Re: [saag] Revised version of draft-knodel-e2ee-definition

[Christopher Wood <[e-mail]>]

> On May 12, 2023, at 8:17 AM, Eric Rescorla <[e-mail]> wrote:
> 
> 
> 
> On Fri, May 12, 2023 at 7:50 AM Mallory Knodel <[e-mail]> wrote:
> Hi Eric,
> 
> On 5/12/23 10:28 AM, Eric Rescorla wrote:
>> 
>> I think the analysis needs to start with the purpose of this
>> document. Is it intended to assist the IETF in designing protocol
>> specifications? If so, how?  If intended for some other audience, then
>> who? Once there is agreement on that question, then we can discuss the
>> shape of the document.
>> 
> The purpose is to define e2ee and as multiple people have said on this list, there is not agreement. It's to make clear what we mean when we talk about e2ee.
> 
> What IETF purpose does it serve to have such a definition? In what contexts
> would we refer to it? In my experience designing protocols, while we may informally
> talk about E2EE to motivate the work we are doing (e.g,, when comparing
> media that is encrypted to an MCU with DTLS-SRTP to media that is
> encrypted to the endpoints with MLS-SFrame), when we actually design the
> protocol we try to use more formal notions. Could you perhaps give me an
> example of a setting in the IETF in which referring to this document would
> help us make progress?
>  
> Are you suggesting that the analysis go into the document text? Or that we have a group discussion here about why we wrote it? Or that we have a group discussion about something else?
> 
> What I am suggesting is that there be group agreement on the purpose of
> this work.
> 
> 
>> In terms of process, I think it should be clear at this point that
>> this document is unsuitable for AD sponsorship. That really only works
>> for documents which are largely finished, which is not the case
>> here. If this document is to proceed, it really needs to be in a WG.
>> This suggests that the next step is SECDISPATCH to determine whether
>> or not the IETF wants to work on this problem.
>> 
> On the contrary, the authors have been able to make relevant changes to the text based on feedback in this process so far. We see a way forward with all of the feedback and we'll have a new version out soon. Most recently I've asked about the systems question because that, too, is pretty straightforward to change. Welcome your thoughts on that since you raised them.
> 
> Well, I think this actually is doing a good job of demonstrating my point, which is
> that the dynamic is presently one of people commenting and the authors deciding
> what changes to make in response to that. That's very different from a WG setting
> in which the WG is responsible for the content. As I said, that's maybe fine in
> cases where the document is largely finished, but that's not the case here.

+1. I support Ekr’s suggestion of bringing this to SECDISPATCH to determine if (a) there is a place in the IETF to work on this definition and then (b) lean on the community to establish consensus around this definition. Given the importance of this topic, I think it’s prudent that we strive to build something that has consensus, even if that means taking a little bit longer to get something concrete.

Best,
Chris