Re: [arch-d] Possible new IAB program on Internet trust model evolution

[Brian E Carpenter <[e-mail]>]

Hi,

I'm confused. What we have in RFC3552 is very intentionally guidance for
RFC writers on what they need to cover in their RFCs. Its specific purpose
was to get rid of "Security considerations are not discussed in this memo." 
Its purpose was not primarily to define an abstraction like a "trust model"
or a "threat model" (the draft charter seems a bit vague about which of those
it means).

I really do not want to see the pragmatic purpose of RFC3552 lost in the
effort to define these abstractions. I don't think that is the intention,
but the text seems to imply that RFC3552 was mainly a description of a
generic threat model, which it wasn't.

I am not against an IAB effort to analyse how the threat and trust models
(plural) have evolved since the security workshop [RFC2316] that ultimately
led to RFC3552. That seems like a good idea. An update of "Guidelines for
Writing RFC Text on Security Considerations" also seems like a good idea.
But the draft charter text seems to conflate these two separate lines of
action.

Incidentally, while writing the above it occurred to me why the phrase
"IAB program" has always slightly disturbed me. Really the proposal is
a virtual IAB workshop (whereas RFC2316 came from three days in a room
together in Murray Hill, NJ). A good idea, but not a program.

Regards
   Brian

On 25-Jan-20 00:49, Jari Arkko wrote:
> 
> The IAB are considering starting up a programme on Internet
> trust model evolution as described in the link at the bottom of this
> email.
> 
> We'd like to get feedback on that idea and the text. As you may
> be aware, in 2019 a number of documents were published on
> this topic and discussions held (on the mailing list, SAAG, side
> meeting at IETF-106, workshops, etc). There’s also a virtual
> meeting coming up on February 14th.
> 
> To be clear, any output from this program would be text offered 
> to the IETF for consideration - it is not within the IAB's remit, nor 
> that of an IAB program, to modify a BCP. Nonetheless, an IAB 
> program offers a good venue for this work, as it perhaps allows 
> for more focus on the evolving architecture aspect within this space.
> 
> The plan is for the new program to be entirely open for participation,
> similar to how the current work has already been. That is, the mailing
> list is open for all interested to join, meetings are open and listed
> in the public agendas. The IAB will find a chair or chairs for the
> group to stay organised.
> 
> There's no specific deadline for this, but the IAB will consider this
> further in the next few weeks, so if you could take a few minutes 
> to share your thoughts on this that'd be great.
> 
> https://github.com/intarchboard/model-t-charter/blob/master/model-t-charter-00.md
> https://www.iab.org/mailman/listinfo/model-t
> 
> Stephen & Jari
> 
> 
> _______________________________________________
> Architecture-discuss mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/architecture-discuss
>