Subject: Re: SDNAuth - Secure SDN authentication and authorization - Interested?

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 3 Feb 2015 18:04:54 -0500

Hello Hosnieh,

I don't see any responses to the points/questions raised by Ted and
Michael.  When SecAuth was closed, I and others provided feedback to
help you narrow the scope of work so that this could turn into
something successful. If you are working to reduce the number of
problem you solve at one time, that should help. Your plan to
implement code along with OpenStack could help a lot to solidify your
ideas and that is a good next next step.  To Ted's point on the
NoteWell and your plan to progress to a BoF and eventual working
group, I'd like to suggest a set of steps that should help you to be
successful:

1. Pick a few people that were helpful in the SecAuth list to
collaborate with directly. Email is fine, a list is not necessary.
2. The team should understand the goal is to develop work that will
get moved to the IETF.  This means they understand that the NoteWell
will apply once that work is contributed.
3. Choose one of the 3 problems that were in discussion on SecAuth and
only focus on that one problem.
4. Document the focused problem statement.
5. Document one or more use cases that directly align with the problem
statement.
6. Document any requirements, especially unique ones to the problem.
7. Determine if existing protocols can be used for that solution.
Document why related protocols may or me not be a fit for the problem
space.
8. Identify overlap with existing working groups. Document why or why
not there is a connection between this proposed work and each of the
related working groups.
9. Define a narrow scope of work that might evolve to a charter.
10. Begin to collaborate on a draft.
11. Develop the draft enough to ensure the problem statement,
requirements, and use case is clearly articulated.  Perhaps have the
draft reviewed by another peer.
12. Develop open source code to demonstrate your proposal.  This would
be extremely helpful.
13. Contact Sec ADs again to discuss progress and next steps.

I wish you lots of luck in your work and ask that you consider these
steps to guide your work.

Best regards,
Kathleen

On Fri, Jan 23, 2015 at 10:44 AM, Michael Richardson
<[email-masked]> wrote:
>
> Hosnieh Rafiee <[email-masked]> wrote:
>     > The name of this group is: SDNAuth
>
>     > This group focuses on the following scope:
>     > - Authentication and authorization of application to the network
>     > control - SDNAuth only provides the place where a network control can find
>     > policy but applying policy is out of the scope of SDN auth
>     > - Authentication and authorization of two controllers (exchanging
>     > policy is out of the scope)
>     > - Optimization of authentication and authorization of network elements
>     > + user at the same time
>
> All of this seems very much internal-to-Autonomous-System.  There are a bunch
> of solutions which exist already, many of which are aimed at tty/CLI-style
> logins.  (Radius, tacacs and kerberos come to mind). Some many inappropriate
> for the m2m-type communication you envision; or may require some profiling to
> make work.
>
>
>     > - Authentication and authorization of an app to a security function
>     > service such as a firewall (applying any rules on the firewall is out of
>     > scope but authentication and showing the place of policies are in scope) :
>     > SDN/NFV authentication
>
> I don't know what the scope of "app" here is, but I think that perhaps it
> means that my mobile phone can ask some firewall that is (perhaps) not within
> my enterprise for access.  Such as when I'm roaming at your office.
> But, even if it turns out that I'm at my office, the firewall is not *my*
> firewall (I'm not the admin), it's my enterprises' firewall.
> As such, this relates to such things as the "authenticated-firewall-traversal
> (AFT)" problem (and WG) of 2 decades ago
> <http://datatracker.ietf.org/wg/aft/charter/>, and also to much more modern
> things like PCP, RSVP, uPNP and the like. It would be wonderful if we could
> solve the problems of being able to scalably authenticate to network elements
> for the purpose of either reserving bandwith (in a positive, I care about
> this traffic way), and also for deflecting traffic (in a negative, please
> filter this DDoS traffic out further away from my constrainted pipe).
>
> On this, you seem to have a totally different set of requirements different
> From the SDN space, and I don't see how it matters that SDN is involved at
> all.
>
> I think that you should remove this item from your SDNauth scope; we've been
> through this dicussion multiple times now.  It's not that it isn't important;
> its really really really important, but it has a very different set of
> constraints.
>
>
>     > You can find more information about this group on the info page.
>
>     > If you are interested on the scope of this group, please feel free to join
>     > clicking on the following address:
>
>     > < https://mail.rozanak.com/mailman/listinfo/sdnauth >
>
>     > ---------------------------------------------------------------
>
>     > We had some discussions on "secauth" at IETF and would like to continue the
>     > discussion with interested folks in an external group. The goal is to
>     > prepare the final draft of charter for possible BoF.
>
>     > This group also plans to have an implementation by using Openstack as a
>     > based. Later, I will update the info page of the group with the link to a
>     > project repository.
>
>     > Thanks,
>     > Best,
>     > Hosnieh
>
>     > P.S. Please note that the group is public including its archive.
>
>
>
> --
> Michael Richardson <[email-masked]>, Sandelman Software Works
>  -= IPv6 IoT consulting =-
>
>
>

