Re: [Slim] Stephen Farrell's Block on charter-ietf-slim-00-06: (with BLOCK)

Barry said:

"What I think is not agreed upon is whether this work needs to be gated
on an overall privacy analysis of adding information (in general) to
SIP calls."

[BA] Brian Rosen has made the point that (at a high level) we already know
what that security/privacy analysis is going to say, because including
language information in SDP or SIP headers does not change the fundamental
security properties of SIP.  So gating the work on that analysis is like
hoping that your next viewing of The Shining will have a more pleasant
ending.

The security facilities of SIP are well understood and their properties
have been analyzed before.  We have SIP over TLS, which is hbh,
 (undeployed) S/MIME, which can protect message bodies e2e, and RFC
4474bis.

We also more or less understand what a privacy analysis would say:  if the
user wants to provide information to enable better routing of their call
(e.g. language preference), this information cannot be kept secret from the
proxies that do the routing.

On Thu, Oct 1, 2015 at 12:03 PM, Barry Leiba <barryleiba@computer.org>
wrote:

> (It doesn't help that Stephen got removed from the CC list on this
> part of the thread, and it might be best to put the IESG back onto it
> also; I'm doing both here.)
>
> > Is there anyone against the view that this discussion can take place when
> > composing the security chapters, and does not influence the charter?
> >
> > The discussion is good, and material can be collected for the security
> > chapters.
>
> Thanks, Gunnar; this is where my mind is on the point.  Stephen,
> though, seems to have a position that this work shouldn't proceed
> until a broader analysis is done.  I'm very much not convinced of
> that, and I'd like more from Stephen on that point.
>
> I think everyone agrees that whatever documents are produced by this
> working group have to consider the privacy issues raised by language
> labelling.  I don't think we need that explicitly called out in the
> charter ("The working group must eat its vegetables."), but I'm happy
> to have text in there if there's some specific text proposed.
>
> What I think is not agreed upon is whether this work needs to be gated
> on an overall privacy analysis of adding information (in general) to
> SIP calls.
>
> Let's please continue the discussion on that *with* Stephen and the
> IESG in the loop.
>
> Barry
>
> _______________________________________________
> SLIM mailing list
> SLIM@ietf.org
> https://www.ietf.org/mailman/listinfo/slim
>