Re: [Lake] Call for adoption for draft-selander-lake-edhoc - respond by June 22

[Richard Barnes <[e-mail]>]

Hi all,

I oppose adoption of EDHOC, for both process and technical reasons.

At the process level, it is ridiculous to move for adoption immediately
after declaring consensus on the requirements.  Unless you're going to use
the requirements to evaluate solutions, there's no point having them, and
there has been no discussion on this list as to how the two solutions
compare in light of the agreed requirements.

Mališa, Your call for adoption also incorrectly suggests that because cTLS
has been adopted by TLS and no other drafts have been submitted to LAKE,
then EDHOC is basically the only option.  That is not true -- the group
could declare consensus that the focus should be on cTLS, declare victory,
and close down.  That would also fulfill the charter.

I continue to believe that cTLS is a better option for solving this
problem.  From the beginning, those of us involved in cTLS have pointed out
that having more choices for security protocols in the ecosystem has
costs.  We have also put forward concrete protocol proposals, backed by
implementation, that show that cTLS can meet the requried constraints.
Neither argument has been addressed by the EDHOC proponents.

More directly, it is hard to evaluate whether EDHOC is a suitable starting
point given that it has been a very dynamic target over the last several
versions, and earlier iterations have had security issues.  Starting from
the thoroughly-vetted baseline of TLS is a safer approach than designing
from whole cloth.  One can focus on specific questions around the things
that are being changed, rather starting analysis all over again.

I also believe that the IETF should focus its work on protocols that will
have real-world impact.  It is clear that EDHOC is popular among
academics.  Opinion appears much more split among people who work on
shipping code for real IoT devices.  Until we can get some real consensus
among actual implementors, we should not move forward.

--Richard

On Mon, Jun 8, 2020 at 9:54 AM Mališa Vučinić <[e-mail]>
wrote:

> Hi all,
>
> Since we now have a rough consensus on the requirements document, we are
> proceeding with the selection of the LAKE for OSCORE our working group is
> chartered to work on. Given:
>
> - the LAKE working group charter,
> - a wide community support over an extensive period of time for
> draft-selander-lake-edhoc,
> - adoption of the cTLS draft by the TLS working group where it will be
> further developed,
> - that no other drafts have been submitted for consideration of the LAKE
> working group,
>
> we are now launching a call for adoption for
> https://tools.ietf.org/html/draft-selander-lake-edhoc-01.
>
> Please reply to this thread whether you support the adoption, and indicate
> if you are ready to review if this draft becomes a working group document.
>
> The call for adoption ends on June 22nd, 2020.
>
> Your LAKE chairs.
> --
> Lake mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/lake
>