Re: Re-chartering for extension work

[Dmitri Tikhonov <[e-mail]>]

Thank you for the comprehensive and insightful answer, Martin.

On Fri, Jan 10, 2020 at 12:41:15PM +1100, Martin Thomson wrote:
> On Fri, Jan 10, 2020, at 01:01, Dmitri Tikhonov wrote:
> > What is the security evaluation process?  Can just anyone do it
> > (for example, myself sitting down and thinking about it really
> > hard) or are there designated IETF people or entities that do
> > this sort of thing?
> 
> The goal is to reach consensus on what the properties of the
> proposal are.  Maybe we might not agree on the value proposition,
> but we should be able to agree on the impact a proposal has to the
> privacy and security of different participants.  When we did the
> spin bit, we formed a design team that discussed potential threats
> and produced an assessment of the overall impact of the proposal.
> That design team reported their findings to the group, people asked
> questions that were answered, we each reached our own conclusions, and
> ultimately we concluded that the findings were sound.  That meant that
> we were able to make a decision about adoption that wasn't confused
> by a disagreement about the facts.
>
> It's probably not the case that everything needs a design team or that
> level of process as long as we are able to reach consensus, but for
> contentious or complicated topics, you could need even more support
> or background work when it comes to establishing what the facts are.
> For instance, when we did HPACK, Google funded academic research into
> the proposal and the researchers set out to break the scheme.  That was
> hugely helpful in informing our decision to adopt that approach.
>