Subject: [Privacy-pass] Privacy Pass BoF agenda is posted

From: Ben Schwartz <[email-masked]>
Date: Mon, 16 Mar 2020 19:58:52 -0400

Privacy Pass Participants,

On behalf of the Privacy Pass BoF chairs, I'd like to announce our first
draft agenda [1].  If you would like any changes to the agenda, please let
us know as early as possible.  As usual, slides for the presentations will
be available in the datatracker before the session.

One important agenda item is discussion of the proposed working group
charter, which is currently under development [2].  You are welcome to
discuss the text on this mailing list, and propose changes here or on
Github.

For the BoF, we will need volunteers to take minutes in the Etherpad.
Please contact the chairs if you are able to volunteer.  We do not expect
to need a jabber scribe, and will send further instructions on how to
participate in the BoF when those details are determined.

As this is a remote-only BoF, we ask for your patience as we adjust our
process to this new environment, and we apologize in advance for any
technical problems.

Sincerely,
Ben Schwartz, for the chairs

[1]
https://datatracker.ietf.org/meeting/107/materials/agenda-107-privacypass
[2] https://github.com/alxdavids/privacy-pass-ietf/blob/master/CHARTER.md

---

From: Ben Schwartz <[email-masked]>
Date: Wed, 18 Mar 2020 09:45:56 -0400

Correction: Based on the latest remote session instructions, we _will_ need
a Jabber scribe.  We also still need a minute-taker, so please notify us if
you can help to take minutes.  (The meeting cannot start until we have
these volunteers.)

I would also strongly encourage all participants to review the remote
participation guide [1], and to join the meeting at least 5 minutes early
to debug their setup.  Even experienced Webex users should take some time
to familiarize themselves with the participation guidelines, which include
processes that go beyond basic Webex functionality.

See you next week,
Ben Schwartz

[1] https://www.ietf.org/how/meetings/107/session-participant-guide/

---

From: Joseph Salowey <[email-masked]>
Date: Mon, 23 Mar 2020 21:40:27 -0700

Hi Folks,

We do need some volunteers for Jabber scribe and note taker.  As a note
taker you do not have to catch all the discussion, just the main decision
points and action items.  In the meantime, I have some questions on the
proposed charter
<https://github.com/alxdavids/privacy-pass-ietf/blob/master/CHARTER.md>:

1. Do you expect to complete the architecture document before the protocol
document or should they progress at the same time?  Would the publication
of the HTTP document follow these?

2. For the HTTP document, would this include discussion of integration with
OAUTH as a web authorization protocol?

3. Have there been any other proposals in this space?

4. Instead of " Analyze mechanisms for tracking via public key and
expectations placed on server." would it be better to say:

"Define expectations for the server to prevent tracking, such as via public
key." ?

Thanks,

Joe

On Wed, Mar 18, 2020 at 6:47 AM Ben Schwartz <bemasc=
[email-masked]> wrote:

> Correction: Based on the latest remote session instructions, we _will_
> need a Jabber scribe.  We also still need a minute-taker, so please notify
> us if you can help to take minutes.  (The meeting cannot start until we
> have these volunteers.)
>
>> charter, which is currently under development [2]..  You are welcome to
> --
> Privacy-pass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/privacy-pass
>

---

From: Sofía Celi <[email-masked]>
Date: Tue, 24 Mar 2020 01:56:54 -0500

Hi, Joe!

I can volunteer for note taker ;)

Thanks!

On 3/23/20 11:40 PM, Joseph Salowey wrote:
> taker you do not have to catch all the discussion, just the main
> decision points and action items.  In the meantime, I have some
> questions on the proposed charter
> 1. Do you expect to complete the architecture document before the
> protocol document or should they progress at the same time?  Would the
> publication of the HTTP document follow these? 
> 
> 2. For the HTTP document, would this include discussion of integration
> with OAUTH as a web authorization protocol? 
> 
> "Define expectations for the server to prevent tracking, such as via
> public key." ?
> 
> Thanks,
> 
> Joe
> 
> 
> 
> 
> On Wed, Mar 18, 2020 at 6:47 AM Ben Schwartz
> <bemasc=[email-masked]
> <mailto:[email-masked]>> wrote:
> 
>     Correction: Based on the latest remote session instructions, we
>     _will_ need a Jabber scribe.  We also still need a minute-taker, so
>     please notify us if you can help to take minutes.  (The meeting
>     cannot start until we have these volunteers.)
> 
>     I would also strongly encourage all participants to review the
>     remote participation guide [1], and to join the meeting at least 5
>     minutes early to debug their setup.  Even experienced Webex users
>     should take some time to familiarize themselves with the
>     participation guidelines, which include processes that go beyond
>     basic Webex functionality.
> 
>     See you next week,
>     Ben Schwartz
> 
>     On Mon, Mar 16, 2020 at 7:58 PM Ben Schwartz <[email-masked]
>     <mailto:[email-masked]>> wrote:
> 
>         On behalf of the Privacy Pass BoF chairs, I'd like to announce
>         our first draft agenda [1].  If you would like any changes to
>         the agenda, please let us know as early as possible.  As usual,
>         slides for the presentations will be available in the
>         datatracker before the session.
> 
>         One important agenda item is discussion of the proposed working
>         group charter, which is currently under development [2]..  You
>         are welcome to discuss the text on this mailing list, and
>         propose changes here or on Github.
> 
>         For the BoF, we will need volunteers to take minutes in the
>         Etherpad.  Please contact the chairs if you are able to
>         volunteer.  We do not expect to need a jabber scribe, and will
>         send further instructions on how to participate in the BoF when
>         those details are determined.
> 
>         As this is a remote-only BoF, we ask for your patience as we
>         adjust our process to this new environment, and we apologize in
>         advance for any technical problems.
> 
>         Sincerely,
>         [1] https://datatracker.ietf.org/meeting/107/materials/agenda-107-privacypass
>     [email-masked] <mailto:[email-masked]>

