Re: [babel] Extension of Call for WG adoption of draft-ovsienko-babel-rfc7298bis through 2018-05-28

[Donald Eastlake <[e-mail]>]

Hi Barbara,


Thanks,
Donald
===============================
 Donald E. Eastlake 3rd   [phone] (cell)
 155 Beaver Street, Milford, MA 01757 USA
 [e-mail]

On Fri, May 18, 2018 at 11:58 AM, STARK, BARBARA H <[e-mail]> wrote:
>
> I wonder if it might be possible to adopt under certain conditions (in-line below)?
> Barbara
>
> > From: Juliusz Chroboczek
> ...
> > I have mixed feelings, and therefore do not know whether I do or don't
> > support adoption at the current time.
> >
> > On the one hand:
> >
> >   - I am convinced that Babel needs a simple, comprehensible,
> >     implementable auth mechanism that introduces no heavy dependencies
> >     (possibly in addition to any heavier mechanism, such as DTLS);
> >   - Denis' draft is a good starting point for obtaining the above.
>
> I agree
>
> > On the other hand:
> >
> >   - as described on the list, the protocol appears to be vulnerable to
> >     replay, due to an unfortunate confusion between symmetric reachability
> >     (as defined by 6126bis) and security association.  I have a plan for
> >     fixing the vulnerability (by removing the confusion), but I'd like to
> >     have a chance to explain my ideas in order to see if they work;
>
> I've seen many adopted drafts die without ever being sent for publication. I've helped kill a few myself. Admittedly, it is easier to kill prior to adoption than prior to WGLC -- but not that much easier. Might it be possible to agree to adopt, but with the understanding that we don't have WGLC unless there are at least 2 interoperable implementations without a replay vulnerability? That is, there exists a technical issue that *must* be resolved before WGLC.

I suppose it's possible but I don't see much point. If people want 2
interoperable implementations, which is consistent with the way this
WG has been thinking about drafts, and such implementations don't
exist, either there won't be a WGLC or it will fail.

> >   - the document (as opposed to the protocol) is very difficult to work
> >     with.  Three reasons for that: (1) an almost complete lack of
> >     rationale and human-readable intuitions, (2) a tendency to repeat the
> >     same points multiple times, and (3) a tendency to repeat what is
> >     already in 6126bis.  This is bad for a security document, and is
> >     especially worrying since the author has a poor track record of
> >     listening to stylistic (as opposed to technical) criticisms.
>
> Authors of WG drafts are assigned by the chairs and do not have to be the same as authors of individual contributions those WG drafts evolve from. If Denis were willing to work with a co-author, the chairs could assign such a co-author with the specific charter of making the draft readable. I would be willing to volunteer to do this. Alternately, the chairs could be cold-hearted and cruel and completely remove Denis as an author (which I'm not advocating, unless Denis refuses to work with a co-author or wants to completely step aside from this effort). I've seen this done several times. So this is not a reason that should prevent adoption, but is input the chairs should consider.

It is not that common for WG chairs to exercise their authority over
authorship on WG draft. Things normally work out informally. If
substantial text changes are needed to the draft, my first through is
that people should be proposing text changes or going through and
marking up the draft and sending the result to Denis. Involuntarily
removing an author of a WG draft is extreme rare and pretty much only
happens if there is a clear WG consensus for specific changes and the
author refuses to make those changes. I don't see any point in talking
about that at this point.

Thanks,
Donald
=============================
 Donald E. Eastlake 3rd   [phone] (cell)
 155 Beaver Street, Milford, MA 01757 USA
 [e-mail]

> > Should the stylistic issues with the document be fixed, and should my ideas
> > for fixing the vulnerability work out, I'd support adoption with no hesitation.
> > As it currently stands, and since I do not trust the author to fix the editorial
> > issues once the document is adopted, I'm not sure.
> >
> > -- Juliusz
> >
> > _______________________________________________
> > babel mailing list
> > [e-mail]
> > https://urldefense.proofpoint.com/v2/url?u=https-
> > 3A__www.ietf.org_mailman_listinfo_babel&d=DwICAg&c=LFYZ-
> > o9_HUMeMTSQicvjIg&r=LoGzhC-
> > 8sc8SY8Tq4vrfog&m=kuyFIAvd4lkAsr4xOmt0IOcVUWBjZuPVIcUKHf9RgX4&s
> > =24w8fbY1aQnxpOhJyK1zB-lnaFAfOawqOckSQeh8zUg&e=