[MSEC] Multicast Security Considerations

["Holland, Jake" <[e-mail]>]

Hi msec,

I know this WG is shut down and the list is mostly defunct, but for
anyone still on it:

I had a slot in secdispatch last Tuesday to talk about multicast
security:
- https://datatracker.ietf.org/doc/html/draft-krose-multicast-security
- https://www.youtube.com/watch?v=vbbFgM761t4&t=1h37m51s
- https://datatracker.ietf.org/meeting/112/materials/slides-112-secdispatch-multicast-security-privacy-considerations-00

The dispatch decision was to go to a mailing list for further discussion,
possibly msec, or possibly a new one.

The stuff we're looking to get discussed is closely related to msec's
prior work, but I think not fully in-scope for the old msec charter,
mainly because (I think?) the GDOI model may not be fully applicable
to the sort of broadcast TV scale we're aiming to support in the latest
efforts I covered in the secdispatch presentation, as we don't anticipate
having quite the same kind of trusted key server setup, and we aim to
do the Authentication and Integrity constraints differently.  But with
that said, the particulars are open for discussion.

Anyway, my first question is whether anybody objects to opening
discussion on the topic on this list?  The other main option was to
create a new mailing list for the new multicast security discussion, and
I think the opinions of current msec list members would be key.

If we do it here, I'd be inviting all the interested parties I can find
to join and discuss the draft and the plans.  I'd be trying to figure
out if we can get to where a BoF seems useful, and if the problem space
can get the kind of discussion and feedback that it needs to reach a
consensus status on what it takes to deliver multicast safely with the
modern internet's ideas of safety (specifically aiming to include Web
traffic, against the advice of some of the web security luminaries).

Other possibly useful background includes the one review from Ekr on the
secdispatch list and the ensuing discussion:
https://mailarchive.ietf.org/arch/msg/secdispatch/N1jDh7MRHupuPIf1S5BiLDecGGY/

And also the discussion the next day in mboned, where some of the background
work ahead of this has been happening:
https://www.youtube.com/watch?v=xCl9NlRZoik&t=31m24s 
https://datatracker.ietf.org/meeting/112/materials/slides-112-mboned-multicast-to-the-browser-update-00.pdf

Please send back opinions if you have them, else I'll assume it won't
bother anybody to start using this list.

Best,
Jake