Re: [saag] AD review of draft-iab-crypto-alg-agility-06

[ianG <[e-mail]>]

On 18/07/2015 09:18 am, Black, David wrote:
>>> intro, 3rd para: are we saying that agility is achieved when a
>>> protocol (specification) can easliy migrate from one suite to a
>>> better one, or when a deployment can easily migrate? The current
>>> text implies the former, but I'm not sure if we'd be better off
>>> aiming more for the latter.
>>
>> +1
>
> IoT slippery slope warning, e.g., I have no idea how to update my
> refrigerator's firmware, and "Patch Tuesday" is not a great answer due
> to risks of spoiled food ;-). (https://en.wikipedia.org/wiki/Patch_Tuesday)
>
> I'd concur that deployment upgradeability is a worthy goal, but would
> suggest leaving exploration of details of how to pull that off to other
> drafts/forums.



The inability to deploy is one of the major criticisms of agility;  if 
there is zero deployment, then there is no point to agility, and it is 
likely doing harm (complexity plus consumption of resources).  Then, if 
there is some deployment, there is some benefit, but does it achieve 
profit?  The arguments begin...

The IETF's business is more about protocol drafts not deployments, so I 
would say that the agility refers to the ability of the protocol to be 
agile, and not towards deployment.  Therefore agility is achieved when 
the protocol has it, not when deployment is shown.  So I'd leave the 
text as it is.

However, because of this criticism, we can't get away without putting a 
warning in there that agility is strictly limited by its ability to 
deploy.  That seems to find itself in section 4. Security 
Considerations, especially last para.

So I think in essence the point is covered.

iang