Re: [Tigress] post-118 direction

On Mon, Nov 27, 2023 at 5:04 PM Yogesh Karandikar <ykarandikar=
40apple.com@dmarc.ietf.org> wrote:

> Replies  inline.
>
>
> Thanks,
> Yogesh
>
> On Nov 27, 2023, at 10:35 AM, Watson Ladd <watsonbladd@gmail.com> wrote:
>
> On Thu, Nov 23, 2023 at 9:01 AM Leif Johansson <leifj@sunet.se> wrote:
>
>
>
> Folks,
>
> The chairs have conferred and we recognize the following consensus:
>
> 1. assume that the invite channel is secure and adjust proposals
> accordingly - at some point we need to identify what (if any) consensus
> exists within the WG to pursue a solution
>
> I agree with this direction.

>
>
> I thought the orthogonal option (#3) in the poll meant:
>
> 3.1 assume the invite channel can be *non-secure* and proceed with a
> solution.
>
> 3.2 Orthogonal work to add security on top of a non-secure channel
> (second-factor or other methods).
>
>
> If we assume invite_channel to be secure (option #1 in the poll), I’m not
> sure why orthogonal work would be required.
>
>
> What's the meaning of secure here? I think based on what EKR and
> others have said on the list this makes sense to pursue first as most
> channels being proposed  are secure in the relevant sense
>
>
> In this context, secure == “invitation is delivered to only the recipient
> selected by share initiator”.
>
> Hence non_secure would mean that someone else besides the selected
> recipient has access to the invitation.
>
>
>
> 2. address invitation channels that are not fully secure in a way that
> is orthogonal to the solutions the WG decides to pursue for the core
> protocol.
>
> This, I suspect, would be a useful work item that could be pursued outside
of this working group as it is generally applicable and I don't think is
covered by our charter and I don't think it would be the best use of
resources to narrowly tailor such a solution to the tigress use case.

>
> I suspect that orthogonality is tricky to actually achieve here.
>
>
> Please respond with your support and/or disagreement. If you disagree
> please provide whatever insights you are able to.
>
> Also please indicate your willingness to eventually implement and/or
> support the results of (1) and (2).
>
>        Best R
>        Leif & Prachi
>
> --
> Tigress mailing list
> Tigress@ietf.org
> https://www.ietf.org/mailman/listinfo/tigress
>
>
>
>
> --
> Astra mortemque praestare gradatim
>
> --
> Tigress mailing list
> Tigress@ietf.org
> https://www.ietf.org/mailman/listinfo/tigress
>
>
> --
> Tigress mailing list
> Tigress@ietf.org
> https://www.ietf.org/mailman/listinfo/tigress
>