Subject: Preliminary minutes for the IPSRA WG meeting

From: Paul Hoffman / VPNC <[email-masked]>
Date: Sun, 1 Apr 2001 16:46:06 -0700

Greetings again. Here are the preliminary minutes for the IPSRA meeting
in Minneapolis. If you have any corrections to what was said or who was
saying it, please send them to me in the next few days so I can turn
the minutes (and Scott's presentation) into the IETF for the
proceedings.

Sara and I expect to start the straw poll later this week or early next
week once we get the wording down.

Preliminary IPSRA minutes
50th IETF, Minneapolis

Cochairs: Sara Bitan and Paul Hoffman
Sara led the meeting; Paul took the minutes.

WG general status
	Low traffic on mailing list
	New requirements draft came out in January
		There were no comments
	DHCP draft is waiting for IETF last call
Remote user authentication
	PIC is using EAP
	GetCert will change to use EAP
March Straw Poll
	Few votes: 7 for GetCert, 6 for PIC
	Is anyone interested???
Proposal
	Advance requirements draft to Informational
	Advance DHCP draft to Standards Track
	Abandon PIC or GetCert due to low interest
		and inability to pick between them
Current status of remote user authentication
	XAUTH, mode-cfg well-deployed, with some interopability
	Both of these have serious security considerations
	This will probably not be fixed by son-of-IKE
	"Group shared secret", other problems
Alternatives for moving forwards
	Flip a coin and work on one
	Move the problem to IPsec WG, try to work in son-of-IKE
		But that will not be allowed
	Change IPSRA charter to allow change IKE
		But that will not be allowed
	Leave things as they are, and get no protocol

Comments from the WG
Bernard Aboba
	Why it's not working:
	We don't have the right group of people
		We're not cert people
	Possibly move the work to PKIX
Marcus Leech
	We only need one solution to succeed
	Previously, vendors with proprietary VPN moved to IPsec
		Therefore we will probably see reticent vendors go with
			whatever IPSRA picks
	It will be failure if we don't pick one and make it a standard
Steve Bellovin
	He is not attached to GetCert
	Wanted to show that remote access authorization without
		changing IKE could be done
	If it goes to PKIX, we have to hold their feet to the fire to
		actually do the work
Bill Sommerfeld
	He would rather flip the coin than not do either
	Also thinks the numbers of votes are high enough to indicate
		interest
Cheryl Madson
	Too many things (the ones that need IKE changes) were thrown
		off the table
	Interop happens even without standards (hinting at XAUTH)
Dan Harkins
	The WG was doomed from the start because of the charter
	Political problems cause current lack of solution
Eric Flieshman (apologies if I spelled this wrong!)
	Customers want GetCert or PIC, not "no solution"
Magnus Nystrom
	Maybe reuse the work being done in the SACRED WG
Steve Bellovin: SACRED does not have our legacy auth constraints

Sara and Paul and Marcus put their heads together and mumbled
There will be a new straw poll with different questions on the
	WG list in the near future

Bob Moskowitz on expected revisions to GetCert
	Will go from SCEP to CMP
	Will add EAP
	Do we go with CMP or CMC?
	Will still have ASN.1 coding
	Nice feature: GetCert box can act like RA
Sara Bitan on PIC
	Currently uses EAP on a transport that looks like IKE

Scott Kelly on requirements
	Listed the changes from -02 to -03
	Much more on L2TP/IPsec
	IPSRA WG has lost focus, we should be emphasizing secure 
		aspect of access, not just remote access
	IPSRA WG has pushed the L2TP folks away
	Is the current L2TP/IPsec sufficient for us?
	Main security issues
		Transit selectors are opaque to IPsec
		Complexities of L2TP-IPsec interactions
		User auth is not done until Phase 2: biggest problem
	Our primary interest should be security: just try to
		secure the pipe
	Should allow lower security if the customer understands it

Bernard Aboba
	Using passwords to get a cert lowers security of certs
	Need to be clearer about the security issues

General feeling
	L2TP is not needed, but should not be shunned

Meeting adjourned

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Mon, 2 Apr 2001 18:08:21 -0700

At 5:55 PM -0400 4/2/01, Andrew Krywaniuk wrote:
>One thing I didn't understand was the result of the straw poll: Get Cert 7,
>PIC 6.
>
>When I look at the results of the poll in the archive (starting with
>http://www.vpnc.org/ietf-ipsra/mail-archive/msg00939.html), I only see: Get
>Cert 4, PIC 3.
>
>Were some of the votes cast offline or assumed? (e.g. that the authors of
>the draft would vote for their own proposal)

They were cast offline, to Sara. Some folks don't want to be 
associated with particular proposals. Unfortunately, the numbers of 
people who felt that way was the same as those who stated their 
preferences publicly.

--Paul Hoffman, Director
--VPN Consortium

---

From: "Andrew Krywaniuk" <[email-masked]>
Date: Mon, 2 Apr 2001 17:55:07 -0400

Andrew
-------------------------------------------
Upon closer inspection, I saw that the line
dividing black from white was in fact a shade
of grey. As I drew nearer still, the grey area
grew larger. And then I was enlightened.

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Paul
> Hoffman / VPNC
> Sent: Sunday, April 01, 2001 7:46 PM
> To: [email-masked]
> Subject: Preliminary minutes for the IPSRA WG meeting
>
>