Re: [Smart] Draft Charter For SMART Proposed RG

[Stephen Farrell <[e-mail]>]

Hiya,

On 28/09/18 12:22, Kirsty P wrote:
> How does something like "will investigate how cyber attack defence
> requirements can be met without weakening the protection afforded by
> encryption" sound to you?
Sounds like a good start. Maybe referring to some relevant IETF BCPs
might be useful (e.g. BCP200, BCP188) and/or the IAB statement [1] on
confidentiality) as being foundational things from which this RG wants
to build?

I think another aspect is also worth a mention - to improve privacy,
we'll also often want to deal with identifiers differently from how
we've done that in the past, e.g. to use identifiers that are less
personally identifying or less stable or to remove them entirely
from some protocols or just not put them in new protocols. And that
creates a different tension between privacy and defence.

As examples - in the case of mail there was a discussion a few years
ago on eliding IP addresses from Received: header fields but even
though that's already done by some large mail service providers,
the idea of standardising that freaked out some anti-spam folks:-)
In the case of DHCP, we ended up developing a privacy-friendly profile
so that e.g. clients don't spew their hostname all the time (RFC7844).

So I'd also suggest adding a bit of text ack'ing that such non-crypto
privacy goals are as valid in the trade space as are desires to know
who're the possible guilty parties for some misbehaviour. And in some
cases the privacy goals may well win out over the defence goal to
know who's doing what.

Note that I'm not suggesting that everyone involved in the putative
RG has to have inhaled all the same fumes as me, but given the tensions
in this space and the history, I think it'd be good if this RG has
explicitly bought in to IETF BCPs, so that anyone who's angling to
modify those knows that that ought be done in/by the IETF and not
via RG activity.

Cheers,
S.

[1]
https://www.iab.org/documents/correspondence-reports-documents/2014-2/iab-statement-on-internet-confidentiality/

PS: I'm deliberately not suggesting specific wording because I think
it's likely better if the words used come from yourself and other folks
proposing this.