Subject: [saag] OS is generic (Re: new terminology ID posted)

From: Nico Williams <[email-masked]>
Date: Tue, 8 Apr 2014 14:58:35 -0500

On Tue, Apr 8, 2014 at 2:22 PM, Stephen Kent <[email-masked]> wrote:
>> On Mon, Apr 07, 2014 at 02:33:23PM -0400, Stephen Kent wrote:
>> Of course, I am not suggesting that "opportunistic DANE TLS" is
>> the one only true "opportunistic security".  I am merely suggesting
>> that DANE TLS is (for now pending wider DNSSEC deployment) a small
>> legitimate corner case that should not be *excluded* from the wide
>> umbrella term of "opportunistic security".
>
> why should it not be excluded as we create definitions for a NEW set
> of security protocols?

The notion of opportunistic security that I thought we were working on
was intended to be *generic*, with application to existing protocols
done separately.

You are now saying that your proposal for "opportunistic security"
should be applied only to "NEW security protocols" (quoting you almost
verbatim).  Is that right??

If that's right, can you please make a detailed argument not only as
to why we must wipe the slate clean, but how we'll manage to deploy
the new security protocols on a large scale?  And while you're at it,
please justify the notion that we must not apply the new OS concept to
existing security protocols -- that makes absolutely no sense to me
unless the situation with current protocols is so bad that nothing
short of starting from scratch could help.

Before you start, I have to tell you that

a) I reject this idea that OS should apply only to NEW security
protocols because I believe we need a generic concept of opportunistic
security

b) I find the proposal that we must start with a blank slate very
difficult to take seriously.

Nico
--

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 08 Apr 2014 22:18:19 +0100

> was intended to be *generic*, with application to existing protocols

FWIW, the above is what I think we're doing. I don't see
that new/old is of much relevance really.

S.

---

From: Stephen Kent <[email-masked]>
Date: Mon, 14 Apr 2014 09:57:32 -0400

Nico,

Sorry if I was unclear.

I didn't mean to suggest that changes to existing protocols ought not
qualify for the OS term. I am not suggesting that only blank slate
approaches should qualify as OS.

I did mean to suggest that the term not be applied retroactively to
existing protocols.

For example, wow that I realize that Viktor was focusing on his draft for
opportunistic use of DANE with TLS I agree that it should be considered
as an OS candidate.

Steve

P.S. A 'generic" concept of OS seems orthogonal to the new vs. existing 
discussion.
However, we do need to discuss whether we will adopt a very vague, 
goal-oriented
definition for OS, or one with a specific set of characteristics. I plan 
to initiate
a discussion on that today.