sent: Wednesday, November 13, 2002 7:54 AM
To: Michel Py
Cc: [email-masked]
Subject: RE: [RPSEC] Chrater Question

> Which leads me to what I would like this WG to do:
> 1. Assess what is wrong with my protocol's security.
> 2. Evaluate what I could or should do to enhance it.
> 3. Produce a recommendations doc that includes both generic security 
> issues and the ones that are specific to my protocol.
> 
> Note that this should be, IMHO, a continuing process for new protocols 
> that still are work in progress, as there is flexibility in releasing 
> interim drafts.

Thanks, Michael, for the feedback. I think we probably need to have some
further discussion on this: so far, we have:

-- We should have one generic threats and one generic requirements draft.
-- We should also have protocol specific recommendations (or
requirements?) drafts, as we can get them done.
-- We shouldn't have protocol specific requirements drafts, but only one
generic requirements draft.

Any other thoughts/issues/etc.? It's be nice to be able to wrap this
discussion up in Atlanta, with the AD's present, so we can understand where
we are going....

:-)

Russ

__________________________________
[email-masked] CCIE <>< Grace Alone

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: "Michel Py" <[email-masked]>
Date: Wed, 13 Nov 2002 08:22:53 -0800

Russ,

> Russ White wrote:
> recommendations (or requirements?) drafts

A few more thoughts:

- Mixing protocols in a "generic" requirements draft that would
necessarily be bigger than a specific one is a sure way to reduce its
reading success. In other words, if I'm a protocol developer that works
on a link-state protocol, I could care less about security requirements
that are unique to distance vector protocols and I don't like to have to
find where the part that is relevant to me is in that huge doc.

- As I mentioned before, security is important, but it's only 10 percent
of the compromise that makes a good routing protocol. An ultra-secure
protocol that can't do anything but be secure is of no use. Don't ask
for miracles unless you know how to make them happen.

- In the recommendations vs. requirements dept, the one thing you don't
want to do is to dig yourself into the same kind of hole that multi6
currently is in (some requirements contradict some others). In the long
run, the success of the work produced by this WG will be judged not by
how consensual or good the requirement docs are, but how much of them
will be included in the actual protocols.

Michel.

---

From: [email-masked]
Date: Wed, 13 Nov 2002 11:47:23 -0500 (EST)

>In other words, if I'm a protocol developer that works
>that are unique to distance vector protocols

It would actually be a very very interesting result to discover that
there were security requirements specific to distance vector protocols
that did not apply to link state protocols.    

>In the long

Or just noted which requirements were judged impossible to meet and why.
(Presuming "included in" means "met by")  Nice to give people hints that
they're putting themselves at risk.

--Sandy

---

From: "Tom Petch" <[email-masked]>
Date: Wed, 13 Nov 2002 17:48:15 -0000

I believe that to try and separate IGP and EGP, or OSPF and RIP, at
this stage is cart before horse, vague and nebulous.

A good threats document (perhaps culled from the legion threats
documents that security experts produce these days) would give us a
much clearer view of how much EGP and IGP, OSPF and RIP, have in
common in terms of threats and so guide how much we have to
differentiate subsequent
documents into various sub-categories.

Tom Petch
[email-masked]

-----Original Message-----
From: Iljitsch van Beijnum <[email-masked]>
To: Russ White <[email-masked]>
Cc: Michel Py <[email-masked]>; [email-masked]
<[email-masked]>
Date: 13 November 2002 13:46
Subject: RE: [RPSEC] Chrater Question

>On Wed, 13 Nov 2002, Russ White wrote:
>
>> -- We shouldn't have protocol specific requirements drafts, but
>> only one generic requirements draft.
>
>> Any other thoughts/issues/etc.? It's be nice to be able to wrap
>> this discussion up in Atlanta, with the AD's present, so we can
>> understand where we are going....
>
>I think it would be useful to separate IGP and EGP issues. Once again
>I'll risk getting ahead of things by naming instances of real-world
>routing protocols, but bear with me as I think it will make things
>clearer.
>
>IGPs such as OSPF or IS-IS (do we even want to look at RIP???)
yes!

---

From: "Dennis Beard" <[email-masked]>
Date: Wed, 13 Nov 2002 14:15:10 -0500

Thank you Sandy for bring this error to my attention.  "Principals" should
have been spelled "principles" as in adhering to the major points and
deliverables spelled out in the WG charter and restated by Russ.  

Regards,

Dennis

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Wednesday, November 13, 2002 10:13 AM
To: Beard, Dennis [CAR:0S03:EXCH]
Cc: [email-masked]
Subject: RE: [RPSEC] Chrater Question

>the best service you can provide is to nail down the charter principals 
>and ensure that any related drafts support the principal goals.

So you mean "principals" as in the primary people involved and "principal
goals" as in the chief and most important goals or do you mean "/principle
goals", as in the fundamentals and assumptions.

--Sandy