Subject: ND options v.s. IPsec diiscussion procedure

From: "James Kempf" <[email-masked]>
Date: Thu, 10 Jul 2003 12:18:28 +0200

So Pekka and I have discussed how we would like to run the ND options v.s.
IPsec discussion in Vienna. Here's what we came up with.

After Pekka and Jari have given their presentations, we will open the
microphones for comments. One microphone will be designated for initial
comments. Initial commentators will have 3 min. to make their point, after
which the commentator will be asked to move to the followup microphone, if
they have additional followup or points to make. Any new commentors who want
to follow up can use the initial comment microphone. The point of this
procedure is to give everybody who has a point at least 3 min. to make it.

When the discussion is completed, we will perfom a concensus call. Now, one
problem I've seen in the past with live concensus calls at IETF meetings is
that there is often confusion about what the actual question is, and the
chairs are often required (perhaps at the prompting of the AD in attendence)
to repeat the call several times in order that everybody understands. In the
process of repeating the call, the wording changes to the point where, by
the end of the call, some people are unclear about what they are being asked
to express a preference on. To avoid that kind of confusion, here are the
calls that we will make at the SEND meeting, in the order they will be made:

    Call 1: Should the SEND design be based on ND options instead of IPsec
AH?

    If Yes:
        Call 2: Should draft-arkko-send-ndopt-00.txt become the basis for
the new WG document?

    If No:
        Call 2: Should draft-nikander-ipsec-00.txt be used for CGA key
management instead of including the key in the AH header as in the current
WG draft?

The text of the calls will be displayed on the projection screen during the
call, so that there is absolutely no ambiguity about what people are being
asked to express their preference for.

If the preference of the WG is clear from the call at the meeting, we will
move forward based on it. If not, we will take the discussion to the list
and, after some additional discussion,  Pekka and I will make a concluding
concensus call, which we will take to be definitive.

It goes without saying that people should read the drafts, particularly if
you intend to express an opinion during the discussion.

Comments?

            jak

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: Soohong Daniel Park <[email-masked]>
Date: Fri, 11 Jul 2003 12:58:39 +0900

I would like to vote both of them.
I believe each approach has useful pros and cons for 
secure neighbor discovery.
Also I think the choice depends on operators not WG.

Regards

Daniel (Soohong Daniel Park)
Mobile Platform Lab,SAMSUNG Electronics

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of James Kempf
Sent: Thursday, July 10, 2003 7:18 PM
To: [email-masked]
Subject: ND options v.s. IPsec diiscussion procedure

So Pekka and I have discussed how we would like to run the ND options
v.s.
IPsec discussion in Vienna. Here's what we came up with.

After Pekka and Jari have given their presentations, we will open the
microphones for comments. One microphone will be designated for initial
comments. Initial commentators will have 3 min. to make their point,
after
which the commentator will be asked to move to the followup microphone,
if
they have additional followup or points to make. Any new commentors who
want
to follow up can use the initial comment microphone. The point of this
procedure is to give everybody who has a point at least 3 min. to make
it.

When the discussion is completed, we will perfom a concensus call. Now,
one
problem I've seen in the past with live concensus calls at IETF meetings
is
that there is often confusion about what the actual question is, and the
chairs are often required (perhaps at the prompting of the AD in
attendence)
to repeat the call several times in order that everybody understands. In
the
process of repeating the call, the wording changes to the point where,
by
the end of the call, some people are unclear about what they are being
asked
to express a preference on. To avoid that kind of confusion, here are
the
calls that we will make at the SEND meeting, in the order they will be
made:

    Call 1: Should the SEND design be based on ND options instead of
IPsec
AH?

    If Yes:
        Call 2: Should draft-arkko-send-ndopt-00.txt become the basis
for
the new WG document?

    If No:
        Call 2: Should draft-nikander-ipsec-00.txt be used for CGA key
management instead of including the key in the AH header as in the
current
WG draft?

The text of the calls will be displayed on the projection screen during
the
call, so that there is absolutely no ambiguity about what people are
being
asked to express their preference for.

If the preference of the WG is clear from the call at the meeting, we
will
move forward based on it. If not, we will take the discussion to the
list
and, after some additional discussion,  Pekka and I will make a
concluding
concensus call, which we will take to be definitive.

It goes without saying that people should read the drafts, particularly
if
you intend to express an opinion during the discussion.

Comments?

            jak

---

From: Jari Arkko <[email-masked]>
Date: Fri, 11 Jul 2003 09:06:05 +0300

> Also I think the choice depends on operators not WG.

I would not want to implement two different mechanisms. Also,
if we do both, then we have to in any case expand the
IPsec AH mechanism which has been controversial in the
IPsec WG.

Finally, as far as I know, there security properties
of the ND options approach are at least as good as those
of the IPsec approach, very likely better in terms of
transition mode etc. So security and functionality -wise
the decision seems clear. However, the main benefit of the
IPsec approach would be the potential use of the AH (and
maybe CGA) header in other applications.

--Jari

---

From: "James Kempf" <[email-masked]>
Date: Fri, 11 Jul 2003 08:52:40 +0200

Daniel,

> Also I think the choice depends on operators not WG.

Speaking with my operator hat on, I would actually prefer if the WG did make
a decision. In matters of security, having one way of doing something with
well understood security properties is better than having two, since it
reduces the amount of configuration necessary, and therefore the possibility
of misconfiguration. If the security properties are equal, there is no
benefit from having a choice from a security standpoint. Other properties
might differ, but unless there are clear and very solid differences that
don't mitigate against one or the other, I think making a choice is
desirable from the standpoint of reducing complexity.

            jak