Subject: [sacm] Proto-consensus - Removal of references to TNC's IF-IMV and IF-IMC specifications.

From: "Schmidt, Charles M." <[email-masked]>
Date: Wed, 18 May 2016 18:21:25 +0000

Hello all,

Between the discussions at IETF 95 and the virtual interim yesterday, there
appears to be "in room" consensus on a few proposed updates and expansions
to SWID M&A. As no IETF consensus is complete without mailing-list
consensus, I'm sending out messages on each point of proto-consensus.  

Item 1: Remove references to TNC's IF-IMV and IF-IMC specifications
The current SWID M&A specification references TNC's IF-IMV and IF-IMC
specifications. While both of these specification have been approved by the
Trusted Computing Group board for transfer to the IETF, we are going to hold
off on that delivery since these specifications 1) are long, 2) somewhat
peripheral to the vulnerability assessment scenario on which we are
currently focusing, and 3) there has been a major recent document dump and
we don't want people more overwhelmed than they are. In the meantime, since
these references are not critical to the specification, it was felt that we
should just remove them to avoid normative references to external
specifications as much as possible.

Both IF-IMV and IF-IMC are referenced with regard to interface functions
that are defined in those specifications. The purpose of naming those
specific interface functions is to describe how the identity of components
on the endpoint and the policy server are captured. This component identity
information is already conveyed between the communicants over the PB-TNC
messages over which SWID M&A communicates. In effect the text will change
from "collect the component identity as conveyed in the PB-TNC message by
using IF-IMC/IMV function XYZ to get the PB message information" to "collect
the component identity as conveyed in the PB-TNC message". The net effect is
the same - we just don't recommend a specific, named interface function.

Any concerns about this or can we call this consensus?

Charles

---

From: Jerome Athias <[email-masked]>
Date: Thu, 19 May 2016 17:18:45 +0300

KISS
(Keep It Simple) so yes i'm ok with it

On Wednesday, 18 May 2016, Schmidt, Charles M. <[email-masked]> wrote:

> Hello all,
>
> Between the discussions at IETF 95 and the virtual interim yesterday,
> there appears to be "in room" consensus on a few proposed updates and
> expansions to SWID M&A. As no IETF consensus is complete without
> mailing-list consensus, I'm sending out messages on each point of
> proto-consensus.
>
> specifications. While both of these specification have been approved by
> the Trusted Computing Group board for transfer to the IETF, we are going
> to hold off on that delivery since these specifications 1) are long, 2)
> somewhat peripheral to the vulnerability assessment scenario on which we
> are currently focusing, and 3) there has been a major recent document dump
> and we don't want people more overwhelmed than they are. In the meantime,
> since these references are not critical to the specification, it was felt
> that we should just remove them to avoid normative references to external
> specific interface functions is to describe how the identity of
> components on the endpoint and the policy server are captured. This
> component identity information is already conveyed between the
> communicants over the PB-TNC messages over which SWID M&A communicates.
> In effect the text will change from "collect the component identity as
> conveyed in the PB-TNC message by using IF-IMC/IMV function XYZ to get
> the PB message information" to "collect the component identity as
> conveyed in the PB-TNC message". The net effect is the same - we just
> don't recommend a specific, named interface function.
>

---

From: Tony Rutkowski <[email-masked]>
Date: Thu, 19 May 2016 14:24:12 -0400

Charles,

I'm not sure what "consensus with this" is.
I think this is important work, but it is very
immature, unrealistic, and of dubious value as
a result of having ensued for years in a very
small, insular environment without much real
discussion or engagement by the outside
world.

So with that said, it deserves continuation,
along with some dedication to deal with the
identified flaws, alternatives, and outreach.
There is a definite need for the generic capability.

--tony

ps. you can also kick it over to OASIS CTI which
has emerged as one of the most active and
effective groups in this sector seen in a long time.

On 2016-05-18 2:21 PM, Schmidt, Charles M. wrote:
> Proto-consensus - Removal of references to TNC's IF-IMV and IF-IMC 
> specifications.
>
> Hello all,
>
> mailing-list consensus,I'm sending out messages on each point of 
> proto-consensus.
>
> specifications.While both of these specification have been approved by 
> the Trusted Computing Group board for transfer to the IETF,we are 
> going to hold off on that delivery since these specifications 
> 1)arelong, 2)somewhatperipheral to the vulnerability assessment 
> scenario on which we are currently focusing, and 3) there has been a 
> major recent document dump and we don't want people more overwhelmed 
> than they are.In the meantime, since these references are not critical 
> to the specification, it was felt that we should just remove them to 
> avoid normative references toexternalspecifications as much as possible.
>
> Both IF-IMV and IF-IMC are referenced with regard 
> tointerfacefunctionsthat are defined in those specifications. The 
> purpose of naming those specificinterfacefunctionsis todescribe howthe 
> identity of components on the endpoint and the policy server 
> arecaptured.Thiscomponentidentityinformationis alreadyconveyed between 
> the communicants overthe PB-TNC messages over which SWID M&A 
> communicates.In effect the text will change from "collect the 
> component identity as conveyed in the PB-TNC message by 
> usingIF-IMC/IMVfunction XYZ to get the PB messageinformation" to 
> "collect the component identity as conveyed in the PB-TNC message".The 
> net effect is the same - we just don'trecommend a specific, 
> namedinterface function.
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm

