Re: [Gen-art] dealing with many the secdir and genart comments [on draft-ietf-anima-bootstrapping-keyinfra]

Brian E Carpenter <brian.e.carpenter@gmail.com> Fri, 30 November 2018 00:57 UTC

Return-Path: <brian.e.carpenter@gmail.com>
X-Original-To: gen-art@ietfa.amsl.com
Delivered-To: gen-art@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1E4812D4E7; Thu, 29 Nov 2018 16:57:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FaF5X9a-0Y4y; Thu, 29 Nov 2018 16:57:34 -0800 (PST)
Received: from mail-pf1-x435.google.com (mail-pf1-x435.google.com [IPv6:2607:f8b0:4864:20::435]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9AC6F1277C8; Thu, 29 Nov 2018 16:57:34 -0800 (PST)
Received: by mail-pf1-x435.google.com with SMTP id c72so1900789pfc.6; Thu, 29 Nov 2018 16:57:34 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=5a0maJTMEqEOAmrT5BuQ6H2x37xYy0PLD3XXIifuLwk=; b=O9AJfyUpm7OXMJD8n5MUql0n5pHJKM5+az1s5kBjJnC1RDJhYboPVcumkq1hFZMvSs wYmDZDmE6PfW/oKuyxGwg3lrxFaUUPOC5wxBx089FKTz0D9T/4NxKQFpep1lk7173G00 3XapmexuUw2+a3EnceZZhG/ssIErSdxTwb/dYhCvncg3vVNAmm08cTJuza05kIC2SBGw Hujh2V8nkcx6TarChZPwBv+lRx+q3Eu6t0ldz2Te/K0lyRyQSlUgcO/rYG3VNLmjGGOz wD/B0h7MMlJScSsqW+2XYup+6o4mNrCGHBjAeMPo2I8xOBuzjWx96Jc2SfiKUDGoFniU Wbnw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=5a0maJTMEqEOAmrT5BuQ6H2x37xYy0PLD3XXIifuLwk=; b=iTjq6KTf0Iz9fZBtpigy+LECgXi39kx2I/I1UeoPdX7gGfZRwAxBRy1wyQMp6y3zmE OfQPXlWoeSOnygJgp6KtXr33lofyWrc82CAY6S1pRFSYKtW/7qIl/khkUM3j5hfLQgWu FHMc6NnKOUh3Qepdtg+LkuP65PoAdzYg/pRvp07uLEkcV9vRGATpLKEdGGX60+q/JVvi 4b2EmP/SJRCEgorQiN50SiJrZfuA9sD4PCLtTMS8ATXOthnNzeix9AdcbfytCRUgQp1V U/syO2YyEV3JCM0XTSV3lcU+d4O+W1sNNiOW+TNT7SpN056o1ZfqHV54CyFKQnvxp+CE d3AQ==
X-Gm-Message-State: AA+aEWYzWgmaVxsjj25UfBcu6unrBCAiDmVy1xZKnx02sjZcPh5VTsHs 5lEdxNGLbs+0UCrfqd6EMQyx3JPk
X-Google-Smtp-Source: AFSGD/UkjpyqthnB9LABcQS/eUiCmtSr7ezltFVuTBZgiUGIeOq7jmyHa5fKX4gOQwVtY254zliWGw==
X-Received: by 2002:a63:da45:: with SMTP id l5mr3168985pgj.111.1543539453774; Thu, 29 Nov 2018 16:57:33 -0800 (PST)
Received: from [192.168.178.30] ([118.148.76.40]) by smtp.gmail.com with ESMTPSA id v62sm5764239pfd.163.2018.11.29.16.57.30 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 29 Nov 2018 16:57:32 -0800 (PST)
To: anima@ietf.org, Jari Arkko <jari.arkko@piuha.net>, Christian Huitema <huitema@huitema.net>
Cc: draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, gen-art@ietf.org, secdir@ietf.org
References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <153874289877.989.15433226866680411112@ietfa.amsl.com> <24358.1543530974@dooku.sandelman.ca>
From: Brian E Carpenter <brian.e.carpenter@gmail.com>
Message-ID: <0b517731-ef11-4484-7bf8-46e313a2ac49@gmail.com>
Date: Fri, 30 Nov 2018 13:57:26 +1300
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.3.1
MIME-Version: 1.0
In-Reply-To: <24358.1543530974@dooku.sandelman.ca>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/gen-art/Pv1EXgfDxEF3-uGrQWDunX6ZdIk>
Subject: Re: [Gen-art] dealing with many the secdir and genart comments [on draft-ietf-anima-bootstrapping-keyinfra]
X-BeenThere: gen-art@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "GEN-ART: General Area Review Team" <gen-art.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/gen-art>, <mailto:gen-art-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/gen-art/>
List-Post: <mailto:gen-art@ietf.org>
List-Help: <mailto:gen-art-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/gen-art>, <mailto:gen-art-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 30 Nov 2018 00:57:37 -0000

