Subject: [saag] Pete Resnick's Discuss on draft-dukhovni-opportunistic-security-04: (with DISCUSS)

From: "Pete Resnick" <[email-masked]>
Date: Thu, 18 Sep 2014 05:58:12 -0700

Pete Resnick has entered the following ballot position for
draft-dukhovni-opportunistic-security-04: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-dukhovni-opportunistic-security/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

I had a full-out rant prepared about "tracking of issues" and such, but a
night's sleep is a good thing. I've decided things are much simpler than
that: There were substantive non-editorial changes between -03 and -04,
substantive changes that *I* think have damaged the document in a
substantive way, and changes about which the community does not have
consensus. I believe there are things that need fixing, and therefore
discussing. (For those playing at home, I'm hanging my hat on the last
bullet of
http://www.ietf.org/iesg/statement/discuss-criteria.html#stand-disc for
this.) Let's start with the Intro:

   Broadly speaking, Opportunistic Security (OS) is a pragmatic risk
   management approach.  With Opportunistic Security, one applies the
   tools at hand to mitigate the risks that can reasonably be addressed,
   and accepts the rest.
   
This is new text, not an editorial change. I find both of those
sentences, and most of the other sentences in the Introduction,
completely useless to the task of explaining what is important about OS,
and unfortunately I think the Introduction as a whole now makes it
*harder* for the reader to understand what OS is. I don't think there is
community consensus that the new intro captures the intent. Most
importantly:

   Thus, use of an OS protocol
   may yield communication that is authenticated and encrypted,
   unauthenticated but encrypted, or cleartext.
   
I find completely insidious because it damages the message of 1.2:
Instead of a build up from a base of cleartext, which I absolutely agree
is the way we should be thinking about security and is the essential bit
of the OS model, this sentence and the one that follows it reinforce the
notion that we start from fully authenticated communication and work our
way down, precisely the notion that this document is supposed to be
moving us away from.

The definition presented in this section also hides this important
point.

The two essential bits of intro are the first paragraph of section 1.1
(which was once the first paragraph of the document) and the first two
paragraphs of section 1.2, and we don't get to read them for another 6 to
15 paragraphs. They  need to be moved up and the rest of this new intro
needs to be deleted.

In section 3:

   Coexist with local policy:  Local security policies preempt OS.
      Opportunistic security never displaces or preempts local policy.
      Many applications and types of data are too sensitive to use OS,
      and more traditional security designs are appropriate in such
      cases.

The title of section 3 is "Opportunistic Security Design Principles".
Coexisting with local policy is not part of the OS design principle; it's
a caveat to that design principle for times when you should *not* use OS.
Again, this undermines the discussion of OS, and I do not believe that
the community has consensus that the above is part of the OS design
principle.

(One overarching point: Others have made comments with other serious
problems that need fixing. That's fine. But if the result of addressing
my comments or other folks's comments is to *add* more text, you've
probably gotten it wrong. The main problem with -04 is the text that it
added. Text needs to be deleted and simplified.)

This is important work and really needs to be done. In retrospect, I
would have preferred to see this work done as a BCP in UTA or as an IAB
document instead of simply a definition document. But we are where we
are. We need to come to consensus on the text in here. We're not there
yet.

---

From: Pete Resnick <[email-masked]>
Date: Thu, 18 Sep 2014 08:48:45 -0500

I added a bit to my ballot due to conversations with Stephen, but I 
don't want to re-send a whole new ballot. I just changed this:

> way down, precisely the notion that this document is supposed to be

I added:

-03 made it clear to me that there was an order to
things. It said that there was "stepping up from" cleartext. That text
disappeared. In its place, there is the above text that apparently has
the steps in the reverse order. The definition of the term in -04
doesn't even refer to the order. I do not remember seeing any
discussion in which the participants came to consensus that this
discussion of order should be removed.

pr

-- 
Pete Resnick<http://www.qualcomm.com/~presnick/>
Qualcomm Technologies, Inc. - +1 (858)651-4478