Re: [Model-t] What are we trying to protect

[Ted Lemon <[e-mail]>]

I think this is a great approach, Christian.   If we follow your model we should be able to start from what we know and avoid boiling the ocean, without inappropriately skipping some modeling that we actually need to do because it borders on our space, even though it is not itself our space.

There are a few other things I think we should do.

First, you may have noticed that I don’t actually show a clear understanding of what the goals of this effort are in my comments.   This is because I’m a security area consumer more than a security area producer, so I wasn’t in the saag meeting.  I saw Stephen’s mail go by about “security models” and thought to myself “excellent, we need that.”   That’s literally all I know about what the plan is for this discussion.   It would be good to actually write down what our goals are.

Second, I don’t think we all agree on how we want to describe threat models.   If there is to be an abbreviated form for describing threats (as opposed to natural English) we need to document what that form is in sufficient detail that IETF participants who are not SMEs can understand it, and hopefully even contribute.   I’m not saying we have to write an RFC, but at a minimum there should be a wiki that has the needed information.

I also don’t think we even agree on what we mean by threat models.   Of course we mean models of threats, but at what level of detail?   How close to the code are these models?  How general, or how specific?   This may all be obvious to people on this list who are SMEs, but I’m not, so for me it would help to describe what we mean by “threat model,” not because anybody here is unclear on the basic concept, but because I suspect we don’t agree on the particulars.

As an example, the models that Bret has described don’t seem as if they would be helpful to me.  This doesn’t mean that they aren’t right—it either means that I don’t understand them clearly, or that we simply have different requirements.   It may be that what I want is not what should be produced here—I’m not claiming otherwise.   But it would be good to get some clarity on that.