Subject: OpenPGP Minutes / Quick Summary

From: Derek Atkins <[email-masked]>
Date: Wed, 12 Jul 2006 18:16:45 -0400

OpenPGP
TUESDAY, July 11, 2006
1850-1950 Afternoon Session IV

Ten people showed up for the meeting.  Only one person was am
implementor, and that was in the past (he's not an OpenPGP implementor
anymore).

2440bis has been submitted to Sam and he will review it and act on it
in two weeks.  He asked if we really still have enough interest to
remain a working group.  In particular do we have 10 reviewers working
on the draft.  The Chair was tasked with asking the mailing list and
seeing how many reviewers we really have.  If we do not have
sufficient quorum then Sam will shut us down and ask that any future
work be submitted as individual drafts (including taking 2440bis(ter?)
to Draft Standard).

Thomas Roessler gave a history of the Multiple Signature Draft.  It's
an extension to RFC1847 to allow the "signature" portion of the
message to be a "multipart/mixed" and have a set of signatures on the
signed data instead of just a single signature.  This signature set
could be a combination of OpenPGP and e.g. S/MIME signatures.

An interop grilloff was proposed to start around October, 2006 and
last about six months to take 2440bis to DRAFT, but we need people
interested in the work to take it forward, be editors and reviewers,
etc.  PGP Corp may be willing to host a meeting if there is call and
interest, and if the work cannot be done online.

The OpenPGP Header work is on hold due to lack of time.  It's stuck
on an ABNF definition.

New work proposed on the list: PFS, Deniable Authentication, V5 Keys,
and Alternate Ciphers.  Nobody in the room seemed interested.  Charter
and Milestone updates have been put on hold pending feedback that the
working group is still viable.

-derek
-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Ian G <[email-masked]>
Date: Fri, 14 Jul 2006 16:02:42 +0200

> 2440bis has been submitted to Sam and he will review it and act on it

Sorry, who is Sam?

> work be submitted as individual drafts (including taking 2440bis(ter?)

Does he mean, 10 people on the mailing list
that comment on the draft?  That should be
easy to show.

I can understand there not being more than
10 people showing up to the meeting.  It's
very expensive to attend those things, and
this has been going on for a decade or so.

There are probably 10 implementations out
there...  Of the implementations I know:

Gpg, PGP Inc,
Cryptix, epointsystems, hushmail

(Thanks for the other comments, too).

iang

---

From: Sam Hartman <[email-masked]>
Date: Fri, 14 Jul 2006 10:12:59 -0400

>>>>> "Ian" == Ian G <[email-masked]> writes:

    Ian> Derek Atkins wrote:
    >> OpenPGP TUESDAY, July 11, 2006 1850-1950 Afternoon Session IV
    >> implementor, and that was in the past (he's not an OpenPGP
    >> implementor anymore).  2440bis has been submitted to Sam and he
    >> will review it and act on it

    Ian> Sorry, who is Sam?

Sam Hartman, the IESG member responsible for openpgp.

---

From: "Brian G. Peterson" <[email-masked]>
Date: Sat, 15 Jul 2006 08:40:45 -0500

On Saturday 15 July 2006 08:12, Derek Atkins wrote:
> He means 10 people on the mailing list that comment on the
> drafts.  Basically, the question is:  how many people do we
> have reading and commenting on drafts.  Even a comment "I have
> read this draft and see nothing wrong with it" counts.  But
> he wants to know that we have at least 10 people willing to
> do that in order to keep moving forward.

I think we have more than 10 people who regularly comment on changes to 
the draft.  A quick review of the mailing list archive should validate 
that, but there seem to be more than 10 names that I recognize commenting 
on 2440bis.

(and count me as one of them ;)

Regards,

   - Brian

---

From: Cat Okita <[email-masked]>
Date: Sat, 15 Jul 2006 10:32:18 -0400 (EDT)

>> do that in order to keep moving forward.

You can certainly count me in the lot of folks that are reading and
saying nothing (in the 'silence implies consent' manner).

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."

---

From: Derek Atkins <[email-masked]>
Date: Sat, 15 Jul 2006 09:12:10 -0400

> this has been going on for a decade or so.

Yeah, I understand.

> there...  Of the implementations I know:
[snip]

I'm not sure that the number of implementations necessarily maps
to the number of people who are reviewing the drafts.   It SHOULD
map, but doesn't necessarily map.

> (Thanks for the other comments, too).

And thank you for your involvement.

-derek

---

From: Ian G <[email-masked]>
Date: Sat, 15 Jul 2006 15:47:18 +0200

> do that in order to keep moving forward.

Oh, I see.  Easily.  See, there are many aspects
to the draft, and many people don't comment on
all the stuff.  I for example will comment on the
cleartext signature stuff because it is critical
to my work but I won't be so easily tempted to
comment on the arcania of the key id extensions,
because I strip the keys down to minimum in my
app.

< http://iang.org/papers/ricardian_contract.html >

Whereas someone like Hal (just picking randomly here)
is more interested in the deeper crypto and security
puzzles within.  E.g., Hal was very involved in that
PGP Inc announcement last year of a security weakness,
which was great work, but to me was outside scope.

I suppose we might not see 10 people in any one
debate.  In the sum of all debates, there are in
excess of 10 people.

Also, frankly, I will say that one of the things
that slows me down from getting "vocally interested"
in it is that it has gone on too long - I bite my
toungue because more debate is more slow.

I'd rather the thing moved into draft status
*now* or preferably 6 years ago than argue about
something of marginal importance.  My silence
should not be seen as lack of support but support
for forward movement :)

I guess I disagree with the question then.  There
are more than 10 people here, but in my eyes, there
may be less than 10 "reviewers" and that is good,
because the time for review is over.

What can we do to make it ID?  I don't want more
review, I approve personally as it is, flaws and
all.

All just IMHO, not meant to represent anyone else's
opinions.

> map, but doesn't necessarily map.

There is always a group that "free-ride" and
don't participate in the writing of the doc.
That's ok, they participate in other ways by
spreading the standard, and they accept the
results they are given.

iang

---

From: Derek Atkins <[email-masked]>
Date: Sun, 16 Jul 2006 10:24:26 -0400

> saying nothing (in the 'silence implies consent' manner).

Well, may I ask that all of those on this list that are actually
actively reviewing drafts please speak up now and let me know.  Feel
free to let me know off-list if you prefer.  Then I can show Sam that
we've got a lot of active reviewers.

I should also note that while it's okay to assume "silence implies
consent", it would be nice for our reviewers to periodically say "I've
read this and I have found no issues."

-derek

---

From: Werner Koch <[email-masked]>
Date: Sun, 16 Jul 2006 20:31:01 +0200

> actively reviewing drafts please speak up now and let me know.  Feel

I have been doing this for 8 years or so and will continue to read and
comment on drafts.

Shalom-Salam,

   Werner

---

From: David Shaw <[email-masked]>
Date: Sun, 16 Jul 2006 21:02:52 -0400

> we've got a lot of active reviewers.

I actively review all drafts and comment on them, and plan to keep
on doing that.

Also count me in with regards to an interop grilloff.

David

---

From: Hironobu SUZUKI <[email-masked]>
Date: Mon, 17 Jul 2006 13:57:11 +0900

> free to let me know off-list if you prefer.  Then I can show Sam
> that we've got a lot of active reviewers.

I've been reviewing draft. It need for my OpenPKSD keyserver
development, specially packets structure, charset and others.

--- 
Hironobu SUZUKI (From Japan)
E-Mail: hironobu @ h2np.net
URL: http://h2np.net