-- 

________________________________ **

*Anthony Michael Rutkowski*

EVP, Industry Standards & Regulatory Affairs

[email-masked] <mailto:[email-masked]>

+1 703 999 8270 <tel:+1%20703%20999%208270>

________________________________ **

*Yaana Technologies LLC *

542 Gibraltar Drive

Milpitas CA 95035 USA

---

From: "Schmidt, Charles M." <[email-masked]>
Date: Thu, 19 May 2016 19:04:16 +0000

Hi Tony,

Just so I am clear: I believe your objection is with the SWID M&A for PA-TNC
specification itself and its current focus on SWID tags, as voiced in
earlier messages. You are not objecting to the specific issue described in
this email of removing references to TNC's IF-IMC and IF-IMV. Am I correct?
I want to make sure I respond to your actual concern.

Charles

> -----Original Message-----
> From: Tony Rutkowski [mailto:[email-masked]]
> Sent: Thursday, May 19, 2016 1:24 PM
> To: Schmidt, Charles M. <[email-masked]>; [email-masked]
> Subject: Re: [sacm] Proto-consensus - Removal of references to TNC's IF-
> IMV and IF-IMC specifications.
> 
> Charles,
> 
> expansions to SWID M&A. As no IETF consensus is complete without mailing-
> list consensus, I'm sending out messages on each point of proto-consensus.
> 
> 
> 
> 	The current SWID M&A specification references TNC's IF-IMV and IF-
> IMC specifications. While both of these specification have been approved
by
> the Trusted Computing Group board for transfer to the IETF, we are going
to
> hold off on that delivery since these specifications 1) are long, 2)
somewhat
> currently focusing, and 3) there has been a major recent document dump
> and we don't want people more overwhelmed than they are. In the
> meantime, since these references are not critical to the specification, it
was
> felt that we should just remove them to avoid normative references to
> external specifications as much as possible.
> 
> 	Both IF-IMV and IF-IMC are referenced with regard to interface
> functions that are defined in those specifications. The purpose of naming
> those specific interface functions is to describe how the identity of
> communicants over the PB-TNC messages over which SWID M&A
> communicates. In effect the text will change from "collect the component
> identity as conveyed in the PB-TNC message by using IF-IMC/IMV function
> XYZ to get the PB message information" to "collect the component identity
as
> conveyed in the PB-TNC message". The net effect is the same - we just
don't
> recommend a specific, named interface function.
> 
> 	[email-masked] <mailto:[email-masked]>
> ________________________________
> 
> Anthony Michael Rutkowski
> 
> <mailto:[email-masked]> [email-masked]
> <mailto:[email-masked]>
> 
> ________________________________
> 
> Yaana Technologies LLC
> 
> 542 Gibraltar Drive
> 
> Milpitas CA 95035 USA

---

From: Tony Rutkowski <[email-masked]>
Date: Thu, 19 May 2016 16:16:37 -0400

You are correct.

-- 

542 Gibraltar Drive

Milpitas CA 95035 USA

---

From: Adam Montville <[email-masked]>
Date: Thu, 19 May 2016 19:27:45 -0500

+1

> On May 19, 2016, at 9:18 AM, Jerome Athias <[email-masked]> wrote:
> 
> KISS
> On Wednesday, 18 May 2016, Schmidt, Charles M. <[email-masked] <mailto:[email-masked]>> wrote:
> Hello all,
> 
> Between the discussions at IETF 95 and the virtual interim yesterday, there appears to be "in room" consensus on a few proposed updates and expansions to SWID M&A. As no IETF consensus is complete without mailing-list consensus, I'm sending out messages on each point of proto-consensus.
> 
> 
> The current SWID M&A specification references TNC's IF-IMV and IF-IMC specifications. While both of these specification have been approved by the Trusted Computing Group board for transfer to the IETF, we are going to hold off on that delivery since these specifications 1) are long, 2) somewhat peripheral to the vulnerability assessment scenario on which we are currently focusing, and 3) there has been a major recent document dump and we don't want people more overwhelmed than they are. In the meantime, since these references are not critical to the specification, it was felt that we should just remove them to avoid normative references to external specifications as much as possible.
> 
> Both IF-IMV and IF-IMC are referenced with regard to interface functions that are defined in those specifications. The purpose of naming those specific interface functions is to describe how the identity of components on the endpoint and the policy server are captured. This component identity information is already conveyed between the communicants over the PB-TNC messages over which SWID M&A communicates. In effect the text will change from "collect the component identity as conveyed in the PB-TNC message by using IF-IMC/IMV function XYZ to get the PB message information" to "collect the component identity as conveyed in the PB-TNC message". The net effect is the same - we just don't recommend a specific, named interface function.
>

