Subject: [Geopriv] the toolbox requirement

From: Andrew Newton <[email-masked]>
Date: Wed, 14 Mar 2007 06:23:27 -0400

It has been stated, or rather suggested, on this list that we are  
spending far too much time questioning the use of location signing  
when our job is to supply a set of tools from which regulators,  
operators, etc. may pick and choose.  Certainly, IETF'ers do not  
think like policy wonks or average end users, so this is not an  
unreasonable position.  In fact, other working groups have expressly  
used this model.

As the discussion on location signing has continued, two alternatives  
have developed: 1) the use of channel security in L-by-R  
dereferencing, and 2) the use of channel security in the signaling  
and the associated accountability.  As I've noted, the second is  
under active discussion by NENA and will be the topic of their  
meeting this Thursday (tomorrow).

My question is this: if we are to offer a toolbox, shouldn't these  
alternative also be part of that toolbox?

-andy

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: "Dawson, Martin" <[email-masked]>
Date: Wed, 14 Mar 2007 05:50:12 -0500

As I just mentioned in a post to Hannes, I don't think these are necessarily the equivalent of "location signing" as I've attempted to characterize it - particularly if the idea is to eliminate a common/independent CA.
 
Having said that - I certainly think both mechanisms are good things to have in the toolbox.
 
I'm primarily interested in the device-LIS interface as opposed to the VoIP signaling and media channels (I'm interpreting item 2 as referring to that). This is an application specific conveyance consideration. Neverhteless, I think channel security for that is also a good option to have available.
 
Cheer,
Martin

________________________________

From: Andrew Newton [mailto:[email-masked]]
Sent: Wed 3/14/2007 9:23 PM
To: GEOPRIV WG
Subject: [Geopriv] the toolbox requirement

-andy

------------------------------------------------------------------------------------------------
This message is for the designated recipient only and may
contain privileged, proprietary, or otherwise private information.  
If you have received it in error, please notify the sender
immediately and delete the original.  Any unauthorized use of
this email is prohibited.
------------------------------------------------------------------------------------------------
[mf2]

---

From: Andrew Newton <[email-masked]>
Date: Wed, 14 Mar 2007 07:25:45 -0400

On Mar 14, 2007, at 6:50 AM, Dawson, Martin wrote:

> As I just mentioned in a post to Hannes, I don't think these are  
> necessarily the equivalent of "location signing" as I've attempted  
> to characterize it - particularly if the idea is to eliminate a  
> common/independent CA.
>
> I'm primarily interested in the device-LIS interface as opposed to  
> the VoIP signaling and media channels (I'm interpreting item 2 as  
> referring to that). This is an application specific conveyance  
> consideration. Neverhteless, I think channel security for that is  
> also a good option to have available.

You are right, I'm mixing things up here.  The alternatives are not  
location singing themselves, they are alternative solutions for  
location spoofing.

As I said earlier, to progress this work we'll need to produce a  
threats analysis draft of some sort.  The security police of the IETF  
won't let us pass go without one.  And because they hate background  
reading, following links, or otherwise noting references (recent  
personal experience talking here), the draft would need to be fairly  
comprehensive regarding the high level requirement of location  
spoofing, the discussed solution space, the motivating use case(s),  
and the threats.

Comments, concerns?  Am I off base here?

-andy