[spring] Benjamin Kaduk's Block on charter-ietf-spring-01-01: (with BLOCK)

[Benjamin Kaduk <[e-mail]>]

Benjamin Kaduk has entered the following ballot position for
charter-ietf-spring-01-01: Block

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)



The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-spring/



----------------------------------------------------------------------
BLOCK:
----------------------------------------------------------------------

This proposed charter has minimal text on security concerns, asserting that
the scope is limited to a single trust domain and only applying a weak
requirement to "strive to identify and address" security considerations
brought up by its technologies.

The text concerning a single trust domain seems to implicitly assume that
there is thus no need for cryptographic assurance of the integrity and/or
authenticity of origin for route information, a position whose accuracy
remains unclear to me.

A commitment to "strive" to do something is hardly any commitment at all,
in that failing to do that thing remains consistent with the commitment.

Additionally, the current charter text includes some security-related
items, noting that "there are a number of serious security concerns with
source routing at the IP layer", committing to define the SRv6 header so
that blind attacks are never possible (and with options to provide
additional security in some networks), and committing to provide a security
analysis for each protocol being developed.  Has anything changed in the
intervening five years to render these items unnecessary?  I don't see any
justification for why these commitments are being abandoned.