Subject: Re: [saag] potential new wg - curdle...

From: John Mattsson <[email-masked]>
Date: Wed, 18 Nov 2015 17:03:06 +0000

Hi,

Excellent! Well needed and a good written charter.

I agree with Eliots earlier comments, and I have one additional suggestion.

The current charter only allows the working group to introduce new mechanisms (which would then be MAY support) or deprecate old algorithms (which would then be MUST NOT support?). I think the group should also have the possibility to create profiles similar to RFC7321, RFC4307bis, and TLS 1.3 Section 8 (i.e MUST, SHOULD, MAY, SHOULD NOT, MUST NOT support…). I have recently driven a profile update of all 3GPP usage of IETF Security Protocols as well as an internal update of Ericsson's usage of security mechanisms. Implementation Requirements and Usage Guidance for at least SSH and PKIX would be very useful to have.

Some editorials:
“and JSON” -> "and JOSE"
“AES-CCM[4]” -> “AES-CCM [4]"

Cheers,
John

On 11/18/15 12:23 PM, Stephen Farrell wrote:
> Hiya,
>
> Following on from the earlier discussion about adding curves
> etc. a few folks (*) helped Kathleen and I craft an initial cut
> at charter text. [1]
>
> I think we have people (well, mostly Simon:-) to do the editing
> work for this.
>
> If you'd be willing to be a chair, please send an offlist mail
> to Kathleen and I.
>
> If you think this is useful and would review documents please
> respond to this mail saying so. I'd like to see that we have
> enough folks interested to make this work.
>
> If you have changes to charter text to suggest please do so,
> preferably in OLD/NEW form.
>
> If you think this is a bad idea, I'm sure you'll not be shy in
> saying so too:-)
>
> If there's not enough interest or if there're sound objections then
> we can abandon the idea and fall back to processing this stuff more
> slowly and more ad-hoc as AD sponsored drafts. (The main point of
> curdle is to be more organised and hopefully quicker at this.)
>
> Thanks,
> S.
>
> [1] https://datatracker.ietf.org/doc/charter-ietf-curdle/
>
> (*) Thanks to Simon Josefsson, Yoav Nir, Russ Housley and
> Sean Turner for help with the text. The fault however is mine,
> if it's bad text or a dumb idea:-)
>
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag
>

JOHN MATTSSON
MSc Engineering Physics, MSc Business Administration and Economics
Ericsson IETF Security Coordinator
Senior Researcher, Security

Ericsson AB
Ericsson Research
Färögatan 6
SE-164 80 Stockholm, Sweden
Phone +46 10 71 43 501
SMS/MMS +46 76 11 53 501
[email-masked]<mailto:[email-masked]>
www.ericsson.com<http://www.ericsson.com/>

[http://www.ericsson.com/]<http://www.ericsson.com/>

This Communication is Confidential. We only send and receive email on the basis of the terms set out atwww.ericsson.com/email_disclaimer<http://www.ericsson.com/email_disclaimer>

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 18 Nov 2015 17:29:12 +0000

Hiya,

On 18/11/15 17:03, John Mattsson wrote:
> The current charter only allows the working group to introduce new
> mechanisms (which would then be MAY support) or deprecate old
> algorithms (which would then be MUST NOT support?). I think the group
> should also have the possibility to create profiles similar to
> RFC7321, RFC4307bis, and TLS 1.3 Section 8 (i.e MUST, SHOULD, MAY,
> SHOULD NOT, MUST NOT support…). 

If the WG had consensus to e.g. propose "<foo> as a MUST for SSH"
for some reasonable <foo> then I think that would be fine and
within the charter scope. Do we need to add text to say that? If
so, what?

> I have recently driven a profile
> update of all 3GPP usage of IETF Security Protocols as well as an
> internal update of Ericsson's usage of security mechanisms.
> Implementation Requirements and Usage Guidance for at least SSH and
> PKIX would be very useful to have.
> 
> Some editorials: “and JSON” -> "and JOSE" “AES-CCM[4]” -> “AES-CCM

Ta,
S.

> [4]"
> Cheers, John
>> Following on from the earlier discussion about adding curves etc. a
>> few folks (*) helped Kathleen and I craft an initial cut at charter
>> text. [1]
>> 
>> If you'd be willing to be a chair, please send an offlist mail to
>> Kathleen and I.
>> 
>> respond to this mail saying so. I'd like to see that we have enough
>> folks interested to make this work.
>> 
>> If there's not enough interest or if there're sound objections
>> then we can abandon the idea and fall back to processing this stuff
>> more slowly and more ad-hoc as AD sponsored drafts. (The main point
>> of curdle is to be more organised and hopefully quicker at this.)
>> 
>> Thanks, S.
>> 
>> (*) Thanks to Simon Josefsson, Yoav Nir, Russ Housley and Sean
>> Turner for help with the text. The fault however is mine, if it's
>> bad text or a dumb idea:-)
>> 
>> _______________________________________________ saag mailing list 
>> [email-masked] https://www.ietf.org/mailman/listinfo/saag
>> 
> 
> 
> JOHN MATTSSON MSc Engineering Physics, MSc Business Administration
> and Economics Ericsson IETF Security Coordinator Senior Researcher,
> Security
> 
> Ericsson AB Ericsson Research Färögatan 6 SE-164 80 Stockholm,
> Sweden Phone +46 10 71 43 501 SMS/MMS +46 76 11 53 501 
> This Communication is Confidential. We only send and receive email on
> the basis of the terms set out
> atwww.ericsson.com/email_disclaimer<http://www.ericsson.com/email_disclaimer>
>
> 
> 
> 
> _______________________________________________ saag mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/saag
>

---

From: John Mattsson <[email-masked]>
Date: Wed, 18 Nov 2015 17:50:20 +0000

>within the charter scope. Do we need to add text to say that? If

I think it would be good to clarify that, suggestion:

OLD:
The  CURDLE working group is chartered to add a small set of cryptographic
mechanisms to some IETF protocols, and to deprecate old algorithms where
there
is IETF consensus to do so.

NEW:
The CURDLE working group is chartered to add a small set of cryptographic
mechanisms to some IETF protocols, and to make implementation requirements
including
deprecation of old algorithms where there is IETF consensus to do so.

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 18 Nov 2015 17:54:52 +0000

Hiya,

> deprecation of old algorithms where there is IETF consensus to do so.

That'd work for me. I'll wait and add it tomorrow(ish) in case folks
have better wording or objections.

Cheers,
S.

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 20 Nov 2015 18:01:19 +0000

Hiya,

> have better wording or objections.

So I've made that change and am happy enough that we should have
enough interested folks. I'll go ahead and move the chartering
along and ask that a mailing list be created. I'll send a mail
here when that's done. If the charter and work-items etc. need
more debate we can do that on the new list.

Thanks,
S.