---

From: Adam Montville <[email-masked]>
Date: Thu, 19 May 2016 19:30:29 -0500

Hi Tony,

We appreciate your objection to SWID M&A, and invite you to bring your specific technical concerns to the working group for technical discussion.

Kind regards,

Adam

> On May 19, 2016, at 3:16 PM, Tony Rutkowski <[email-masked]> wrote:
> 
> You are correct.
> 
>>> From: Tony Rutkowski [mailto:[email-masked] <mailto:[email-masked]>]
>>> To: Schmidt, Charles M. <[email-masked]> <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>
>>> 	[email-masked] <mailto:[email-masked]> <mailto:[email-masked]> <mailto:[email-masked]>
>>> 	https://www.ietf.org/mailman/listinfo/sacm <https://www.ietf.org/mailman/listinfo/sacm>
>>> 
>>> 
>>> --
>>> 
>>> 
>>> <mailto:[email-masked]> <mailto:[email-masked]> [email-masked] <mailto:[email-masked]>
>>> <mailto:[email-masked]> <mailto:[email-masked]>
>>> 
>>> +1 703 999 8270 <tel:+1%20703%20999%208270> <tel:+1%20703%20999%208270>
>>> 
>  <mailto:[email-masked]>[email-masked] <mailto:[email-masked]>

---

From: "Schmidt, Charles M." <[email-masked]>
Date: Wed, 25 May 2016 14:42:12 +0000

Hi all,

So far there has been one voice in support of removing the IF-IMV/IF-IMC
references (in addition to the in-room consensus at IETF 95) and no
opposition.  Barring outcry, I shall take that as consensus and move forward
with changes.

Charles

> From: sacm [mailto:[email-masked]] On Behalf Of Schmidt, Charles
> M.
> Sent: Thursday, May 19, 2016 2:04 PM
> To: [email-masked]; [email-masked]
> mailing-

---

From: [email-masked]
Date: Wed, 25 May 2016 11:03:33 -0400

Hi Charles,

Are you saying you would remove this because one person requested and no one has objected yet?  I just want to make sure I'm clear on what you are asking.  

Thanks,
Kathleen 

Sent from my iPhone

> On May 25, 2016, at 10:42 AM, Schmidt, Charles M. <[email-masked]> wrote:
> 
> Hi all,
>

---

From: "Schmidt, Charles M." <[email-masked]>
Date: Wed, 25 May 2016 15:21:46 +0000

Hi Kathleen,

This was originally suggested by the authors of the SWID M&A specification
back in March for the reasons described below. The proposal was presented at
IETF 95 and the consensus in the room was to remove. The consensus was
confirmed at the Virtual Interim in June. I then brought it to the mailing
list to confirm consensus on-list. There was one response to the mailing
list regarding this proposal and it was in support. 

In short, several people have spoken in support of this change on multiple
occasions over a period of 3 months. My message was to note for the record
that I am hearing consensus and I'm going to go ahead and make the requested
edits, so if anyone has any last-second concerns they need to speak up.

Charles

> From: [email-masked]
> [mailto:[email-masked]]
> Sent: Wednesday, May 25, 2016 10:04 AM
> To: Schmidt, Charles M. <[email-masked]>
> Cc: [email-masked]
> Are you saying you would remove this because one person requested and
> no one has objected yet?  I just want to make sure I'm clear on what you
are
> asking.
> >>> meantime, since these references are not critical to the
specification,
> > it

---

From: "Schmidt, Charles M." <[email-masked]>
Date: Wed, 25 May 2016 15:25:55 +0000

Correction: I initially said there was one post in support of the change on
the list. This was incorrect - there were 2. I apologize for the error.

Charles

> From: Schmidt, Charles M.
> Sent: Wednesday, May 25, 2016 10:22 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: RE: [sacm] Proto-consensus - Removal of references to TNC's
IF-IMV
> and IF-IMC specifications.
> 
> Hi Kathleen,
> 
> > >> earlier messages. You are not objecting to the specific issue
described
> in