Subject: Re: [xmpp] Proposed WG Item: End-to-End Encryption Requirements

From: Sean Turner <[email-masked]>
Date: Wed, 15 Jul 2009 19:31:09 -0400

Sean Turner wrote:
> The following ID has been proposed as WG item to aid the WG by
> enumerating the requirements for End-to-End Encryption and is aimed at
> completing our 3rd milestone in December 2010:
> 
>  Title      : Requirements for End-to-End Encryption in the
>               Extensible Messaging and Presence Protocol (XMPP)
>  Author(s)  : P. Saint-Andre
>  Filename   : draft-saintandre-xmpp-e2e-requirements-00.txt
>  Pages      : 7
>  Date       : 2009-06-05
> 
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-saintandre-xmpp-e2e-requirements-00.txt 
> 
> 
> Please indicate whether or not you believe this is a good place start.
> Note: if you indicate it is not, please provide rationale and alternatives.
> 
> spt
> co-chair xmpp wg

There has been little traffic on the WG adoption of this as WG item.
Have people read this draft (now -02)?  Is it a good starting point?
Are there requirements that are missing?

spt

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 16 Jul 2009 20:00:48 -0600

> Are there requirements that are missing?

So that people can find it, in fact it's now -01...

http://tools.ietf.org/html/draft-saintandre-xmpp-e2e-requirements-01

Perhaps I'm biased, but I think we need some kind of requirements
document for end-to-end encryption, given that (1) it seems the IESG
will require a solution to this problem before being able to sign off on
the revisions to RFCs 3920/3921 and (2) the prior solution to broadly
the same problem has not passed muster (as far as I know, there are
exactly zero implementations of RFC 3923). IMHO the threat analysis and
requirements in draft-saintandre-xmpp-e2e-requirements provide some
framing for any work we might do here. I have heard some quibbles about
some of the requirements (e.g., questions have been raised as to whether
we really need perfect forward secrecy), but I think those requirements
have broad consensus given that most of them were previously discussed
and published in XEP-0210:

http://xmpp.org/extensions/xep-0210.html

Anyway I think this provides a reasonable starting point for further
discussion. But, again, I'm probably biased in the matter...

Peter

- --
Peter Saint-Andre
https://stpeter.im/

---

From: Sean Turner <[email-masked]>
Date: Thu, 23 Jul 2009 13:49:35 -0400

Peter Saint-Andre wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 

Normally, the problem with requirements documents is that somebody has 
actually got to write the document.  But, you've already done the work 
so I think it's worth formally accepting them to ensure we stay on 
track.  The ID doesn't necessarily have to proceed to RFC status, but if 
we keep it alive it will keep us on track.

The reason I keep pushing for list acceptance of new WG items is that I 
want to make sure there's a clear consensus on acceptance.  There have 
been problems in the past when a document was accepted when it shouldn't 
have.

spt