Subject: [saag] Fwd: Evaluation: <draft-dukhovni-opportunistic-security-04.txt> to Informational RFC

From: Stephen Farrell <[email-masked]>
Date: Tue, 26 Aug 2014 11:12:08 +0100

Hi all,

I've put Viktor's draft on the IESG telechcat for Sep 4th.
As an experiment, I've added this list to the set of email
addresses that will get notifications. That means that
IESG comments and discuss points and any haggling that
happens between IESG folk, authors and shepherds will
be cc'd to this list.

A couple of notes about that:

- Please don't respond unless you really must. The IESG
will make comments some of which may be repeats from
earlier discussion etc. That's just fine and you should
leave it to the sponsoring AD (me in this case), the
shepherd and authors to handle that. One good reason
to not have loads of responses will be that this will
be just one of a dozen or so similar conversations
about drafts that are going on in parallel for that
IESG telechat, so its best if we can try to keep the
mails to stuff that really really needs to be said.

- Please let Kathleen and I know if you think its useful
to see these mails (not now, but afterwards:-). I think
for AD sponsored stuff it might be good to provide some
transparency for any changes that get suggested during
IESG evaluation. We plan to also start cc'ing WG lists
in future - the IESG figure that that's probably a good
idea, and it seems to work ok for APPS WGs where its
been tried. (To be honest I meant to try that out before
but forgot - will next time though;-)

Thanks,
Stephen.

-------- Forwarded Message --------
Subject: Evaluation: <draft-dukhovni-opportunistic-security-04.txt> to
Informational RFC
Date: Tue, 26 Aug 2014 02:59:23 -0700
From: IESG Secretary <[email-masked]>
Reply-To: IESG Secretary <[email-masked]>
To: Internet Engineering Steering Group <[email-masked]>

Evaluation for <draft-dukhovni-opportunistic-security-04.txt> can be
found at
http://datatracker.ietf.org/doc/draft-dukhovni-opportunistic-security/

Last call to expire on: 2014-08-05 00:00

        Please return the full line with your position.

                      Yes  No-Objection  Discuss  Abstain
Stephen Farrell      [ X ]     [   ]      [   ]    [   ]

Has enough positions to pass.

DISCUSSES AND COMMENTS
======================

---- following is a DRAFT of message to be sent AFTER approval ---
From: The IESG <[email-masked]>
To: IETF-Announce <[email-masked]>
Cc: RFC Editor <[email-masked]>
Subject: Document Action: 'Opportunistic Security: some protection most
of the time' to Informational RFC
(draft-dukhovni-opportunistic-security-01.txt)

The IESG has approved the following document:
- 'Opportunistic Security: some protection most of the time'
  (draft-dukhovni-opportunistic-security-01.txt) as Informational RFC

This document has been reviewed in the IETF but is not the product of an
IETF Working Group.

The IESG contact person is Stephen Farrell.

A URL of this Internet Draft is:
http://datatracker.ietf.org/doc/draft-dukhovni-opportunistic-security/

Technical Summary

   This document defines the concept "Opportunistic Security" in the
   context of communications protocols.  Protocol designs based on
   Opportunistic Security remove barriers to the widespread use of
   encryption on the Internet by using encryption even when
   authentication is not available, and using authentication when

Working Group Summary

   This is an AD sponsored document and not the product of
   a WG. It was extensively debated on the saag list and during
   an extended IETF LC. The concept was also debated at
   the STRINT workshop.

   The shepherd write-up has more to say:

   "The document and its predecessors were discussed with great
    gusto over many months on the SAAG mailing list, in the UTA WG,
    and at two IETF meetings. There is a great deal of interest in
    having a common set of definitions for the ideas related ot
    opportunistic security, even where there might be disagreement
    about where it should and should not be used.

    The IETF Last Call on the -03 draft produced a lot of suggestions
    for major improvements to the language in the draft, and the author
    did a significant revision based on them, all without changing the
    design philosophy. There are probably still some people who think
    that the wording is not what they would want, and some who think
    that the whole idea is a bad one, but there was rough consensus
    that the document was useful and should be published.

    The document has had more review, and ended up getting stronger
    consensus for the eventual definition, than the products of many
    security WGs. Because this document does not define how to
    implement opportunistic security, there is some disagreement about
    its applicability to existing and future IETF protocols, but there was
    strong agreement that the definition was good enough for many
    protocols."

Document Quality

   One would not directly implement this as its a design pattern.
   There are Internet-drafts that are using this already in DANE,
   HTTPBIS and some individual drafts.

Personnel

   Paul Hoffman is the document shepherd.
   Stephen Farrell is the irresponsible AD.

RFC Editor Note

  (Insert RFC Editor Note here or remove section)

IRTF Note

  (Insert IRTF Note here or remove section)

IESG Note

  (Insert IESG Note here or remove section)

IANA Note

  There is no IANA considerations section and no need for
  one. It'll be interesting to see if this note gets noticed or if
  folks complain about the lack of a redundant section.
  I hope the former and not the latter:-)

---

From: Dave Crocker <[email-masked]>
Date: Tue, 26 Aug 2014 09:04:08 -0700

> I've put Viktor's draft on the IESG telechcat for Sep 4th.

That's significantly premature.

First, consider how little convergence there was on the preceding draft
-- and yes, that's contrary to your mis-characterization of it as only
my having serious concerns; but I think that error of that myth has been
adequately documented.

Then consider how substantial the changes have been to the latest draft.

Then consider that this round of changes, again, has been subject to a
mystical process of offlist evaluation and decision-making, rather than
any sort of interactive and incremental process with those making
comments.  In other words, folks again have to do their own audit, to
see whether the changes resolve concerns.

So please give the current draft a chance to get meaningful review,
comment and possibly convergence.

And then there is the August and US Labor Day vacation issue...

d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 26 Aug 2014 23:48:44 +0100

Hi Dave,

> That's significantly premature.

Clearly, I disagree, and am proceeding with the plan I
set out on [email-masked] on Friday last week [1] after
the extended IETF LC.

My evaluation was (and is) that we do have rough consensus
to proceed and that from about version -02 to -04, there has
been no real change to the concept but many wording changes.
Those have improved things, but in particular from -03 to
-04 I agree with what Christian Huitema said earlier: we
are starting to go sideways instead of forward (i.e. we're
not improving significantly and its good-enough).

I realise that you do not agree with that assessment but I
do think all your points have been considered appropriately.
I also read your review of -04 and don't see new issues
there to change that assessment. (Thanks for that review btw,
and I'm sure the editorial comments will be useful.)

On balance I think best is to move this one into IESG
evaluation and see what conclusion is reached.

Thanks,
S.

[1] https://www.ietf.org/mail-archive/web/ietf/current/msg89280.html