Subject: [T2TRG] draft-irtf-t2trg-iot-seccons ready to publish

From: Jim Schaad <[email-masked]>
Date: Sat, 19 May 2018 18:17:23 -0700

This draft has completed the IRSG poll with a final result of 2 'Ready to
publish' (in addition to the implicit RG chairs positions) and one 'No
Objection'.  The positions have been recorded in the data tracker.

 A new version of the document has been published to deal with the last of
the IRSG Poll comments.

I have sent the message to IANA for review and have received a response
(IANA ticket # 1109425) from Amanda which says that no IANA actions are
present.

Stephen Farrell did a review of the document back in February.  He made many
suggestions to the document which were mainly adopted, but still expressed
some skepticism about the final worth of the document.   What I read as his
major reservations were 1) A worry that this document was expressed as a
sales pitch and as such might have some limited long term applicability,  2)
A worry that some of the references to current work (SUIT and OSCORE being
two) in a long term document may not be useful, and 3) Some of the document
might be better if it were re-organized.

Vincent Roca did a review and requested that issues around privacy were
highlighted to a greater degree.  He recognized that this might need a new
document to be fully addressed, but felt that it needed to be stressed more.
In addition to this he provided a solid review that lead to some significant
fixes to the document.  Vincent expressed that his comments were adequately
addressed before responding to the poll.

Arbnor Zeqiri volunteered to review the draft, but not follow through as
near as I can tell.

Finally, Spencer Dawkins provided a review of the document that mostly
focused on nits with some small questions that have been addressed in this
last update.  I have gone through his review and the edits and believe that
they have been adequately addressed.  (Most of his comments can with some
suggested text.)

If you have any questions please let me know.

Jim

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 20 May 2018 11:50:04 +0100

Hi Jim,

Thanks for the comprehensive and nicely objective write-up. Seems like a
good example for us all.

> might be better if it were re-organized.

That's a bit more negative than I ended up. Point 3 still stands yes,
but definitely ought not be any barrier to publication. IIRC, my main
outstanding issue was the unfounded optimism wrt homomorphic crypto.
Note that I'm not asking that the document not be published on that
basis. (I do predict that everyone will regret the current text on
that down the road though;-)

S.

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Mon, 21 May 2018 08:19:16 -0500

Hi, Jim,

> they have been adequately addressed.  (Most of his comments can with some

I agree that my comments have been adequately addressed. Thanks to you all
for that.

Spencer

> _______________________________________________
> T2TRG mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/t2trg
>

---

From: Allison Mankin <[email-masked]>
Date: Mon, 21 May 2018 12:09:24 -0400

Hi Jim and all,

I’m taking a look and will request the IESG’s conflict review later today.

Allison

---

From: Mohit Sethi <[email-masked]>
Date: Tue, 22 May 2018 10:09:29 +0300

Hi Stefan,

My co-author, Oscar knows and understands homomorphic encryption well so 
perhaps he can comment more. This is all the text we have on homomorphic 
encryption in the draft (listed as one of the many options of end-to-end 
security in presence of middleboxes):

>     4.  Homomorphic encryption techniques can be used in the middlebox to
>         perform certain operations.  However, this is limited to data
>         processing involving arithmetic operations.  Furthermore,
>         performance of existing libraries, for example, SEAL [SEAL 
> <https://tools.ietf.org/html/draft-irtf-t2trg-iot-seccons-15#ref-SEAL>] is
>         still too limited and homomorphic encryption techniques are not
>         widely applicable yet.

The way I read this: homomorphic encryption exists, can only work on 
arithmetic operations, performance is still too limited and homomorphic 
techniques are not widely applicable yet? I don't see how this text is 
optimistic about homomorphic crypto?

--Mohit

---

From: Mohit <[email-masked]>
Date: Tue, 22 May 2018 10:11:59 +0300

Hi Stephen:

I blame the early morning coffee jitters for the misspelling your name. 
Sorry :)

On 05/22/2018 10:09 AM, Mohit Sethi wrote:
>
> Hi Stefan,
>
> My co-author, Oscar knows and understands homomorphic encryption well 
> so perhaps he can comment more. This is all the text we have on 
> homomorphic encryption in the draft (listed as one of the many options 
> of end-to-end security in presence of middleboxes):
>
> arithmetic operations, performance is still too limited and 
> homomorphic techniques are not widely applicable yet? I don't see how 
> this text is optimistic about homomorphic crypto?
>
> --Mohit

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 22 May 2018 11:38:33 +0100

Hiya,

> I blame the early morning coffee jitters for the misspelling your name.

No problem:-)

>> this text is optimistic about homomorphic crypto?

s/can/could in theory/ and s/widely// would make it more realistic IMO.
As-is, it's optimistic as the text will only make any sense when HE is
actually relevantly usable, which will be a very long time in the IoT
space.

Even better would be to delete the mention of HE as it is not a real
deployment option in this space, and therefore simply a distraction.
(HE is a fine research topic in general and in this space, but I don't
think it's useful to try document things that are very far from being
deployable in this docuemnt.)

All that said, and as I said before, I'm not trying to get this changed
prior to publication. (But my opinion's not changed:-)

Cheers,
S.