Re: [saag] Content rights management (was: Pasi's AD notes for September 2008)

["David P. Quigley" <[e-mail]>]

It may just be me but this just sounds like you want an environment that
enforces mandatory access controls and has some sort of MLS or MCS
policy in place. I am planning a bar BOF for 73 to cover MAC security
labels and when planning it I was told that you really need a clear set
of goals that you want to accomplish at the BOF. I didn't see any goals
published on the saag list for this BOF so I am not quite sure what you
are trying to accomplish here but it sounds like the same situation you
find with respect to documents in the military.

Dave 


On Wed, 2008-10-01 at 00:52 +0300, [e-mail] wrote:
> Thomas,
> 
> If I remember the history correctly, the IDRM and PERM BOFs were about
> DRM for copyright enforcement, or managing rights for entertainment 
> content that is usually publicly available (to anyone who pays). As 
> you point out, this is an area where several other organizations have 
> also been active (not very successfully, some folks might say), and 
> I don't think IETF work in this area would have much chances either.
> 
> However, this BOF proposal is about managing rights for *confidential*
> information (inside an enterprise, or between cooperating enterprises); 
> some folks are using the term "data-centric security" to mean something 
> similar.
> 
> This topic has received perhaps less attention (although e.g. Microsoft 
> Office has related features), and there are some differences. For 
> example, entertainment DRM often considers the user to be the adversary, 
> but inside an enterprise, most users aren't actively trying to leak 
> confidential information to competitors.  Also, entertainment DRM is 
> usually "break once, run anywhere", so if it works only 50% of time, 
> it's useless -- but preventing 50% of information leaks could be 
> worthwhile.
> 
> Even this kind of "rights management" is a somewhat controversial
> topic (especially if used outside enterprise scenarios), and personally, 
> I have some doubts whether we at IETF have the right set of people 
> (e.g., vendors, potential users, etc.) for this work (and it's not
> clear what "this work" even is). However, I think the topic is 
> sufficiently different from entertainment DRM that it might succeed
> somewhere (even if it turns out IETF wasn't the right place).
> 
> Unlike Paul (who replied to you already), I might even consider going 
> to the bar BOF, if it happens and they have good beer :-) However,
> I want to clarify that the IETF is *not* proposing anything here -- 
> a bar BOF is just individuals chatting over drinks.
> 
> Best regards,
> Pasi
> 
> > -----Original Message-----
> > From: ext Thomas Hardjono [mailto:[e-mail]] 
> > Sent: 30 September, 2008 21:28
> > To: [e-mail]; [e-mail]; Eronen Pasi (Nokia-NRC/Helsinki)
> > Cc: Mark Baugher; [e-mail]
> > Subject: Re: [saag] Pasi's AD notes for September 2008
> > 
> > 
> > 
> > Pasi, Tim,
> > 
> > Apologies for asking, but I was wondering about the proposed 
> > Content Rights Management (ie. DRM) BOF. More specifically, I 
> > was wondering if the IETF is now open to discussing such a 
> > "DRM standard".
> > 
> > Back in 2001, Mark Baugher and myself went through two (2) 
> > BOFs proposing the creation of an IETF open standards for a 
> > DRM protocol.  If my memory serves me right the presiding ADs 
> > was Steve Bellovin and Russ Housley. The specific protocol 
> > was called PERM, and the slides can be found here:
> > http://hardjono.net/idrm/
> > 
> > At that time the outcry against this effort was deafening. I 
> > was arguing that it was better for the IETF to own such a 
> > protocol and made it it "open" (ie. not proprietary and no 
> > need to sign consortium legal paperwork). Since that time 
> > there has been a plethora of DRM related products and 
> > standards (eg. Apple, MSFT RM, OMA-download, CableLabs, 5C, 
> > etc, etc). In a sense, the IETF missed the boat on this one.
> > 
> > Not that I'm unsupportive, but I was wondering what is 
> > motivating the IETF to propose such a BOF again at this time :)
> > 
> > Thanks.
> > 
> > Regards.
> > 
> > /thomas/
> > 
> > --- On Tue, 9/30/08, [e-mail] 
> > <[e-mail]> wrote:
> > 