-- 

Best regards,
Kathleen

---

From: Tobias Gondrom <[email-masked]>
Date: Wed, 04 Feb 2015 09:14:43 +0800

Hi Ted,

just fyi: the mailing-list does on its sign-up page (in the first line) 
make the explicit statement to operate under the IETF Notewell: 
https://mail.rozanak.com/mailman/listinfo/sdnauth

Which I would assume to be natural and implicit, as it is mandatory for 
any IETF BoF or later WG once it forms.

Best regards, Tobias

On 23/01/15 18:41, Ted Hardie wrote:
> Hi Hosnieh,
>
> Just to confirm my understanding, the mailing list is not operating 
> under Note Well, but you expect the BoF and eventual WG to?
>
> regards,
>
> Ted Hardie
>
> On Thu, Jan 22, 2015 at 2:28 PM, Hosnieh Rafiee <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     Folks,
>
>     We have established a group for discussion on secure
>     authentication and
>     authorization of SDN components when SDN solution is in use.
>

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Wed, 4 Feb 2015 08:30:07 +0100

Thanks Kathleen for your useful advices. I am following your steps with a group of people who are interested to contribute to this work and progressing. I will contact you after finalizing our work and ready to submit the BoF. 

Best,
Hosnieh

> -----Original Message-----
> From: Kathleen Moriarty [mailto:[email-masked]]
> Sent: Wednesday, February 04, 2015 12:05 AM
> To: Michael Richardson
> Cc: Hosnieh Rafiee; IETF
> Subject: Re: SDNAuth - Secure SDN authentication and authorization -
> Interested?
> 
> Hello Hosnieh,
> 
> I don't see any responses to the points/questions raised by Ted and Michael.
> When SecAuth was closed, I and others provided feedback to help you
> narrow the scope of work so that this could turn into something successful. If
> you are working to reduce the number of problem you solve at one time, that
> should help. Your plan to implement code along with OpenStack could help a
> lot to solidify your ideas and that is a good next next step.  To Ted's point on
> the NoteWell and your plan to progress to a BoF and eventual working group,
> I'd like to suggest a set of steps that should help you to be
> successful:
> 
> 1. Pick a few people that were helpful in the SecAuth list to collaborate with
> directly. Email is fine, a list is not necessary.
> 2. The team should understand the goal is to develop work that will get moved
> to the IETF.  This means they understand that the NoteWell will apply once
> that work is contributed.
> 3. Choose one of the 3 problems that were in discussion on SecAuth and only
> focus on that one problem.
> 8. Identify overlap with existing working groups. Document why or why not
> there is a connection between this proposed work and each of the related
> working groups.
> requirements, and use case is clearly articulated.  Perhaps have the draft
> reviewed by another peer.
> 12. Develop open source code to demonstrate your proposal.  This would be
> extremely helpful.
> I wish you lots of luck in your work and ask that you consider these steps to
> guide your work.
> 
> Best regards,
> Kathleen
> 
> > All of this seems very much internal-to-Autonomous-System.  There are
> > a bunch of solutions which exist already, many of which are aimed at
> > tty/CLI-style logins.  (Radius, tacacs and kerberos come to mind).
> > Some many inappropriate for the m2m-type communication you envision;
> > or may require some profiling to make work.
> >
> >
> > I don't know what the scope of "app" here is, but I think that perhaps
> > it means that my mobile phone can ask some firewall that is (perhaps)
> > not within my enterprise for access.  Such as when I'm roaming at your
> office.
> > But, even if it turns out that I'm at my office, the firewall is not
> > *my* firewall (I'm not the admin), it's my enterprises' firewall.
> > As such, this relates to such things as the
> > "authenticated-firewall-traversal (AFT)" problem (and WG) of 2 decades
> > ago <http://datatracker.ietf.org/wg/aft/charter/>, and also to much
> > more modern things like PCP, RSVP, uPNP and the like. It would be
> > wonderful if we could solve the problems of being able to scalably
> > authenticate to network elements for the purpose of either reserving
> > bandwith (in a positive, I care about this traffic way), and also for
> > deflecting traffic (in a negative, please filter this DDoS traffic out further
> away from my constrainted pipe).
> >
> > On this, you seem to have a totally different set of requirements
> > different From the SDN space, and I don't see how it matters that SDN
> > is involved at all.
> >
> > I think that you should remove this item from your SDNauth scope;
> > we've been through this dicussion multiple times now.  It's not that
> > it isn't important; its really really really important, but it has a
> > very different set of constraints.
> >
> >

