Subject: [Sip] Proposed: delete Guidelines for use of SIP Security milestones

From: Dean Willis <[email-masked]>
Date: Mon, 09 Jul 2007 15:01:52 -0500

We have these two milestones in our charter, and neither Keith nor I are
exactly sure what they mean:

Mar 2007 Guidelines for use of SIP security to WGLC (Informational)
Jun 2007 Guidelines for use of SIP security to IESG (Informational)

Now we all know that there is a substantial need to better document the
usage of and relationships between the many SIP-related security
mechanisms, but I'm not aware of having seen a document posted that is
making any headway on this problem,. and I'm not even sure we have a
consensus on exactly what needs to be done.

Plus, we've definitely missed the milestones.

So I'd like to propose that we delete these milestones for now, and
bring them back only when we have a concrete proposal on the table for
what we think we can actually do (and should do) here.

Opinions?

--
Dean

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 09 Jul 2007 16:48:31 -0400

When did they get introduced? Seems odd that we got them added when no 
one is quite sure what they mean.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
[email-masked]                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Mon, 09 Jul 2007 16:19:10 -0500

Dean Willis wrote:
> We have these two milestones in our charter, and neither Keith nor I
> are exactly sure what they mean:
> 
> Now we all know that there is a substantial need to better document
> the usage of and relationships between the many SIP-related security 
> mechanisms, but I'm not aware of having seen a document posted that
> is making any headway on this problem,

Well, way back at the 65th IETF in Dallas (March 2006), I had
presented some slides on draft-gurbani-sip-tls-use-00 (slides
archived at http://www3.ietf.org/proceedings/06mar/slides/sip-5.pdf).
Portions of that work got absorbed elsewhere -- for instance,
the URI promotion aspect was then further explored in sip-sips;
the test cases from tls-use-00 made it into sip-sec-flows;
the mutual authentication aspect made it to domain-certs, etc.
tls-use-00 subsequently expired and was not revised, having
served some purpose in life.

> and I'm not even sure we have a consensus on exactly what needs to be
> done

Wouldn't drafts like sec-flows, sip-certs, sip-sips, domain-certs
all lead towards providing guidelines for the use of SIP
security?

> bring them back only when we have a concrete proposal on the table
> for what we think we can actually do (and should do) here.

It looks like the drafts and a substantive body of the work in
this area is out there; just needs to be organized for a more
amenable deadline.  But, I may be mistaken...

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
2701 Lucent Lane, Rm. 9F-546, Lisle, Illinois 60532 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
WWW:   http://www.alcatel-lucent.com/bell-labs

---

From: Dean Willis <[email-masked]>
Date: Mon, 09 Jul 2007 19:42:15 -0500

> all lead towards providing guidelines for the use of SIP

Certainly, and these are all both within the charter of the working 
group, and individually milestoned when the WG develops a consensus to 
deliver them.

> amenable deadline.  But, I may be mistaken...

Otherwise said, you think the milestones in question were essentially 
made redundandt by the adoption of the more-focused drafts? If so, then 
we can just delete the milestones in question, as we know we can add new 
milestones for new "more focused" drafts under our existing charter.

Or do we need something like a meta or framework document that brings 
all these pieces together into a more coherent structure?

--
Dean

---

From: "James M. Polk" <[email-masked]>
Date: Mon, 09 Jul 2007 20:49:19 -0500

At 07:42 PM 7/9/2007, Dean Willis wrote:
>group, and individually milestoned when the WG develops a consensus 
>to deliver them.
>
>>>So I'd like to propose that we delete these milestones for now, 
>>>and bring them back only when we have a concrete proposal on the table
>Otherwise said, you think the milestones in question were 
>essentially made redundandt by the adoption of the more-focused 
>drafts? If so, then we can just delete the milestones in question, 
>as we know we can add new milestones for new "more focused" drafts 
>under our existing charter.
>
>Or do we need something like a meta or framework document that 
>brings all these pieces together into a more coherent structure?

this meta framework was discussed in Dallas and it was basically, 
without structure at the time - suggested that SIP ought to get its 
act together and make SIP Security make sense to everyone else.

(Dean, you were too busy 'packing heat'  to notice  ;-)

(everyone else might have been packing their canoe from that storm  :-D

I'll suggest, if possible, there is a call for volunteers to write 
such a doc, including what's advanced since 65. Therefore I don't 
want that milestone removed until we can't find someone to write 
it.  Moving the dates out a year seems prudent though.

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Tue, 10 Jul 2007 09:45:24 -0500

Dean Willis wrote:
vkg> It looks like the drafts and a substantive body of the work in
vkg> this area is out there; just needs to be organized for a more
vkg> amenable deadline.  But, I may be mistaken...
> made redundandt by the adoption of the more-focused drafts? 

No; I thought that the focused drafts were *leading* to the milestone.
But this may be my mis-interpretation of how a WG is chartered.  Is
it the case that it is one draft per milestone?  Or could a series
of drafts satisfy one milestone?

If the latter, then sec-flows, sip-sips, sip-certs, domain-certs
all go towards fulfilling the to fulfil a general milestone that
charters the WG to develop "Guidelines for the use of SIP
security."

> all these pieces together into a more coherent structure?

Doesn't S15 of sip-hitchhikers-guide-03
(http://tools.ietf.org/html/draft-ietf-sip-hitchhikers-guide-03#section-15)
come close to providing some structure to the various security-
related drafts?  Plus, if sip-hitchhikers-guide is the last document
that the WG produces, then it will keep up -- thanks to Jonathan --
with newer technologies (SAML), protocols (DTLS) and documents as
they are adopted by the WG.

Thanks,

- vijay

---

From: Dean Willis <[email-masked]>
Date: Tue, 10 Jul 2007 20:28:46 -0500

> of drafts satisfy one milestone?

Depends on how your milestones are written -- ours are generally
structured "one milestone, one draft" rather like riots and Texas Rangers.

Usually a charter will have major planks, like "Clarify SIP security"
and then milestones (aka "deliverables") will be approved if they
support a plank.

> they are adopted by the WG.

Good question.

--
Dean

---

From: Scott Lawrence <[email-masked]>
Date: Wed, 11 Jul 2007 10:14:29 -0400

> structured "one milestone, one draft" rather like riots and Texas Rangers.

Well, I think that the drafts Vijay listed are all parts of that
picture.  Perhaps what is needed is to get a volunteer to edit a
document that pulls them all together into a single document to address
the deliverable?

-- 
Scott Lawrence  tel:+1-781-938-5306;ext=162 or sip:[email-masked]
  sipXecs project coordinator - SIPfoundry http://www.sipfoundry.org/sipXecs
  Chief Technology Officer    - Pingtel Corp. http://www.pingtel.com/