> > > From: [e-mail] <[e-mail]>
> > > Subject: [saag] Pasi's AD notes for September 2008
> > > To: [e-mail], [e-mail]
> > > Date: Tuesday, September 30, 2008, 3:21 AM
> > > Hi all,
> > > 
> > > Here's again a short status update about what things
> > > are going on 
> > > from my point-of-view. If you notice anything that
> > > doesn't look
> > > right, let me know -- miscommunication and mix-ups do
> > > happen.
> > > 
> > > Best regards,
> > > Pasi
> > > 
> > > MISC NOTES
> > > 
> > > - There have been two security-related BoF requests for
> > > IETF73:
> > >   OAuth (in the applications area), and Content Rights
> > > Management
> > >   (in the security area). For the latter, Tim and I have
> > > recommended 
> > >   having a bar BoF first. 
> > > - SecDir mailing list is in the process of being moved from
> > > mit.edu 
> > >   to ietf.org servers.
> > > - I've spent some time this month on tools development
> > > and IESG
> > >   process improvements -- nothing is ready yet, but
> > > hopefully soon..
> > > 
> > > WORKING GROUPS
> > > 
> > > DKIM
> > > - draft-ietf-dkim-ssp: in Publication Requested, waiting
> > > for 
> > >   me to read it.
> > > - Waiting for WG to send list of RFC errata IDs the WG
> > > agrees on.
> > > 
> > > EMU
> > > - draft-ietf-emu-gpsk: in AD Evaluation -- waiting for
> > > revised 
> > >   ID that reflects the new WG consensus on MAC length/key
> > > size 
> > >   issue before going to IETF last call (since 2008-08-25)
> > > - A liaison statement reply was sent to ITU-T SG 17
> > > regarding X.1034, 
> > >   "Guidelines on EAP-based authentication and key
> > > management in a 
> > >   data communication network".
> > > - IESG appointed Joe Salowey as the designated expert for
> > > IANA 
> > >   allocation of EAP Type Codes
> > > - (not WG item) draft-arkko-eap-aka-kdf ís now in IETF
> > > Last Call
> > > 
> > > IPSECME
> > > - Lots of emails that I need to read (but haven't done
> > > so yet)
> > > - (not wearing AD hat) I sent my "things that need to
> > > be looked at" 
> > >   list about IKEv2bis to the mailing list; I need to check
> > > that   
> > >   they got entered in the issue tracker, too.
> > > 
> > > ISMS
> > > - It seems the discussion has largely converged; I'm
> > > waiting for
> > >   revised IDs to read and review.
> > > 
> > > KEYPROV
> > > - I sent more comments regarding PSKC; I need to read the
> > > replies
> > >   and participate in discussion.
> > > - I need to review and comment DSKPP, too.
> > >   
> > > SASL
> > > - I replied to Frank Ellermann's appeal about WG
> > > chairs' handling 
> > >   of draft-ietf-sasl-crammd5.
> > > - Waiting for charter update text from the chairs (>6
> > > months)
> > > 
> > > SYSLOG
> > > - draft-ietf-syslog-transport-tls: a revised version
> > > addressing
> > >   Chris Newman's DISCUSS should be posted in a couple
> > > of days.
> > > - draft-ietf-syslog-sign: there has been a bunch of replies
> > > to my
> > >   AD evaluation comments that I need to read and process,
> > > but I 
> > >   haven't done so yet.
> > > 
> > > TLS
> > > - (not WG item) draft-rescorla-tls-suiteb is now in IETF
> > > Last Call.
> > > - (not WG item) draft-hajjeh-tls-identity-protection: IESG
> > > reviewed
> > >   this independent submission to the RFC Editor, and
> > > recommended
> > >   not publishing it.
> > > 
> > > OTHER DOCUMENTS
> > > 
> > > - draft-ietf-capwap-*: I've been working with Pat and
> > > others,
> > >   and I think we're done (except that agreed text needs
> > > to be   
> > >   edited in, and some editorial nits fixed).
> > > - draft-ietf-avt-rtcpssm: no news; waiting for Joerg to
> > > explore
> > >   "feedback debug" messages.
> > > - draft-santesson-digestbind: I read this and sent comments
> > > to
> > >   Stefan.
> > > - PKCS #1/RFC 3447 update: waiting for James Randall to
> > > post an
> > >   update including the various errata.
> > > - draft-mattsson-srtp-store-and-forward: I've promised
> > > to read 
> > >   this and send comments, but haven't done so yet.
> > > - draft-ietf-mpls-mpls-and-gmpls-security-framework:
> > > I've promised 
> > >   to read this once there's a new version.
> > > - "Security roadmap for routing protocols":
> > > I've promised to read
> > >   and comment this once Gregory sends something.
> > >   
