Subject: [saag] Draft liaison response to ITU-T re: top 100 security standards

From: <[email-masked]>
Date: Mon, 27 Apr 2009 14:57:31 +0200

Hi all,

A while back we received a liaison statement from ITU-T titled
"Solicitation of interest in ITU-T SG 17 initiative on business use 
of telecommunications/ICT security standards". The liaison statement 
is available here:

https://datatracker.ietf.org/liaison/511/

Tim and I have started preparing a response, basically listing bunch
of IETF security standards the Study Group might consider for
including in their list (note that the intent was *not* to list all
possible IETF security standards). The current draft text is included 
below.

If you have any comments, or are interested in contributing to the
liaison statement text, please send email to Tim and me within two
weeks.
 
Best regards,
Pasi & Tim

---draft text begins---

The Internet Engineering Task Force (IETF) Security Area would like to 
thank ITU-T Study Group 17 for the opportunity to comment on the new 
activity, "Business use of telecommunications/ICT security standards".

The IETF has developed a number of security standards that could be
included in this document based on the Study Group's proposed
criteria.  An initial list is provided below (in alphabetical order):

* Cryptographic Message Syntax (CMS)
* DNS Security (DNSSEC)
* DomainKeys Identified Mail (DKIM)
* Extensible Authentication Protocol (EAP) framework and 
  authentication methods
* Generic Security Service Application Program Interface (GSS-API) 
  framework and mechanisms
* HTTP authentication mechanisms and HTTP cookies
* IPsec
* Internet X.509 Public Key Infrastructure (PKIX) certificate 
  profiles and protocols
* Kerberos
* Lightweight Directory Access Protocol (LDAP) 
* Remote Authentication Dial In User Service (RADIUS) and Diameter
* S/MIME and OpenPGP 
* Secure Real-time Transport Protocol (SRTP)
* Secure Shell (SSH)
* Simple Authentication and Security Layer (SASL) framework and mechanisms
* Transport Layer Security (TLS)

The IETF Security Area does not have the resources to directly support
this activity, but IETF protocol experts may be willing to assist in
the development of summary sheets for specific protocols.  We would
invite Study Group 17 to contact the IETF Working Group responsible
for the protocol for assistance if required.

---draft text ends---

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 27 Apr 2009 07:54:37 -0700

>possible IETF security standards). The current draft text is included

That list seems fine (maybe with a bit of extension), but there are also questions in their request. The first question they ask is "Do you agree that this work activity would be useful to organizations and/or DC/CETs planning to deploy telecommunications/ICT security systems?". You might consider answering that question and, if you do, say "no". It is hard to imagine that an organization in any part of the world, not just in DC/CETs, would find a list of 100 security standards in the least bit useful.

--Paul Hoffman, Director
--VPN Consortium