[Mcic] Summary + Next Steps from Web Obj Security bar BoF - Sunday Nov 9th

["Klas, Guenter, Vodafone Group" <[e-mail]>]

Web Object Security bar BoF  at IETF 91 - next steps

Hi there,

You recall, we had the "Multiparty Content Integrity and Confidentiality" bar BoF in Hawaii on Sunday and also talked about web object security.  Thanks to all who participated, prepared some stuff and to Dan Wing for having chaired the session.

Here some takeaways and suggested next steps.
Takeaways:

-          Based on the introduction from Dan D. and Julien, we gathered a number of use cases which people found relevant or associated with the problem space. See the use case slide as edited by Dan Wing.

-          Several people felt the number of use cases is too high, better to narrow the list down to a few use cases which can gain good support (e.g. caching, bandwidth consumption, optimisation).

-          Feedback that the problem statement should be articulated more concisely, building on the top few use cases of interest, explaining the non-technical and the related technical issues that require a solution.

-          Maybe a degree of misunderstanding was produced and needs to be corrected, as the objective is certainly NOT to break TLS.

Worth also to say that the intent fits to what Jari mentioned in his IETF 91 blog summary at http://www.ietf.org/blog/2014/11/ietf-91-summary/ : "We need deployable security solutions, we need technology that enables the network to do its work (addressing, caches, ...) while protecting privacy, and we need algorithms that we know we can trust. Hard work ahead!"

Next possible steps:

-          The group to prioritise the use cases as gathered at IETF 91. Can use a Doodle poll as suggested by Dan W.

-          Firming up the problem description. Explaining clearly what non-technical problem exists AND describing the technical problem(s) one level below the use cases.

-          Following up on some of the more detailed questions/aspects already raised at the bar BoF.

-          Involving additional experts who might have an interest in this area.

-          Using the discussion on the mailing list to create material that is sufficient to justify a proper BoF session in the future.

Br
Guenter

From: Mcic [mailto:[e-mail]] On Behalf Of Salvatore Loreto
Sent: 04 November 2014 18:55
To: Greg Wilkins; Mark Nottingham; Simone Bordet; Larry Masinter; Barry Leiba; Pete Resnick; Stephen Farrell; Jari Arkko; [e-mail]; Alissa Cooper; Richard Barnes; Sean Turner; [e-mail]; [e-mail]; [e-mail]; [e-mail]; [e-mail]; [e-mail]; [e-mail]; Peter Saint-Andre; Joe Hildebrand (jhildebr); [e-mail]; Brian Raymor (MS OPEN TECH); Gabriel Montenegro; Rob Trace; Roberto Peon; Martin Nilsson; Eric Rescorla; Martin Thomson; [e-mail]; Craig Taylor; Mike Jones; Simon Pietro Romano
Cc: [e-mail]
Subject: [Mcic] Web Obj Security bar BoF - Sunday Nov 9th

Aloha,

While you are getting ready for your next surfing adventure in the clear waters of Hawaii, an invisible shark is lurking ready to attack again.
This is not a joke. Pervasive monitoring is a threat and an attack as it has been clearly identified and articulated in RFC 7258( https://tools.ietf.org/html/rfc7258 )by the IETF community. It is a threat for individuals as it invades their privacy and a threat for organizations as it erodes their credibility in front of their customer constituency. It is a threat to the society as it challenges and inhibits the very basic rights like freedom of expression. We must stop it and it is in our power to act by providing the next generations' internet users with tools that make unlawful monitoring difficult if not impossible. Our role in the IETF community is to evolve the internet protocols in order to adapt to the society requirements and to fend off the new (or old) threats. We live in a digital world where everything we do and everything we say is one way or another captured, stored and shared in electronic format. The Internet plays a central role in our lives, our work and our social activities. It helps us connect, be informed and it has already shown us the potential to topple oppressive governments as it happened  in Egypt or to fund non-profit causes as it was the case for Ice Bucket challenge.

The IETF community rallied behind the commitment to improve and enforce better security in the protocols we develop to preserve and protect the privacy of the internet users, to regain their trust in an internet for everyone. We all got excited about this objective and while existing protocols like TLS, support strong client server e2e encryption they fail short at allowing more complex internet delivery methods to be implemented and deployed. From content distribution networks to interconnected web of things we are looking at a very sophisticated mesh where connections are optimized and enhanced by specialized intermediaries that improve efficiency and quality of experience. In fact RFC 7258 acknowledges that certain forms of monitoring like network management functions are necessary and should not be considered attacks.

On this premise, a few of us thought it would be useful to have a dialogue about the challenges we are faced in deploying e2e encryption over the internet, the use cases that require multi party negotiation for content integrity and confidentiality and the requirements for intermediary aware protocols and applications.
This informal session will try to identify the problem, scope the use cases, analyze existing solutions, present a few new proposals and most importantly facilitate the dialogue about the next steps we should take in order to accomplish our goals of building better and more secure protocols for the internet.
We compiled a short draft http://www.ietf.org/internet-drafts/draft-reschke-objsec-00.txt that attempts to touch some of the topics but it should only serve as a starting point for a more engaged dialogue that we expect to have during the bar bof session.


We have reserved Coral 2 room from 16:00 to 18:00 on Sunday Nov 9th and we hope to see you there.
Your RSVP is kindly requested in order to better plan for the session.


This is an open invitation so feel free to forward this to anybody that might be interested in contributing to the discussion and can bring additional use cases or security considerations to the table.


The right venue to discuss the draft and/or to send any question related to the topic is the MCIC (Multiparty Content Integrity and Confidentiality)
non wg mailing list.
You can subscribe here: https://www.ietf.org/mailman/listinfo/mcic


We are aware about the overlap with the newcomers meeting and while we understand that some of you might have obligations to be there, we hope that you can stop by and share some thoughts with us on this important topic.

Looking forward to hearing from you.

Best Regards,
Dan Druta, Salvatore Loreto