Subject: [Nea] Next steps for NEA

From: Steve Hanna <[email-masked]>
Date: Fri, 7 Apr 2006 10:16:54 -0400

Although the NEA BOF did not end with consensus on a
charter, there were several clear messages:

1) This is important work. Many people spoke about this.

2) We need clear interoperability goals.

3) We should standardize at least a minimal set of
   posture attributes to allow any client and server
   to have some interoperability.

4) PA and PB should be transport independent.

5) We should not spend too much time on requirements.

Based on these messages, I would like to suggest the
action plan below. Comments are welcome on the messages
and action plan.

Thanks,

Steve

------

Proposed NEA Action Plan

1) Discuss, revise, and agree on this action plan.

2) Work on these items in parallel:

 A) Draft requirements for PA, PB, and PTT

 B) Revise proposed NEA charter to focus on
    transport-independent PA and PB and
    requirements for PTT

 C) Revise NEA problem statement to focus on
    transport-independent PA and PB and
    requirements for PTT

 D) Draft NEA security analysis

3) When we have all or most of those items in
   good shape, schedule another NEA BOF or ask
   for a WG to be created

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea

---

From: "Sahita, Ravi" <[email-masked]>
Date: Fri, 7 Apr 2006 09:19:22 -0700

Steve,

Can you expand on the security analysis item in the action plan - My
opinion is that security requirements/considerations would be part of
PA, PB, PTT etc. 

Additionally, after the requirements, there should also be a draft that
covers some canonical architecture (informational draft if required)
that should cover terminology also.

I would like to brainstorm on PA and PB requirement draft and will be
glad to work with others who are interested to draft these.

Cheers,
Ravi

-----Original Message-----
From: Steve Hanna [mailto:[email-masked]] 
Sent: Friday, April 07, 2006 7:17 AM
To: [email-masked]
Subject: [Nea] Next steps for NEA

Although the NEA BOF did not end with consensus on a charter, there were
several clear messages:

Based on these messages, I would like to suggest the action plan below.
Comments are welcome on the messages and action plan.

Thanks,

Steve

------

Proposed NEA Action Plan

---

From: Steve Hanna <[email-masked]>
Date: Fri, 7 Apr 2006 14:45:21 -0400

Ravi,

Security requirements will definitely need to be part of the requirements
for PA, PB, and PTT. And security measures that address those requirements
will need to be part of any follow-on protocol specifications. But what
I had in mind with item D) below is a top-to-bottom security analysis
of the entire NEA architecture. When we did this for TNC, we found things
that would have been missed if you only considered each protocol
individually.
Maybe I should rephrase item D) as "Draft security analysis of entire NEA
system".

Hmmm, an NEA architecture. We have been trying to avoid defining a new
endpoint integrity architecture because there are too many already.
But section 6 of the problem statement already includes something very
much like an architecture and it's probably useful to preserve that
in an RFC form. Do you think it would be sufficient to refine the
problem statement and submit that for Informational?

Consider yourself signed up to work on PA and PB requirements.
Thank you! We have a lot of other people signed up also. There's
definitely strong interest in this work.

Take care,

Steve

> From: Sahita, Ravi [mailto:[email-masked]] 
> Sent: Friday, April 07, 2006 12:19 PM
> To: Steve Hanna; [email-masked]
> Subject: RE: [Nea] Next steps for NEA
> 
> Steve,
>

---

From: "Sahita, Ravi" <[email-masked]>
Date: Fri, 7 Apr 2006 17:25:09 -0700

Steve,
Yes - always helps to have the problem statement recorded in a draft. On
the architecture side, I was suggesting a canonical (or simplified)
version that explains the scope of the elements in NEA's scope. I'm ok
if this is part of the problem statement draft itself.

Glad to hear other folks are also signed up for PA/PB requirements,
Thanks,
Ravi

-----Original Message-----
From: Steve Hanna [mailto:[email-masked]] 
Sent: Friday, April 07, 2006 11:45 AM
To: Sahita, Ravi; [email-masked]
Subject: RE: [Nea] Next steps for NEA

Ravi,

Security requirements will definitely need to be part of the
requirements for PA, PB, and PTT. And security measures that address
those requirements will need to be part of any follow-on protocol
specifications. But what I had in mind with item D) below is a
top-to-bottom security analysis of the entire NEA architecture. When we
did this for TNC, we found things that would have been missed if you
only considered each protocol individually.
Maybe I should rephrase item D) as "Draft security analysis of entire
NEA system".

Hmmm, an NEA architecture. We have been trying to avoid defining a new
endpoint integrity architecture because there are too many already.
But section 6 of the problem statement already includes something very
much like an architecture and it's probably useful to preserve that in
an RFC form. Do you think it would be sufficient to refine the problem
statement and submit that for Informational?

Take care,

Steve

> Additionally, after the requirements, there should also be a draft 
> that covers some canonical architecture (informational draft if 
> required) that should cover terminology also.
> 
> Although the NEA BOF did not end with consensus on a charter, there 
> were several clear messages:
>

---

From: Steve Hanna <[email-masked]>
Date: Thu, 13 Apr 2006 17:41:53 -0400

Once the items listed under 2) are ready, we will go back to the
ADs and see if another BOF is needed or if we can go straight
to WG status. To have a BOF at the next IETF, we'd need to have
things ready by the end of May. That's ambitious but possible.

In the interest of moving forward and maintaining momentum,
I will send out a final call for feedback on the action plan.
Assuming we have agreement on that, we'll move forward:
get volunteers to draft the requirements and security analysis,
prepare a first draft and put that out for review, etc.

Thanks,

Steve

> From: Sanchez, Mauricio (ProCurve) [mailto:[email-masked]] 
> Sent: Friday, April 07, 2006 7:43 PM
> Do you have any opinions on dates these various efforts should target.
> I assume the desire is to shoot for a BoF at the next IETF.  Right?
> 
> MS 
> 
> > Although the NEA BOF did not end with consensus on a charter, 
> > there were several clear messages:
> > 
> > Based on these messages, I would like to suggest the action 
> > plan below. Comments are welcome on the messages and action plan.
> > 
> > Thanks,
> > 
> > Steve
> > 
> > ------
> > 
> > Proposed NEA Action Plan
> >