From rjsparks@nostrum.com Fri Apr 8 12:49:16 2011 Return-Path: X-Original-To: earlywarning@core3.amsl.com Delivered-To: earlywarning@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E92C13A69CF for ; Fri, 8 Apr 2011 12:49:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.574 X-Spam-Level: X-Spam-Status: No, score=-102.574 tagged_above=-999 required=5 tests=[AWL=0.025, BAYES_00=-2.599, HTML_MESSAGE=0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oU2n6SABif0g for ; Fri, 8 Apr 2011 12:49:15 -0700 (PDT) Received: from nostrum.com (nostrum-pt.tunnel.tserv2.fmt.ipv6.he.net [IPv6:2001:470:1f03:267::2]) by core3.amsl.com (Postfix) with ESMTP id 2450E3A6975 for ; Fri, 8 Apr 2011 12:49:13 -0700 (PDT) Received: from [192.168.2.105] (pool-173-57-91-217.dllstx.fios.verizon.net [173.57.91.217]) (authenticated bits=0) by nostrum.com (8.14.3/8.14.3) with ESMTP id p38JowTY082171 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO) for ; Fri, 8 Apr 2011 14:50:58 -0500 (CDT) (envelope-from rjsparks@nostrum.com) From: Robert Sparks Content-Type: multipart/alternative; boundary=Apple-Mail-92--284972273 Date: Fri, 8 Apr 2011 14:50:58 -0500 References: <307CEC25-9E1F-4090-9965-758904FEA3F1@nostrum.com> To: earlywarning@ietf.org Message-Id: <39015142-16FB-41BB-A830-6211591384E4@nostrum.com> Mime-Version: 1.0 (Apple Message framework v1082) X-Mailer: Apple Mail (2.1082) Received-SPF: pass (nostrum.com: 173.57.91.217 is authenticated by a trusted mechanism) Subject: [Atoca] Fwd: ATOCA mailing list update X-BeenThere: earlywarning@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: "Discussion list for the IETF Authority-to-Citizen Alert \(atoca\) working group." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Apr 2011 19:49:17 -0000 --Apple-Mail-92--284972273 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Resending to earlywarning@ietf.org. If you get this message, but did not get the message quoted below, = please verify that you are subscribed to atoca@ietf.org using RjS Begin forwarded message: > From: Robert Sparks > Date: April 8, 2011 2:48:05 PM CDT > To: atoca@ietf.org > Subject: ATOCA mailing list update >=20 > All - >=20 > Based on the discussion at the meeting in Prague, the chairs requested = that the email list for this group be moved from > earlywarning@ietf.org to atoca@ietf.org. That move has been completed. = You should all have been automatically > subscribed to the new list, and the archives have been moved forward. = The old list will be closed in a few days.=20 > Please upgrade any mail filters you are running accordingly (the = List-ID header, in particular, will have changed). >=20 > Please let the chairs know if you are having any difficulties with the = new list or spot anything that didn't move correctly. >=20 > Thanks, >=20 > RjS >=20 >=20 --Apple-Mail-92--284972273 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii earlywarning@ietf.org.

<= /div>
If you get this message, but did not get the message quoted = below, please verify that you are subscribed to atoca@ietf.org using

RjS

Begin forwarded message:

From: Robert Sparks = <rjsparks@nostrum.com>
Date: April 8, 2011 = 2:48:05 PM CDT
Subject: ATOCA mailing = list update

All -

Based on the = discussion at the meeting in Prague, the chairs requested that the email = list for this group be moved from
earlywarning@ietf.org to atoca@ietf.org. That move has been = completed. You should all have been automatically
subscribed to the = new list, and the archives have been moved forward. The old list will be = closed in a few days.
Please upgrade any mail filters you are = running accordingly (the List-ID header, in particular, will have = changed).

Please let the chairs know if you are having any = difficulties with the new list or spot anything that didn't move = correctly.

