Subject: Re: factoring the spec into digestible pieces

From: <[email-masked]>
Date: Tue, 18 Mar 2003 21:40:03 +0200

Tuomas Aura wrote:

> I also think that the IPSec extensions should be factored out
> into a separate spec. Like CGA, they may have other uses beyond SEND.
> Let's keep this in small and digestible pieces, and make those pieces as universally usable as possible. 

One possible approach is to describe the basic protocol
pieces in separate drafts, then have one main SEND draft
to show how they are used together. For instance,

    * Delegation chain discovery protocol
    * IPsec asymmentric extension (refs: CGA addresses)
    * CGA addresses
    * Secure ND (refs: all of the above)

The last one would be basically sections 4, 8-12 of the
current spec. One problem with this approach is that I
think Pekka S wanted to separate the CGA parts not just
in terms of the technical pieces, but also in terms of
security considerations etc. But perhaps this could be
dealt with by clearly separating the security properties
in the last document for the following four cases:

    (a) Only CGA addresses available
    (b) Only trusted root for routers available
    (c) Trusted root available for both hosts and routers
    (d) CGA and trusted root available

Jari 

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Tue, 18 Mar 2003 22:31:08 +0200 (EET)

>     * Secure ND (refs: all of the above)

I'm having a bit difficulties visualizing what would go to each part.
 
>     (d) CGA and trusted root available

What I think could be preferable is to have a separation where the SEND
core protocol does not discuss CGA at all and has only an informative
reference to CGA mechanisms.

So, I was in support of a "stronger" separation, pending the resolution of 
IPR issues.

If docs were split when there are no IPR-specific CGA concerns, the 
separation would likely be different.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: "James Kempf" <[email-masked]>
Date: Tue, 18 Mar 2003 15:56:12 -0800

So it sounds to me like we should keep the document in one piece if we can get
the IPR resolved. If not, we should split out CGAs and simply have a reference
to them.

As a practical matter, I think keeping as much as makes sense in a single spec
is a better approach, since it will make advancing easier. The only other part I
can think of that I see makes sense to split out is the RSA Transform. A reason
for splitting might be that it could be useful for other purposes. But it might
make slow the spec down.

            jak

---

From: Alper Yegin <[email-masked]>
Date: Tue, 18 Mar 2003 23:43:09 -0800

I'm still not sure if this is a good idea.
As I was saying at the meeting, there are two independent problems here. One
is about proving address ownership, the other is about proving authority to
send router advertisements. The solutions should be separable. So that
deployments can replace any one of them, or choose to address one but not
the other. For example, some deployments might be interested in using the
address ownership part, and rely on some filtering to prevent unauthorized
RAs. Unless we include a language in the spec that says "an implementation
may support part A, or part B, or both to be compliant with this spec", how
can we say something is compliant with tihs RFCxxxx. This is a bit strange.

As for advancing in the IETF process, I think independent solutions that are
separately drafted have better chances of advancing faster. I think the key
is not to create dependency between them.

my 0.02 cents.

alper

---

From: Pekka Nikander <[email-masked]>
Date: Wed, 19 Mar 2003 06:39:24 -0800

Alper,

> is not to create dependency between them.

My sensing of the floor yesterday was that nobody (except
perhaps you) really did see any compelling reason to split
the document for any other reason but the CGA IPR.  In any
case, there was no consensus how exactly do the split, if
it going to be done.  There were several proposals, and none
of them got any larger support.

We can always do the split later.  I think that we will eventually
need a split, but I am still hoping that it would be necessary
only after we have published the first version as a PS.

--Pekka Nikander

---

From: Alper Yegin <[email-masked]>
Date: Wed, 19 Mar 2003 09:09:33 -0800

Hi Pekka,

> perhaps you) 

Yes, I know :) But this really doesn't answer my points above.
Maybe I should ask the question another way: why do they have to be in the
same document? 

> really did see any compelling reason to split

I don't think we want to have both combined and split versions of the specs.
This is both time costly and possible cause of problems for implementors and
deployment. If you think it should be split eventually, I'd say it is better
done at the beginning.

my o.o2 cents.

alper