Subject: SACRED meeting minutes for 53rd IETF

From: Alfred Arsenault <[email-masked]>
Date: Wed, 20 Mar 2002 16:43:29 -0500

> Folks,
> 
> 	Below are the draft minutes from Monday's SACRED WG meeting.  Any
> foul-ups in these are mine; please let me know if there are any omissions,
> additions or mis-attributions to be corrected.  If there are no
> comments/objections, these will stand as the meeting minutes.
> 
> 	Thanks,
> 
> 			Al Arsenault
> 
> _____________________________________________________________________
> 
> Meeting minutes - SACRED Working Group meeting, 53rd IETF, Minneapolis, MN
> Meeting Chair:  Magnus Nystrom, RSA Security.  (Co-chair Stephen Farrell
> missed the meeting for personal reasons.)
> Magnus started the meeting by going over the agenda, which was as follows:
> Introduction, agenda walkthrough, WG status - Magnus Nystrom
> Framework draft - Dale Gustafson
> Protocol draft - Merlin Hughes
> Updated milestones - Magnus Nystrom
> All Other Business
> Since there were no objections to the proposed agenda, Magnus started with
> the WG status.  He began by reviewing the objectives of this working
> group, and the objectives of this session.  He then summarized the WG
> status as follows:
> There are 2 I-D's: the Framework ID; the current version is version -03,
> which was submitted in February; and the protocol I-D.  The current
> version of that is version -02, which was also submitted in February.
> Dale Gustafson then spoke on the Framework draft, which is co-authored by
> himself, Mike Just, and Magnus Nystrom. Dale started by reviewing the
> SACRED Network architecture.  He noted that the purpose of the
> architecture is to allow credentials to be uploaded or downloaded into a
> variety of devices. The WG's job is to define a protocol between end-user
> device and credential server.  Management/administration of credential
> server is beyond the scope of this WG's charter.
> Dale then summarized comments from the SACRED mailing list on previous
> drafts of the framework document. There were lots of comments in the
> August - December timeframe, so the authors went through list archives for
> comments that apply to the framework draft. They also harmonized the
> framework draft with the latest SACRED protocol draft.  
> Draft -03 was posted to the mailing list March 4th and again on March 6th
> (it was the same version). The most important change from draft -02 is the
> reordering of several document sections.  The authors are waiting for
> comments from WG members to be posted on the mailing list.
> Issues remaining on the Framework document include:
> -	ID/fingerprint: the framework document was updated to use
> ID/fingerprint for all conditional operations (per recent list
> discussion), but the latest protocol draft uses the "last update" method.
> Should the authors change the framework document to match the protocol
> document, or leave it as is?
> -	Security considerations section: the authors would like to ask
> mailing list members to review this section, and determine whether or not
> it is complete. 
> Dale then summarized plans for draft-04. The authors expect minimal or no
> changes for this document going forward. They will put out a revised draft
> soon, and expect WG last call in May 2002.
> Merlin Hughes then summarized the Protocol document, written by Stephen
> Farrell.  Version -02 is current.  Merlin summarized the changes from the
> -01 draft. He then identified the issues that are still open.  These
> include: 
> -	the "multiple substrates" issue; 
> -	the SASL authorization identity issue; 
> -	should we apply for a port number; 
> -	should the DTD or the schema be considered normative; 
> -	fix the DTD extensibility scheme; 
> -	should we specify a max value where "unbounded" is in the schema.
> Multiple substrates issue:  this relates to how the protocol should be
> defined, and whether it should be bound tightly to a single lower-layer
> protocol stack, or left open for implementation on top of a variety of
> protocol stacks/transport mechanisms.  There was lots of discussion of
> this issue on the list, and at the Salt Lake City IETF meeting, but no
> clear consensus.  Currently, the document defines the bindings for the
> SACRED protocol to run over BEEP.  Since there was no clear consensus to
> change this, it was decided to leave the protocol the way it is.  Anyone
> who wants to modify the protocol to run over some other transport service
> will have to do the work himself.  Magnus Nystrom asked whether the WG
> felt that the protocol document should be left the way it is, with the
> PDUs, bindings, and protocol spec all in the same document; or would it be
> better to split the protocol into two documents, with the PDUs and
> bindings in a separate document, to make later implementation of the
> protocol on another transport easier.  The WG consensus was to leave it as
> a single document.
> SASL authorization identity issue: the document does not address this at
> this moment. Bob Morgan suggested that this be modified to explicitly
> state that this is undefined.  That is now legal under the SASL document.
> There was consensus to do this; Bob was asked to provide words for the
> document.
> Applying for a port number: There was consensus that the WG needs to apply
> for a port number for its protocol.  It was also pointed out that it might
> be appropriate to register a service name and/or a URI, as SASL requires
> that all protocols making use of it have a registered GSSAPI service name.
> It was agreed that we ought to register a service name.
> DTD or schema being normative: The WG seemed to favor having the schema be
> normative, and drop the DTD.
> DTD Extensibility scheme:  Stephen has agreed to fix this in the next
> draft; there was no further discussion.
> Specifying a max value:  The consensus of the group was to leave this as
> "unbounded".
> Merlin stated that Stephen's plan is as follows: once the meeting minutes
> from this meeting are published, a summary of issue resolutions will be
> sent to the list.  Then, Stephen will wait a week, and publish the -03
> protocol draft.  He hopes for WG last call on -03.  If all goes well,
> that'll be in May.
> Magnus then proposed a suggested new WG schedule.  For the framework
> document, he proposed to have the -04 I-D in April; take that to last call
> in May, and submit the Framework document to IESG in August for
> publication as an Informational RFC.
> For the Protocol document, he proposed  taking the Protocol I-D to WG last
> call in June.  (This assumes that there will actually be a couple more
> iterations of the document, to address last-minute comments.) The Protocol
> will be submitted to IESG in September for publication as a
> Standards-track RFC.
> Magnus noted that the Protocol document has a dependency on SASL-SRP
> draft, so it can't actually be published as an RFC until after that
> document is done. Magnus asked if anyone had any insights into the
> progression of the SASL-SRP draft.  Lawrence Greenfield said that the last
> he knew, there were no outstanding issues on that draft, and he has no
> real idea what's holding it up.  Thus, it's possible that the block from
> SASL-SRP will soon be removed.
> Given all of that, Bob Morgan suggested that there don't seem to be three
> months' of protocol issues left to be resolved; maybe the work will
> actually progress faster than the proposed schedule.  Magnus said that
> that would be good; but it's probably better to set a schedule and beat it
> than to set a more aggressive schedule and slip.
> Bob Morgan noted that there might be IPR concerns around SRP that could
> hold this work up.  Jeff Schiller said that the IPR situation around SRP
> is "a mess".  IAB is now looking at ways to avoid SRP, EKE, and similar
> technologies that could be covered by patents and may hold up work.
> Dave Jablon took that opportunity to stand up and give a quick
> presentation on draft-jablon-speke-00.txt.  This individual I-D covers,
> among other things, SPEKE.  SPEKE is a competing authenticating technology
> patented by Phoenix Technologies, which might be available under "more
> reasonable" licensing terms.  Jeff Schiller stated that it was
> inappropriate for Dave to be soliciting business in this manner, and
> discussion essentially ceased on this issue at that time.  The issue of
> encumbered authentication technologies remains unsolved. 
> The meeting ended at 1400.

