Subject: Re: [keyassure] Moving policy to a different WG

From: "Jeffrey A. Williams" <[email-masked]>
Date: Fri, 1 Oct 2010 16:27:37 -0500 (GMT-05:00)

Paul and all,

  I disagree that there is a need to remove policy from this
WG discussion as to devise a standard inhearently at some point
requires that a policy be determined or arrived at.

-----Original Message-----
>From: Paul Hoffman <[email-masked]>
>Sent: Oct 1, 2010 3:03 PM
>To: [email-masked]
>Subject: [keyassure] Moving policy to a different WG
>
>Greetings again. The issue of "host security policy" has bedeviled different IETF WGs over the past decade. It means different things to different people, and it has tended to pull WGs into areas where only a few people have strong opinions, although those people also tend to disagree with each other. This is not to say that defining policies is impossible, but it is often time-consuming and the results are not always well-understood even when they work; DKIM is a good example of this.
>
>Phill's responses today to the current charter shows that there is still a fairly wide rift between different people's views of what policy is wanted and how it should be expressed. Much of the interest in forming this WG was for a single issue that is arguably not policy: which keys and certificates, when given in-band in a security protocol, are to be used by the client.
>
>Given this rift, I propose that we change the proposed charter again and remove "policy" altogether, and that those interested in being able to express policy in the DNS, secured by DNSSEC, set up their own WG to do this. I say this as someone who will participate in that other WG because there is a piece of policy that I absolutely care about, namely "This site always uses { TLS | IPsec }, don't fall back to unprotected". I agree with Phill that such a policy should not be tied to the key or cert that is being proffered in the current work.
>
>Splitting key assurance (which most people here seem to understand) from policy (on which there is a lot of disagreement) should allow the two pieces of work to move forwards in different timeframes, with different WG leadership, even though there will be some overlap between participants, just as there is in many Security Area WGs. I assume that it would not be hard to get a "[email-masked]" mailing list to start discussions of a charter.
>
>How do others feel about this removal of policy for *this* WG?
>
>--Paul Hoffman, Director
>--VPN Consortium
>_______________________________________________
>keyassure mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/keyassure

Regards,
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 300k members/stakeholders and growing, strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827

---

From: =JeffH <[email-masked]>
Date: Fri, 01 Oct 2010 15:54:57 -0700

> [email-masked] said:
 >> From: [email-masked] [mailto:[email-masked]] On
 >> Behalf Of Zack Weinberg
 >>
 >> As a security researcher and Web browser implementor, I'm fine with
 >> splitting out policy assertions of the form "always use TLS for this site"
 >> (which
 >> are not conceptually tied to any given key).

 > Agreed.  I fully support moving this to another WG.  Depending on whether we
 > believe that there should be a all-purpose policy mechanism, or a
 > per-protocol/application one, some of this could take place in WebSec.

 >> But I don't see that it doe anyone any good to define DNS records for key
 >> fingerprints without also defining what it _means_ for a key's fingerprint
 >> to appear in the DNS. Client software has to be able to do something with
 >> that information, after all. If this WG cannot come to any consensus on the
 >> meaning of a fingerprint record, _in the absence_ of any explicit policy
 >> records, then we're not doing anything useful.

 > Agreed.  This specific question belongs here.

+1

=JeffH