---

From: Ted Lemon <[email-masked]>
Date: Wed, 4 Feb 2015 06:12:10 -0700

On Feb 3, 2015, at 6:14 PM, Tobias Gondrom <[email-masked]> wrote:
> just fyi: the mailing-list does on its sign-up page (in the first line) make the explicit statement to operate under the IETF Notewell:https://mail.rozanak.com/mailman/listinfo/sdnauth

That's precisely what I would advise doing in this situation.   It might be worth adding that the list is informal and is not sponsored by the IETF, though; otherwise people might get the impression that it's an official IETF mailing list.   You should also disclose whether or not the list is being archived, although since it's not an IETF mailing list, whether you do so is not up to us.   If the list is not archived, however, it might be difficult and involve a painful discovery process if for some reason the Note Well had to be enforced in a lawsuit.  So while keeping an archive places an additional burden on Hosnieh, it is probably a win for other participants.

(And yes, I realize you were talking to the other Ted... :)

---

From: Tobias Gondrom <[email-masked]>
Date: Wed, 04 Feb 2015 22:29:24 +0800

> (And yes, I realize you were talking to the other Ted... :)

Just fyi: I am not the administrator of the mailing-list. I just 
happened to sign-up and noticed that the notewell is/was already there 
on the sign-up page. It seems the new list only got needed up as the Sec 
AD (Kathleen) shut down the previous IETF BOF mailing-list.

And to answer your second question: it appears the new list is being 
archived, as is also a basic mailman function.

Best regards, Tobias

---

From: Ted Hardie <[email-masked]>
Date: Wed, 4 Feb 2015 07:02:08 -0800

> ​I'​
> m not the administrator of the mailing-list. I just happened to sign-up
> and noticed that the notewell is/was already there on the sign-up page.
> It seems the new list only got needed up as the Sec AD (Kathleen) shut down
> the previous IETF BOF mailing-list.
>
>
​Yes, Hosnieh added this at my suggestion.  I think it is clearer to
indicate that the list is operating under note well, even informally, since
the intent is to work within the IETF framework.

regards,

Ted

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Wed, 4 Feb 2015 20:29:15 +0100

Hi Ted,

> From: Ted Lemon [mailto:[email-masked]]
> Sent: Wednesday, February 04, 2015 2:12 PM
> 
make the
> explicit statement to operate under the IETF
> Notewell:https://mail.rozanak.com/mailman/listinfo/sdnauth
> 
> That's precisely what I would advise doing in this situation.   It might
be worth
> adding that the list is informal and is not sponsored by the IETF, though;
> otherwise people might get the impression that it's an official IETF
mailing list.
> You should also disclose whether or not the list is being archived,
although
> since it's not an IETF mailing list, whether you do so is not up to us.
If the list is
> not archived, however, it might be difficult and involve a painful
discovery
> process if for some reason the Note Well had to be enforced in a lawsuit.
So
> while keeping an archive places an additional burden on Hosnieh, it is
> probably a win for other participants.
> 

The List archives all messages. The archives are public. I also sent the
Note Well to the members to aware of this fact because of privacy issue.
Members also received this Note Well when they joined the list.

This is what I could do as an admin of the list :-) I hope the procedure was
enough :-)

Thanks,
Best,
Hosnieh

---

From: Dave Cridland <[email-masked]>
Date: Wed, 4 Feb 2015 20:08:40 +0000

Do I understand this right? The original mailing list was shut down by the
IETF, and folks are now complaining that the third party list isn't an IETF
one? Seriously?
On 4 Feb 2015 14:29, "Tobias Gondrom" <[email-masked]> wrote:

> On Feb 3, 2015, at 6:14 PM, Tobias Gondrom <[email-masked]> <[email-masked]> wrote:
>
> Just fyi: I am not the administrator of the mailing-list. I just happened
> to sign-up and noticed that the notewell is/was already there on the
> sign-up page. It seems the new list only got needed up as the Sec AD
> (Kathleen) shut down the previous IETF BOF mailing-list.
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 4 Feb 2015 15:27:33 -0500

Hi Dave,

I didn't read this thread the same way you did.  I read it as Ted
pointing out that the Notewell will be important for contributors to
understand applies for any submission that comes to the IETF.

