Subject: [keyassure] Moving policy to a different WG

From: Paul Hoffman <[email-masked]>
Date: Fri, 1 Oct 2010 13:03:05 -0700

Greetings again. The issue of "host security policy" has bedeviled different IETF WGs over the past decade. It means different things to different people, and it has tended to pull WGs into areas where only a few people have strong opinions, although those people also tend to disagree with each other. This is not to say that defining policies is impossible, but it is often time-consuming and the results are not always well-understood even when they work; DKIM is a good example of this.

Phill's responses today to the current charter shows that there is still a fairly wide rift between different people's views of what policy is wanted and how it should be expressed. Much of the interest in forming this WG was for a single issue that is arguably not policy: which keys and certificates, when given in-band in a security protocol, are to be used by the client.

Given this rift, I propose that we change the proposed charter again and remove "policy" altogether, and that those interested in being able to express policy in the DNS, secured by DNSSEC, set up their own WG to do this. I say this as someone who will participate in that other WG because there is a piece of policy that I absolutely care about, namely "This site always uses { TLS | IPsec }, don't fall back to unprotected". I agree with Phill that such a policy should not be tied to the key or cert that is being proffered in the current work.

Splitting key assurance (which most people here seem to understand) from policy (on which there is a lot of disagreement) should allow the two pieces of work to move forwards in different timeframes, with different WG leadership, even though there will be some overlap between participants, just as there is in many Security Area WGs. I assume that it would not be hard to get a "[email-masked]" mailing list to start discussions of a charter.

How do others feel about this removal of policy for *this* WG?

--Paul Hoffman, Director
--VPN Consortium

---

From: Jakob Schlyter <[email-masked]>
Date: Fri, 1 Oct 2010 22:06:19 +0200

> How do others feel about this removal of policy for *this* WG?

I think this would be a reasonable way forward.

	jakob

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 1 Oct 2010 16:06:27 -0400

> How do others feel about this removal of policy for *this* WG?

It seems to me that if we want to get any work done, it would be a good idea.

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: Matt McCutchen <[email-masked]>
Date: Fri, 01 Oct 2010 16:36:30 -0400

On Fri, 2010-10-01 at 13:03 -0700, Paul Hoffman wrote:
> Phill's responses today to the current charter shows that there is
> still a fairly wide rift between different people's views of what
> policy is wanted and how it should be expressed. Much of the interest
> in forming this WG was for a single issue that is arguably not policy:
> which keys and certificates, when given in-band in a security
> protocol, are to be used by the client.
> 
> Given this rift, I propose that we change the proposed charter again
> and remove "policy" altogether, and that those interested in being
> able to express policy in the DNS, secured by DNSSEC, set up their own
> WG to do this. I say this as someone who will participate in that
> other WG because there is a piece of policy that I absolutely care
> about, namely "This site always uses { TLS | IPsec }, don't fall back
> to unprotected". I agree with Phill that such a policy should not be
> tied to the key or cert that is being proffered in the current work.

It seems clear that mandatory use of TLS/IPSEC is outside the scope of
DNSSEC key assurance per se.  The disagreement is over the possible
exclusivity of DNSSEC key assurance.  IIUC, you are including it in the
"single issue that is arguably not policy: which keys and certificates,
when given in-band in a security protocol, are to be used by the
client", while Phill argues that it constitutes policy and should be
treated along with other policy:

http://www.ietf.org/mail-archive/web/pkix/current/msg28410.html

I am happy either way, as long as the exclusivity gets standardized
without undue delay.  While the improved security of exclusive DNSSEC
key assurance is arguably the most important benefit of what we are
doing, Phill has pointed out that some admins might want to take
advantage of the convenience of DNSSEC key assurance without committing
to using it exclusively, so I think the exclusivity should be optional
(i.e., a flag).

-- 
Matt

---

From: "Richard L. Barnes" <[email-masked]>
Date: Fri, 1 Oct 2010 17:19:49 -0400

I agree with this proposal.
--Richard

On Oct 1, 2010, at 4:06 PM, Jakob Schlyter wrote:

> _______________________________________________
> keyassure mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/keyassure

---

From: Warren Kumari <[email-masked]>
Date: Fri, 1 Oct 2010 19:45:50 -0400

> It seems to me that if we want to get any work done, it would be a good idea.

Just in case it wasn't obvious from my earlier mails, so do I.... 

W