Thanks,

RjS


<= br>
= --Apple-Mail-92--284972273-- From Martin.Thomson@commscope.com Tue Apr 12 19:05:50 2011 Return-Path: X-Original-To: earlywarning@ietfc.amsl.com Delivered-To: earlywarning@ietfc.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfc.amsl.com (Postfix) with ESMTP id F2AD0E06F4 for ; Tue, 12 Apr 2011 19:05:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([208.66.40.236]) by localhost (ietfc.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aEDdqUvFX5rg for ; Tue, 12 Apr 2011 19:05:49 -0700 (PDT) Received: from cdcsmgw02.commscope.com (fw.commscope.com [198.135.207.129]) by ietfc.amsl.com (Postfix) with ESMTP id 46BBDE06EA for ; Tue, 12 Apr 2011 19:05:46 -0700 (PDT) X-AuditID: 0a0404e9-b7c0fae000001e9f-af-4da504f9cd6f Received: from ACDCE7HC2.commscope.com ( [10.86.20.103]) by cdcsmgw02.commscope.com (Symantec Brightmail Gateway) with SMTP id E2.B2.07839.9F405AD4; Tue, 12 Apr 2011 21:05:45 -0500 (CDT) Received: from SISPE7HC1.commscope.com (10.97.4.12) by ACDCE7HC2.commscope.com (10.86.20.103) with Microsoft SMTP Server (TLS) id 8.3.137.0; Tue, 12 Apr 2011 21:05:45 -0500 Received: from SISPE7MB1.commscope.com ([fe80::9d82:a492:85e3:a293]) by SISPE7HC1.commscope.com ([fe80::8a9:4724:f6bb:3cdf%10]) with mapi; Wed, 13 Apr 2011 10:05:39 +0800 From: "Thomson, Martin" To: Hannes Tschofenig , "earlywarning@ietf.org" Date: Wed, 13 Apr 2011 10:05:36 +0800 Thread-Topic: [Atoca] Remarks on the security discussion today Thread-Index: Acvv2t7HMDnUQz4xSdOfgZ7arpealQJpDo9w Message-ID: <8B0A9FCBB9832F43971E38010638454F040295909F@SISPE7MB1.commscope.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: AAAAAA== Subject: Re: [Atoca] Remarks on the security discussion today X-BeenThere: earlywarning@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Discussion list for the IETF Authority-to-Citizen Alert \(atoca\) working group." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Apr 2011 02:05:50 -0000 Hi Hannes, Thanks for putting this together. It's a pretty good summary of the discus= sion. --Martin On 2011-04-01 at 06:35:48, Hannes Tschofenig wrote: > Hi all, >=20 > in the discussions today a few interesting remarks were raised. I=20 > wanted to share them with you. Richard, Martin and Cullen listed two=20 > aspects that need to be described in the requirements/architecture=20 > document, namely >=20 > (1) How does the recipient/receiver learn which author/originator to=20 > trust? >=20 > In this case Richard distinguished two scenarios: >=20 > a) Tsunami warning >=20 > Here the warning may be provided to the recipient/receiver by some=20 > local entity. How does the author/originator know when it receives an=20 > alert that can indeed be trusted? It could be sent by anyone. It is=20 > not very likely that the author of the message is known. >=20 > For this specific case Richard suggested to build on the work in=20 > draft- rosen-ecrit-lost-early-warning-01.txt. The basic idea is that=20 > the receiver uses LoST to discovers organizations issuing alerts for=20 > specific geographical regions. When an alert is received then the=20 > author and/or originator fields are checked against the info=20 > previously obtained via LoST. >=20 > b) School closed warning >=20 > Here, the recipient will have a prior relationship with the author=20 > (the school). A prior "registration" step is likely going to be required. >=20 > (2) Transitive Trust vs. End-to-End Security >=20 > In order to ensure that the comparison between the identity=20 > information can be processed by the recipient/receiver there is a need=20 > for cryptographic assurance. During the meeting we had discussed the=20 > possibility to use transitive trust (I know my service provider and I=20 > assume that he will only accept and forward alerts it got from other=20 > trusted sources) and end-to-end security. >=20 > In the area of end-to-end security it was noticed that the deployment=20 > reality of SIP (and XMPP) with regard to e2e security is rather weak. > Security at the alert level was seen as OK but XMLDSIG was not=20 > acceptable. >=20 > I hope my writeup makes sense (even though I am tired already). >=20 > Ciao > Hannes >=20 > _______________________________________________ > earlywarning mailing list > earlywarning@ietf.org > https://www.ietf.org/mailman/listinfo/earlywarning