> > > DISCUSSES (active -- something happened within last month)
> > > 
> > > - draft-ietf-capwap-protocol-binding-ieee80211: text
> > > agreed,
> > >   waiting for authors to submit a revised ID [since
> > > 2008-09-26]
> > > - draft-ietf-lemonade-msgevent: waiting for authors to
> > > submit
> > >   a revised ID [since 2008-09-08]
> > > - draft-ietf-mip6-whyauthdataoption: waiting for authors to
> > > submit 
> > >   a revised ID [since 2008-09-08]
> > > - draft-ietf-mipshop-mstp-solution: the authors have
> > > replied to  
> > >   my comments; I need to read the replies [since
> > > 2008-09-26]
> > > - draft-ietf-nfsv4-rpcsec-gss-v2: waiting for authors to
> > >   reply to my comments [since 2008-09-25]
> > > - draft-ietf-sieve-refuse-reject: waiting for authors to
> > > reply
> > >   to my comments [since 2008-09-11]
> > > - draft-ietf-sipping-race-examples: waiting for document
> > > shepherd
> > >   or Jon to comment the "Updates" issue [since
> > > 2008-09-26]
> > > - draft-ietf-v6ops-addcon: the changes in version -10 were
> > > sent
> > >   to 6MAN WG for review; I'll clear once this has
> > > happened 
> > >   [expected to happen on 2008-10-01]
> > > - draft-mraihi-inch-thraud: version -07 addressed almost
> > > all of 
> > >   my comments; waiting for authors to send RFC Editor Note
> > > text
> > >   fixing the IANA issue, too [since 2008-09-02]
> > > 
> > > DISCUSSES (stalled -- I haven't heard anything from the
> > > authors 
> > > or document shepherd for over one month)
> > > 
> > > - draft-cain-post-inch-phishingextns: waiting for authors
> > > to reply 
> > >   to my comments or submit a revised ID [since 2008-08-28]
> > > - draft-cam-winget-eap-fast-provisioning: waiting for
> > > authors to 
> > >   reply to my comments or submit a revised ID [since
> > > 2008-08-28]
> > > - draft-hautakorpi-sipping-uri-list-handling-refused: text
> > > agreed, 
> > >   waiting for authors to submit a revised ID [since
> > > 2008-07-03]
> > > - draft-ietf-enum-experiences: talked briefly with Jon
> > > Peterson 
> > >   in Dublin -- waiting to hear more from the authors and/or
> > > Jon
> > >   [since 2008-07-31]
> > > - draft-ietf-pce-pcep: new version -15 addressed some
> > > comments from
> > >   other ADs; some discussions about my comments has
> > > occured;
> > >   waiting for proposed text or revised ID [since
> > > 2008-06-16]
> > > - draft-ietf-pwe3-pw-atm-mib: waiting for authors to reply
> > > to
> > >   my comments or submit a revised ID [since 2008-07-02]
> > > - draft-zhou-emu-fast-gtc: changes probably agreed, waiting
> > > for authors
> > >   to submit a revised ID to see exact text [since
> > > 2008-08-28]
> > > 
> > > DISCUSSES (presumed dead -- I haven't heard anything
> > > from the authors
> > > or document shepherd for over three months)
> > > 
> > > - draft-ietf-bfd-base: waiting for authors to reply to my 
> > >   comments or submit a revised ID [since 2008-06-05]
> > > - draft-ietf-bfd-multihop: waiting for authors to reply to 
> > >   my comments or submit a revised ID [since 2008-06-05]
> > > - draft-ietf-bfd-v4v6-1hop: waiting for authors to reply to
> > > 
> > >   my comments or submit a revised ID [since 2008-06-05]
> > > - draft-ietf-shim6-proto: waiting for Erik to propose
> > > something 
> > >   to solve IPsec interaction issue [since 2008-06-18]
> > > - draft-ietf-simple-imdn: waiting for authors to reply to
> > > my 
> > >   comments or submit a revised ID [since 2008-05-14]
> > > - draft-ietf-sipping-sbc-funcs: new version (-06) addressed
> > >   all comments except one; text agreed for the remaining
> > > one,
> > >   waiting for RFC editor note or revised ID [since
> > > 2008-06-17]
> > > - draft-ietf-tsvwg-emergency-rsvp: this document has large 
> > >   number of discusses/abstains; waiting for Magnus to
> > > figure
> > >   out next steps [since 2008-06-03]
> > > 
> > > --end--
> > > _______________________________________________
> > > saag mailing list
> > > [e-mail]
> > > https://www.ietf.org/mailman/listinfo/saag
> > 
> > 
> > 
> > 
> > 
> _______________________________________________
> saag mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/saag

_______________________________________________
saag mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/saag