Re: [Lake] Call for adoption for draft-selander-lake-edhoc - respond by June 22

Stephen Farrell <stephen.farrell@cs.tcd.ie> Mon, 22 June 2020 22:07 UTC

Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: lake@ietfa.amsl.com
Delivered-To: lake@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 59F923A0C52 for <lake@ietfa.amsl.com>; Mon, 22 Jun 2020 15:07:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WaoKJxGjNppk for <lake@ietfa.amsl.com>; Mon, 22 Jun 2020 15:07:21 -0700 (PDT)
Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C132F3A0C3A for <lake@ietf.org>; Mon, 22 Jun 2020 15:07:20 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id B3BB8BE2F; Mon, 22 Jun 2020 23:07:18 +0100 (IST)
X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie
Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mpOaT8u_gIPq; Mon, 22 Jun 2020 23:07:16 +0100 (IST)
Received: from [10.244.2.119] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 28CA6BE2C; Mon, 22 Jun 2020 23:07:16 +0100 (IST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1592863636; bh=vRolvdkNnzhcbcSNdYwWUv0MqU4Pn5zgzMpVvftANO8=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=aTxpixF4K+Ctfl5AzqeWHs5tFr1AzntQvQ/7A3sGEiN1FHMFpOrEQCW7/FIMEDRDs kogIbbCcbnuo7ANaaBzwLyGteJw2hRDLTmuBxMsU/9wScp710v3wrXn8hK+sGx6Sax B25DUOTVr3di7SQZMH2epw3O5CTyUchuCYaerSQQ=
To: Richard Barnes <rlb@ipv.sx>, =?UTF-8?B?TWFsacWhYSBWdcSNaW5pxIc=?= <malisa.vucinic@inria.fr>
Cc: lake@ietf.org
References: <89EA6A63-AB99-4649-9F08-D6FBDE1DEF2F@inria.fr> <CAL02cgQ_eLnnwztRShbFbra6eFEvY5pv7Q2Mrk+rxMaHxd7ubw@mail.gmail.com>
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw==
Message-ID: <ec7fa3f2-035b-2f12-0d1f-1a2a00431843@cs.tcd.ie>
Date: Mon, 22 Jun 2020 23:07:15 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.8.0
MIME-Version: 1.0
In-Reply-To: <CAL02cgQ_eLnnwztRShbFbra6eFEvY5pv7Q2Mrk+rxMaHxd7ubw@mail.gmail.com>
Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="G7jmC88g4NROHMEUZJxRKaOiUiEqWukRN"
Archived-At: <https://mailarchive.ietf.org/arch/msg/lake/eRKQ9Jm6985mO4lFHw9eFjNC-yY>
Subject: Re: [Lake] Call for adoption for draft-selander-lake-edhoc - respond by June 22
X-BeenThere: lake@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Lightweight Authenticated Key Exchange <lake.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lake>, <mailto:lake-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/lake/>
List-Post: <mailto:lake@ietf.org>
List-Help: <mailto:lake-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lake>, <mailto:lake-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 22 Jun 2020 22:07:23 -0000

Hiya,

On 22/06/2020 22:49, Richard Barnes wrote:
> Hi all,
> 
> I oppose adoption of EDHOC, for both process and technical reasons.

I don't see how your process reasons add up tbh, but
maybe I'm wrong...

> 
> At the process level, it is ridiculous to move for adoption immediately
> after declaring consensus on the requirements.  

That is kinda funny tbh. This topic has been discussed for
a significant duration. IMO people have clearly reached
their reasoned conclusions either way well before now. I
see no real possibility that more time will change
positions and no new information being offered that might
have that effect.

> Unless you're going to use
> the requirements to evaluate solutions, there's no point having them, and
> there has been no discussion on this list as to how the two solutions
> compare in light of the agreed requirements.

It seems clear to me that both edhoc and cTLS can meet the
requirements. Feel free to correct me as to why that is
wrong.

> 
> Mališa, Your call for adoption also incorrectly suggests that because cTLS
> has been adopted by TLS and no other drafts have been submitted to LAKE,
> then EDHOC is basically the only option.  That is not true -- the group
> could declare consensus that the focus should be on cTLS, declare victory,
> and close down.  That would also fulfill the charter.

If the consensus were to not adopt edhoc, I will be arguing
to close the WG as it'd be pointless. That seems to me to
amount to the same decision that you argue for above.

To be clear about something I've said before: as a chair, I
am not personally willing to put up with procrastinating
further on what is a clear choice that needs to be made and
on which I believe all informed participants have reached
their own considered decisions. There are non-trivial
arguments on both sides, but I don't see that there have
been any new arguments nor information for some time. It
is time to pick or get off the picking-pot.

Cheers,
S.

> 
> I continue to believe that cTLS is a better option for solving this
> problem.  From the beginning, those of us involved in cTLS have pointed out
> that having more choices for security protocols in the ecosystem has
> costs.  We have also put forward concrete protocol proposals, backed by
> implementation, that show that cTLS can meet the requried constraints.
> Neither argument has been addressed by the EDHOC proponents.
> 
> More directly, it is hard to evaluate whether EDHOC is a suitable starting
> point given that it has been a very dynamic target over the last several
> versions, and earlier iterations have had security issues.  Starting from
> the thoroughly-vetted baseline of TLS is a safer approach than designing
> from whole cloth.  One can focus on specific questions around the things
> that are being changed, rather starting analysis all over again.
> 
> I also believe that the IETF should focus its work on protocols that will
> have real-world impact.  It is clear that EDHOC is popular among
> academics.  Opinion appears much more split among people who work on
> shipping code for real IoT devices.  Until we can get some real consensus
> among actual implementors, we should not move forward.
> 
> --Richard
> 
> On Mon, Jun 8, 2020 at 9:54 AM Mališa Vučinić <malisa.vucinic@inria.fr>
> wrote:
> 
>> Hi all,
>>
>> Since we now have a rough consensus on the requirements document, we are
>> proceeding with the selection of the LAKE for OSCORE our working group is
>> chartered to work on. Given:
>>
>> - the LAKE working group charter,
>> - a wide community support over an extensive period of time for
>> draft-selander-lake-edhoc,
>> - adoption of the cTLS draft by the TLS working group where it will be
>> further developed,
>> - that no other drafts have been submitted for consideration of the LAKE
>> working group,
>>
>> we are now launching a call for adoption for
>> https://tools.ietf.org/html/draft-selander-lake-edhoc-01.
>>
>> Please reply to this thread whether you support the adoption, and indicate
>> if you are ready to review if this draft becomes a working group document..
>>
>> The call for adoption ends on June 22nd, 2020.
>>
>> Your LAKE chairs.
>> --
>> Lake mailing list
>> Lake@ietf.org
>> https://www.ietf.org/mailman/listinfo/lake
>>
> 
>