[Mcic] Web Obj Security bar BoF

Aloha,

While you are getting ready for your next surfing adventure in the clear waters of Hawaii, an invisible shark is lurking ready to attack again.
This is not a joke. Pervasive monitoring is a threat and an attack as it has been clearly identified and articulated in RFC 7258( https://tools.ietf.org/html/rfc7258 )by the IETF community. It is a threat for individuals as it invades their privacy and a threat for organizations as it erodes their credibility in front of their customer constituency. It is a threat to the society as it challenges and inhibits the very basic rights like freedom of expression. We must stop it and it is in our power to act by providing the next generations' internet users with tools that make unlawful monitoring difficult if not impossible. Our role in the IETF community is to evolve the internet protocols in order to adapt to the society requirements and to fend off the new (or old) threats. We live in a digital world where everything we do and everything we say is one way or another captured, stored and shared in electronic format. The Internet plays a central role in our lives, our work and our social activities. It helps us connect, be informed and it has already shown us the potential to topple oppressive governments as it happened  in Egypt or to fund non-profit causes as it was the case for Ice Bucket challenge.

The IETF community rallied behind the commitment to improve and enforce better security in the protocols we develop to preserve and protect the privacy of the internet users, to regain their trust in an internet for everyone. We all got excited about this objective and while existing protocols like TLS, support strong client server e2e encryption they fail short at allowing more complex internet delivery methods to be implemented and deployed. From content distribution networks to interconnected web of things we are looking at a very sophisticated mesh where connections are optimized and enhanced by specialized intermediaries that improve efficiency and quality of experience. In fact RFC 7258 acknowledges that certain forms of monitoring like network management functions are necessary and should not be considered attacks.

On this premise, a few of us thought it would be useful to have a dialogue about the challenges we are faced in deploying e2e encryption over the internet, the use cases that require multi party negotiation for content integrity and confidentiality and the requirements for intermediary aware protocols and applications.
This informal session will try to identify the problem, scope the use cases, analyze existing solutions, present a few new proposals and most importantly facilitate the dialogue about the next steps we should take in order to accomplish our goals of building better and more secure protocols for the internet.
We compiled a short draft http://www.ietf.org/internet-drafts/draft-reschke-objsec-00.txt that attempts to touch some of the topics but it should only serve as a starting point for a more engaged dialogue that we expect to have during the bar bof session.

We have reserved Coral 2 room from 16:00 to 18:00 on Sunday Nov 9th and we hope to see you there.
Your RSVP is kindly requested in order to better plan for the session.

This is an open invitation so feel free to forward this to anybody that might be interested in contributing to the discussion and can bring additional use cases or security considerations to the table.

The right venue to discuss the draft and/or to send any question related to the topic is the MCIC (Multiparty Content Integrity and Confidentiality)
non wg mailing list.
You can subscribe here: https://www.ietf.org/mailman/listinfo/mcic

We are aware about the overlap with the newcomers meeting and while we understand that some of you might have obligations to be there, we hope that you can stop by and share some thoughts with us on this important topic.

Looking forward to hearing from you.

Best Regards,
Dan Druta, Salvatore Loreto

[Mcic] Web Obj Security bar BoF - Sunday Nov 9th