Subject: [Roll] WG Last Call draft-ietf-roll-security-threats

From: "JP Vasseur (jvasseur)" <[email-masked]>
Date: Thu, 18 Oct 2012 05:16:24 +0000

Dear all,

As you know, we have been discussing security framework document in the WG, which is one of our WG item.

draft-ietf-roll-security-threats-00 is a revision of draft-ietf-roll-security-framework-07 that has been reviewed in great
details by the WG and IESG, waiting for 400 days.  The title has been changed, and the focus of the document is on
security threats, rather than solutions, in line with our ROLL WG item:

Sep 2012        Submit first draft of RPL threat analysis to the IESG to be considered as an Informational RFC

Section 7 was removed: this is the result of negotiation with the IESG on where and how security issues will be addressed.

The goal of this new document is to outline threats with the expectation that applicability statements will have to cover
(i.e. mitigate or solve) these threats in some way.  Please read this document and ask if the questions it asks are clear
enough.

This starts a WG Last call, ending on Nov 9, at noon ET. Please send your questions and comments to the authors, copying
the mailing list.

Thanks.

JP.

---

From: Abdussalam Baryun <[email-masked]>
Date: Thu, 18 Oct 2012 09:48:29 +0200

Hi JP,

Why there is WGLC for this initial draft-00, I recommend we check why
the return draft and see if the new one is representing all thoes
reasons (which I disagreed with IESG). I hope we agree in the coming
meeting to comments and WGLC for draft-01, so this can go forward. Was
there any other changes than just deleting a section and changing a
title (don't think that was the IESG concerns, if it was I am
worried)?

AB

On 10/18/12, JP Vasseur (jvasseur) <[email-masked]> wrote:
> draft-ietf-roll-security-threats-00 is a revision of
> draft-ietf-roll-security-framework-07 that has been reviewed in great
> details by the WG and IESG, waiting for 400 days.  The title has been
> changed, and the focus of the document is on
> Section 7 was removed: this is the result of negotiation with the IESG on
> where and how security issues will be addressed.
>
> The goal of this new document is to outline threats with the expectation
> that applicability statements will have to cover
> (i.e. mitigate or solve) these threats in some way.  Please read this
> document and ask if the questions it asks are clear
> enough.
>
> This starts a WG Last call, ending on Nov 9, at noon ET. Please send your
> questions and comments to the authors, copying
> the mailing list.
>
> Thanks.
>
> JP.
>

---

From: "JP Vasseur (jvasseur)" <[email-masked]>
Date: Thu, 18 Oct 2012 08:14:11 +0000

Hi AB,

Jut to shed some light here; as pointed out in the email below, this is not a -00 draft per say,
but the continuation of an effort that started a long time ago. The document used to be 
draft-ietf-roll-security-framework-07, the name was changed to reflect more accurately the
content.

Feel free to send your comments on the content of the document during the next two weeks.

Thanks.

JP.

---

From: Abdussalam Baryun <[email-masked]>
Date: Thu, 18 Oct 2012 10:40:07 +0200

Hi JP

Yes I have questions, there was comments from IESG on that draft if I
am not mistaken, so does the new draft with new name represent the
comments that was given on the framework draft. I suggested before to
do like MANET WG drafts related to security documents (draft-SEC and
draft-threats), because we are not in Security Area we are in Routing
Area. So do I now understand that we have a draft for *threats* and
not *threats-analysis*. I beleive they are two different.

------------------------------------------------------------------------------------------------
Our AD send written on Sat, 18 Aug 2012:
What we need to do is develop and publish text to address all of these things.
There were, thus, two options for this document:
1) Add substantial text to answer the how and why
2) Re-shape it as just a Security Threat Analysis
------------------------------------------------------------------------------------------------

 This is my comment/questions for now, before my review, I don't agree
for the WGLC. please read the discussion in the link below as well:

http://www.ietf.org/mail-archive/web/roll/current/msg07261.html
http://www.ietf.org/mail-archive/web/roll/current/msg07269.html
http://www.ietf.org/mail-archive/web/roll/current/msg07283.html

Finally, I agree that we don't do *threat analysis docs*, but we do
only threats docs similar to what the returned draft was doing,
because I disagreed with the IESG discuss positions on the return. My
worries, will this new draft be ok for the IESG, please explain if you
had discussion about this matter which I am not aware of.

Regards
AB
++++++++++++++++++
On 10/18/12, JP Vasseur (jvasseur) <[email-masked]> wrote:
>>> As you know, we have been discussing security framework document in the
>>> WG,
>>> which is one of our WG item.
>>>
>>> Sep 2012        Submit first draft of RPL threat analysis to the IESG to
>>> be
>>> considered as an Informational RFC
>>>