-- 
Sofía Celi
@claucece
Cryptographic research and implementation at many places
FAB9 3EDC 7CDD 1198 DCFD  4558 91BB 6B45 6F44 2D02

---

From: Alex Davidson <[email-masked]>
Date: Tue, 24 Mar 2020 12:03:33 +0000

Hi Joe,

>> publication of the HTTP document follow these? 

Currently we’re developing the protocol document and the architecture at the same time. However I would actually expect that the protocol document would be finished before the architecture document, as the protocol document is really just laying out the protocol specification between a client and a server. The architecture document currently expands that framework to the wider setting that the protocol will actually be used in. The HTTP document should then follow both of these, yes.

>> with OAUTH as a web authorization protocol? 

This is not something that we have yet considered in the document. However, if we were to include this sort of discussion, this would be the place that it would go. If integration with OAUTH for providing specific trust attestation is something that the community thinks would be valuable, then I can’t see a problem incorporating it.

>> 3. Have there been any other proposals in this space?

There are proposals that use slightly different cryptographic functionality to achieve similar results, such as: https://engineering.fb.com/security/partially-blind-signatures/ <https://engineering.fb.com/security/partially-blind-signatures/>. However, we can also just view this as an extension of the Privacy Pass framework. To the best of my knowledge, I’m not aware of competing protocols that offer similar cryptographic guarantees, although this may also be because the underlying cryptographic functionality is relatively new to the standardisation process (https://datatracker.ietf.org/doc/draft-irtf-cfrg-voprf/ <https://datatracker.ietf.org/doc/draft-irtf-cfrg-voprf/>). There is some academic work on privacy-preserving allow/deny-listing that seeks to solve a similar problem but I don’t think this has seen wide-scale deployment.

>> public key.” ?

Yes I think that is a better wording, we can also be more general and replace public key with “key management”, or something similar. We discuss these possibilities in the architecture document.

Thanks,
Alex

> On 24 Mar 2020, at 06:56, Sofía Celi <[email-masked]> wrote:
> 
> Hi, Joe!
> 
>> <https://github.com/alxdavids/privacy-pass-ietf/blob/master/CHARTER.md <https://github.com/alxdavids/privacy-pass-ietf/blob/master/CHARTER.md>>:
>> 
>> <mailto:[email-masked] <mailto:[email-masked]>>> wrote:
>> 
>>    [1] https://www.ietf.org/how/meetings/107/session-participant-guide/ <https://www.ietf.org/how/meetings/107/session-participant-guide/>
>> 
>>    On Mon, Mar 16, 2020 at 7:58 PM Ben Schwartz <[email-masked] <mailto:[email-masked]>
>>    <mailto:[email-masked] <mailto:[email-masked]>>> wrote:
>> 
>>        [1] https://datatracker.ietf.org/meeting/107/materials/agenda-107-privacypass <https://datatracker.ietf.org/meeting/107/materials/agenda-107-privacypass>
>>        [2] https://github.com/alxdavids/privacy-pass-ietf/blob/master/CHARTER.md <https://github.com/alxdavids/privacy-pass-ietf/blob/master/CHARTER.md>
>> 
>>    -- 
>>    [email-masked] <mailto:[email-masked]> <mailto:[email-masked] <mailto:[email-masked]>>
>>    https://www.ietf.org/mailman/listinfo/privacy-pass <https://www.ietf.org/mailman/listinfo/privacy-pass>
>> 
>> 
> 
> -- 
> Sofía Celi
> @claucece
> https://www.ietf.org/mailman/listinfo/privacy-pass <https://www.ietf.org/mailman/listinfo/privacy-pass>