On 2018-11-30 11:36, Michael Richardson wrote:
> 
> {This is the first of many replies to the various reviews}
> 
> Jari Arkko <jari.arkko@piuha.net>; wrote:
>> My first bigger comment is that I believe the security and privacy
>> considerations section should have provided an actual in-depth
>> analysis of the characteristics offered by the protocol, perhaps under
>> several different situations, as the protocol can be operated in
>> different modes.
> 
> The authors seriously believe that this will result in an attempt to boil the
> ocean.  Yes, BRSKI is exciting for many and opens many doors, but in
> the context of the *ANIMA* Charter, we strongly think that this
> document should leave the oceans alone, and deal only with the
> ANIMA ACP usage.

Yes, violent agreement. From all the interest outside ANIMA, the basic
idea of BRSKI is a big hit and will be re-used in other contexts. I think
a strong statement about the specific scope of *this* document belongs
in the Abstract and Introduction, with a comment that variant usages
of BRSKI in other scenarios will be documented separately.
 
> Other users of BRSKI *SHOULD* write a new profile.
> Would it be acceptable for us to provide a section that might be
> entitled:
>         "The ACP mode of operation of BRSKI"
> 
> or perhaps some other section that would clarify the applicability of this
> document?

That too, but make sure that the reader gets the point in the first
few seconds of reading.

> 
> We would list the assumptions and maybe even reduce the options for use
> in the ACP?
> 
> The authors do not object to writing more documents about more situations
> where BRSKI might be used, but we think that putting it all into one
> document is a way for continuing scope creep.
> 
> In accepting the constrained work into the ANIMA WG, the chairs and area
> director have already been very generous.
> 
>> My second comment is that the protocol as defined is quite focused on
>> manufacturer-controlled situations. As Christian mentioned, there is
>> some discussion of other situations in the document (Section 6.4), but
>> not much, and there's little information on what happens if one tries
>> to use the protocol in this way.
> 
> The above comments would seem to apply to this as well.

Correct. The last call discussion has convinced me for one that we need
to tackle the issue of non-MASA scenarios, and I have some ideas about
it, but *the scope of this document* is MASA-based scenarios for
professionally managed networks. Let's make that clear (see above)
but not dilute the present text with it.

   Brian

> 
> As I previously indicated when you first wrote this, we have turned your
> comments into a series of issues on github, and we will be closing those
> issues as quickly as we can.
> 
> Some will come with proposed text changes, but a number will need discussion,
> and we will start new subject lines in this thread for them.   I don't want
> to innudate you, so I've set the Reply-To.
> 
> --
> ]               Never tell me the odds!                 | ipv6 mesh networks [
> ]   Michael Richardson, Sandelman Software Works        | network architect  [
> ]     mcr@sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [
> 
> 
> --
> Michael Richardson <mcr+IETF@sandelman.ca>;, Sandelman Software Works
>  -= IPv6 IoT consulting =-
> 
> 
> 
> 
> _______________________________________________
> Gen-art mailing list
> Gen-art@ietf.org
> https://www.ietf.org/mailman/listinfo/gen-art
>