Re: Re-chartering for extension work

["Martin Thomson" <[e-mail]>]

On Fri, Jan 10, 2020, at 01:01, Dmitri Tikhonov wrote:
> What is the security evaluation process?  Can just anyone do it
> (for example, myself sitting down and thinking about it really
> hard) or are there designated IETF people or entities that do
> this sort of thing?

The goal is to reach consensus on what the properties of the proposal are.  Maybe we might not agree on the value proposition, but we should be able to agree on the impact a proposal has to the privacy and security of different participants.  When we did the spin bit, we formed a design team that discussed potential threats and produced an assessment of the overall impact of the proposal.  That design team reported their findings to the group, people asked questions that were answered, we each reached our own conclusions, and ultimately we concluded that the findings were sound.  That meant that we were able to make a decision about adoption that wasn't confused by a disagreement about the facts.

It's probably not the case that everything needs a design team or that level of process as long as we are able to reach consensus, but for contentious or complicated topics, you could need even more support or background work when it comes to establishing what the facts are.  For instance, when we did HPACK, Google funded academic research into the proposal and the researchers set out to break the scheme.  That was hugely helpful in informing our decision to adopt that approach.