Re: [Smart] Draft Charter For SMART Proposed RG

[Kirsty P <[e-mail]>]

Stephen,

Thank you for your comments! Great to hear you think the work here could be interesting.

I hope I can clarify what the proposed RG is about, and get your support. I can reassure you are correct in believing what our aims are - we are not trying to weaken the privacy aspect of protocols, and it is not the intention of the RG to propose modifications to IETF protocols - we want cyber defence methods to co-exist along encryption, rather than seeking to break or weaken it. Hopefully, as you say, stating this explicitly in our charter will let us investigate these real tensions and challenges without raising any hackles.

The draft charter is still up for discussion, so we can certainly change the phrase "will investigate how cyber attack defence requirements can be met in a world of encrypted data". I know you said you don't much care what words are used, but do you have any thoughts on to better say what we mean? How does something like "will investigate how cyber attack defence requirements can be met without weakening the protection afforded by encryption" sound to you?

I hope this allays your concerns, and I welcome any further input you (or others) might have.

Kirsty


________________________________
From: Smart <[e-mail]> on behalf of Stephen Farrell <[e-mail]>
Sent: 27 September 2018 21:08
To: [e-mail]
Subject: Re: [Smart] Draft Charter For SMART Proposed RG


Hiya,

I think there's work here that could be interesting, so
I'd be supportive of what I hope this RG might be about,
but I'm not quite sure...

I would be re-assured if the charter was explicit that
the putative RG is not trying to break or weaken the
security aspects of IETF protocols. I believe that that
is the case - after all the overwhelming majority of
people using the Internet, including those defending
the security of systems, really need those security
features - but given the history, the "in a world of
encrypted data" is the kind of phrase that could raise
hackles, and hackles are better not raised.

I don't much care what words would be used, so long as
it's clear that the putative RG is not setting out to
e.g. upend the IETF's BCPs on these topics.

There are real tensions and challenges created by encrypting
more and better, and in reducing uses of identifiers to be
more privacy-friendly, but IMO successfully investigating
those issues requires being explicit that one is not aiming
to weaken things like e2e security as a feature of Internet
protocols.

Cheers,
S.
This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [e-mail]