Re: [kitten] Proposal for tracking document reviews and skipping WGLC

[Jeffrey Altman <[e-mail]>]

On 6/21/2016 5:03 AM, Stephen Farrell wrote:
> 
> Just for the record: I think this is a fine thing to try
> for a while, and thanks to the chairs for being willing.
> I hope the WG are also willing to give it a shot as I figure
> we need to make IETF stuff easier for WGs like kitten that
> maintain important protocols through what will sometimes
> be relatively "low energy" periods.
> 
> S.

Stephen,

I will point out that even when documents complete WGLC they do not
necessarily move forward.  For example,

 https://datatracker.ietf.org/doc/draft-ietf-kitten-aes-cts-hmac-sha2/

which has been waiting for a write-up for five months.  This is a
document that not only passed WGLC but has two independent interoperable
implementations blocked waiting for assignment of ETYPE and SUMTYPE
values by IANA.

As a former Kitten chair, the lack of available resources to work on
protocol design, documents, and implementations is not new.  The
GSS/Kerberos community has suffered with resource starvation for
decades.  Although GSS, Kerberos and other authentication technologies
are critical to the functioning of non-web network communications there
has never been sufficient funding available to complete even 10% of the
work that needs to be accomplished.  This is a key factor in the time it
takes to get things done.

When the WG Chairs and key participants are not funded to work on
GSS/Kerberos it is very hard for them to prioritize the work.  In the
end, none of us are independently wealthy and few of participant's
employers pay the participants for this work.

As someone who funded one of the independent implementations of

 https://datatracker.ietf.org/doc/draft-ietf-kitten-aes-cts-hmac-sha2/

I can tell you that there is little incentive for me to spend those
funds in the future if it is going to take 9 months to a year post the
expenditure to see the benefits.

It makes me appreciate why a company like Microsoft might decide to stop
investing in core GSS/Kerberos and instead layer additional complexity
on top of what is already standardized.  The current development work
cycle is well under a year.  If we can't standardize a protocol
extension in six months it won't be possible to ship products that
utilize the functionality.

While tooling might help, the underlying issue is lack of qualified
developer and reviewer time.  In the end, like anything else, that is
going to have to be paid for by someone.

Thanks for listening.

Jeffrey Altman