---

From: David Jablon <[email-masked]>
Date: Sat, 23 Mar 2002 16:29:23 -0500

Alfred,

There are a few things that should be amended in the first draft of the
minutes excerpted below.

A few of us have had some private discussion on these points, but
I believe these should also be publicly noted, as the SACRED mailing
list includes many who did not attend the meeting.

First, the statement about the IAB and patent issues was poorly worded,
and should be completely ignored until restated.

Second, the Schiller objection to at least some aspect of the Jablon
presentation was (and remains) a contentious point.  However, to be fair,
it should be noted that Jeff saved his comment until what seemed
(to me) to be the natural end of discussion, and it did not appear to
preempt much discussion, as might be implied from the first draft minutes.

Third, the phrase:
        -- which might be available under "more reasonable" terms. --
has quote marks which seem to imply that those were my exact words.
I do not recall that statement, or making any statement about specific
license terms or any general characterization of such terms.
I know I said that one should pose certain questions directly to owners of
potentially relevant patents and that this should be done specifically because
certain things are not appropriate for discussion in an IETF meeting.

I know that patents are an extremely sensitive issue for this or any IETF WG.
I strived to present material that I believed to be directly relevant to both
the SACRED WG's technical goals and their concerns about relevant patents.
I just saw no way to present this material without also stating that my company
is a source of patents in this regard, as required by fairness and IETF rules.
If anyone has any problem with the way this material was presented,
please let me know.

Thanks.

-- David

At 09:43 PM 3/20/02 -0500, Alfred Arsenault wrote:
>Folks, 
>
>        Below are the draft minutes from Monday's SACRED WG meeting.  Any foul-ups in these are mine; please let me know if there are any omissions, additions or mis-attributions to be corrected.  If there are no comments/objections, these will stand as the meeting minutes.
>
>        Thanks, 
>
>                        Al Arsenault 
>Meeting Chair:  Magnus Nystrom, RSA Security.  (Co-chair Stephen Farrell missed the meeting for personal reasons.) 

[...]

>Magnus noted that the Protocol document has a dependency on SASL-SRP draft, so it can't actually be published as an RFC until after that document is done. Magnus asked if anyone had any insights into the progression of the SASL-SRP draft.  Lawrence Greenfield said that the last he knew, there were no outstanding issues on that draft, and he has no real idea what's holding it up.  Thus, it's possible that the block from SASL-SRP will soon be removed.

[...]

>Bob Morgan noted that there might be IPR concerns around SRP that could hold this work up.  Jeff Schiller said that the IPR situation around SRP is "a mess".  IAB is now looking at ways to avoid SRP, EKE, and similar technologies that could be covered by patents and may hold up work.
>
>Dave Jablon took that opportunity to stand up and give a quick presentation on draft-jablon-speke-00.txt.  This individual I-D covers, among other things, SPEKE.  SPEKE is a competing authenticating technology patented by Phoenix Technologies, which might be available under "more reasonable" licensing terms.  Jeff Schiller stated that it was inappropriate for Dave to be soliciting business in this manner, and discussion essentially ceased on this issue at that time.  The issue of encumbered authentication technologies remains unsolved. 
>