You can look at the SecAuth archive to see why it was shutdown.  Many
were glad as the work was taking too long to become focused into an
achievable set of goals.  A push to go back to the drawing board was
needed.  If it's an IETF list, many feel they have to follow it and
the work wasn't ready for that yet.  We'll re-evaluate the proposal
when they have had time to narrow the scope and figure out what
problem they want to solve most.

Best regards,
Kathleen

On Wed, Feb 4, 2015 at 3:08 PM, Dave Cridland <[email-masked]> wrote:
>> make the explicit statement to operate under the IETF
>> be worth adding that the list is informal and is not sponsored by the IETF,
>> though; otherwise people might get the impression that it's an official IETF
>> mailing list.   You should also disclose whether or not the list is being
>> archived, although since it's not an IETF mailing list, whether you do so is
>> not up to us.   If the list is not archived, however, it might be difficult
>> and involve a painful discovery process if for some reason the Note Well had
>> to be enforced in a lawsuit.  So while keeping an archive places an
>> additional burden on Hosnieh, it is probably a win for other participants.
>>
>> to sign-up and noticed that the notewell is/was already there on the sign-up
>> page. It seems the new list only got needed up as the Sec AD (Kathleen) shut
>> down the previous IETF BOF mailing-list.
>>

-- 

Best regards,
Kathleen

---

From: Dave Cridland <[email-masked]>
Date: Wed, 4 Feb 2015 20:49:55 +0000

So you want this list to be under IETF rules, because it's intended that
IETF contributions will happen from it, but you don't want it to be an IETF
list, because people might treat it as being IETF contributions.

I see there's a distinction, I'm not clear why it was drawn, but I'll take
your word for it that it's not as political as it sounds.
On 4 Feb 2015 20:27, "Kathleen Moriarty" <[email-masked]>
wrote:

> happened
> sign-up

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 4 Feb 2015 16:02:28 -0500

> list, because people might treat it as being IETF contributions.

My request was in the list of steps I provided to Hosnieh and that was
just to ensure that those contributing to a draft outside of IETF
understand that the NoteWell applies to content on that draft to be
contributed.  It's important for this to be understood by
contributors.  My request was for her to work with a small group and I
never suggested a list.  I sent her this list several weeks ago along
with a private note to help her with next steps.  The list I sent her
is the same that I posted.

I'm going to get back to reading drafts and not answer for others in
this discussion.

Best regards,
Kathleen

-- 

Best regards,
Kathleen

---

From: Dave Cridland <[email-masked]>
Date: Wed, 4 Feb 2015 21:18:54 +0000

That's much clearer, and to my mind more worrying.

Any discussion outside of the IETF is outside the IETF, whether it's within
a group, or a list, or a pub on the corner, or whatever. The IETF surely
cannot impose its IPR rules to the world at large.

If the results of that discussion are later entered as a contribution to
the IETF, the IETF's IPR rules apply to the person contributing, not to the
originator.

If the list discussion needs to happen under the IETF rules, the list needs
to be formally an IETF one.

Note that I'm not concerned with the specifics of whether this list ought
to exist or whether the goals are defined - just whether an non-IETF list
should be under IETF rules.
On 4 Feb 2015 21:02, "Kathleen Moriarty" <[email-masked]>
wrote:

> >> >> On Feb 3, 2015, at 6:14 PM, Tobias Gondrom <
> [email-masked]>
> >> >> wrote:
> >> >>
> >> >> though; otherwise people might get the impression that it's an
> official
> >> >> IETF
> >> >> archived, although since it's not an IETF mailing list, whether you
> do
> >> >> so is
> >> >> page. It seems the new list only got needed up as the Sec AD
> (Kathleen)
> >> >> shut

---

From: Ted Lemon <[email-masked]>
Date: Wed, 4 Feb 2015 17:16:57 -0700

On Feb 4, 2015, at 2:18 PM, Dave Cridland <[email-masked]> wrote:
> Any discussion outside of the IETF is outside the IETF, whether it's within a group, or a list, or a pub on the corner, or whatever. The IETF surely cannot impose its IPR rules to the world at large.
> 
> If the results of that discussion are later entered as a contribution to the IETF, the IETF's IPR rules apply to the person contributing, not to the originator.
> 
> If the list discussion needs to happen under the IETF rules, the list needs to be formally an IETF one.

The IETF cannot insist that Hosnieh, whose mailing list this is, do anything in particular, because it is not an IETF mailing list.   However, Hosnieh can, if she chooses, state that the list is covered by IETF Note Well rules, and can ask all participants to read and agree to the Note Well before joining the list and participating.

This is a good practice for avoiding IPR issues later on, should the work done on the list turn into IETF work.   But you are correct that there is no requirement that this be done.   Not required doesn't mean not a good idea.

---

From: Tobias Gondrom <[email-masked]>
Date: Thu, 05 Feb 2015 11:16:39 +0800

Dave,

This is getting into legal fineprint now.

Just from a process perspective to answer to your question:
(in my work at the IAOC, I have seen this type of question before and 
heard some legal advise on it - but I am not a lawyer, nor giving legal 
advise (disclaimer)...)
Actually to distinguish what is under IETF notewell and not, it does not 
matter where the mailing-list is hosted.
E.g. two IETFers could have a call on the phone or meet over coffee in 
the garden and talk about a subject related to the IETF work and if they 
perceive they are working within the IETF at that moment (and that the 
Notewell applies), they are doing so under the IETF notewell. Where the 
conversation happens is not of importance.

Best regards, Tobias

Ps.: having said that, I did not think shutting down the non-WG 
mailing-list was the best approach.... - a non-WG mailing-list does not 
cost much and we the IETF are here to allow for people to come together 
and have conversations about work related to or leading to the IETF. And 
as long as it is not a WG yet, the hurdle to come together should be as 
low as possible. Shutting down a pre-BOF mailing-list because it is not 
of BOF quality yet, is IMHO not in supporting the inclusion and mission 
of the IETF. But hey, different ADs have different approaches. And as I 
said before, in the end it does not matter where the mailing-list is 
hosted. ;-)

On 05/02/15 05:18, Dave Cridland wrote:
> Any discussion outside of the IETF is outside the IETF, whether it's 
> within a group, or a list, or a pub on the corner, or whatever. The 
> IETF surely cannot impose its IPR rules to the world at large.
>
> If the results of that discussion are later entered as a contribution 
> to the IETF, the IETF's IPR rules apply to the person contributing, 
> not to the originator.
>
> Note that I'm not concerned with the specifics of whether this list 
> ought to exist or whether the goals are defined - just whether an 
> non-IETF list should be under IETF rules.
>
> On 4 Feb 2015 21:02, "Kathleen Moriarty" 
> <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     On Wed, Feb 4, 2015 at 3:49 PM, Dave Cridland <[email-masked]
>     <mailto:[email-masked]>> wrote:
>     > On 4 Feb 2015 20:27, "Kathleen Moriarty"
>     <[email-masked]
>     <mailto:[email-masked]>>
>     > wrote:
>     >>
>     >> Hi Dave,
>     >>
>     >> On Wed, Feb 4, 2015 at 3:08 PM, Dave Cridland
>     <[email-masked] <mailto:[email-masked]>> wrote:
>     >> > Do I understand this right? The original mailing list was
>     shut down by
>     >> > the
>     >> > IETF, and folks are now complaining that the third party list
>     isn't an
>     >> > IETF
>     >> > one? Seriously?
>     >> >
>     >> > On 4 Feb 2015 14:29, "Tobias Gondrom"
>     <[email-masked] <mailto:[email-masked]>>
>     >> > wrote:
>     >> >>
>     >> >> On Feb 3, 2015, at 6:14 PM, Tobias Gondrom
>     <[email-masked] <mailto:[email-masked]>>
>     >> >> wrote:
>     >> >>
>     >> >> That's precisely what I would advise doing in this
>     situation.   It
>     >> >> might
>     >> >> be worth adding that the list is informal and is not
>     sponsored by the
>     >> >> IETF,
>     >> >> though; otherwise people might get the impression that it's
>     an official
>     >> >> IETF
>     >> >> mailing list.   You should also disclose whether or not the
>     list is
>     >> >> being
>     >> >> archived, although since it's not an IETF mailing list,
>     whether you do
>     >> >> so is
>     >> >> not up to us.   If the list is not archived, however, it
>     might be
>     >> >> difficult
>     >> >> and involve a painful discovery process if for some reason
>     the Note
>     >> >> Well had