Subject: Re: [openpgp] Proposed WG charter

From: Stephen Farrell <[email-masked]>
Date: Mon, 01 Jun 2015 13:38:49 +0100

FWIW, I like it. Just tell me when you're happy folks on
the list are happy and I'll start the formal chartering ball
rolling.

Be good to do that in the next week or so if you want to
be a WG and schedule a session at the next IETF in Prague.

I'm fine as well if you don't want to meet there though,
as the charter itself notes, so no need to rush if you
don't wanna. But if you do want to meet f2f in Prague,
getting the session request in before June 11 is what's
needed. (It'd appear as a pseudo-BoF as we're a WG in the
process of forming now.)

Cheers,
S.

On 31/05/15 04:28, Christopher LILJENSTOLPE wrote:
> Greetings,
> 
> 	Here's  a first cut of the charter.  We'd like to get this process started ASAP, so please make any comments, suggestions as soon as possible.
> 
> 	It's also available as a gist https://gist.github.com/liljenstolpe/a4a45477d1b89ea45e09
> 
> 
> 	Christopher
> 
> 
> An Open Specification for Pretty Good Privacy (openpgp)
> =======================================================
> 
> Charter
> -------
> 
> Chairs:
>      Christopher Liljenstolpe <[email-masked]>
>      Daniel Kahn Gillmor <[email-masked]>
> 
> Security Area Directors:
>      Stephen Farrell <[email-masked]>
>      Kathleen Moriarty <[email-masked]>
> 
> Security Area Advisor:
>      Stephen Farrell <[email-masked]>
> 
>  Mailing Lists:
>      To Subscribe:       https://www.ietf.org/mailman/listinfo/openpgp
>      Archive:            http://www.ietf.org/mail-archive/web/openpgp/
> 
> Description of Working Group
> ----------------------------
> 
> OpenPGP is an Internet standard that covers object encryption, object
> signing, and identity certification.  These were defined by the first
> incarnation of the OpenPGP working group.
> 
> The following is an excerpt from the charter of the original
> incarnation of the openpgp working group
> 
>> The goal of the OpenPGP working group is to provide IETF standards
>> for the algorithms and formats of PGP processed objects as well as
>> providing the MIME framework for exchanging them via e-mail or other
>> transport protocols.
> 
> The working group concluded this work and was closed in March
> of 2008.  In the intervening period, there has been a rough consensus
> reached that the RFC that defined the IETF openpgp standard, RFC4880,
> is in need of revision.
> 
> This incarnation of the working group is chartered to primarily
> produce a revision of RFC4880 to address issues that have been
> identified by the community since the working group was originally
> closed.
> 
> The Working Group will perform the following work
> -------------------------------------------------
> 
> Revise RFC4880
> 
> Other work may be entertained by the working group as long as it does
> not interfere with the completion of the RFC4880 revision.  As the
> revision of RFC4880 is primary goal of the working group, and other
> work will also not unduly delay the closure of the working group
> after the revision is finished (unless the working group is
> rechartered).
> 
> Working Group Process
> ---------------------
> 
> The working group will endeavor to complete most if not all of its
> work online on the working group's mailing list.  We expect that the
> requirement for face-to-face sessions at IETF meetings to be minimal.
> 
> Furthermore, the working group will accept no ID's as working group
> items unless there is a review by at least two un-interested parties
> of the ID as part of the acceptance process.
> 
> 
> Goals and Milestones
> --------------------
> 
> July 2016: Deliver an RFC 4880bis WG ID to the RFC editor
> 
> 
> 
> 
> 
> 
> 
> 
> _______________________________________________
> openpgp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/openpgp
>

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Mon, 01 Jun 2015 09:09:20 -0400

> needed. (It'd appear as a pseudo-BoF as we're a WG in the

FWIW, i'd be happy to go ahead and try to get a pseudo-BoF on the
schedule for Prague, if anyone else in the WG is going to be there.

         --dkg

---

From: "Christopher LILJENSTOLPE" <[email-masked]>
Date: Wed, 03 Jun 2015 17:34:34 -0700

Greetings,

On 31 May 2015, at 3:00, Peter Pentchev wrote:

> On Sat, May 30, 2015 at 08:28:18PM -0700, Christopher LILJENSTOLPE wrote:
>> Greetings,
>>
>> Here's  a first cut of the charter.  We'd like to get this process
>> started ASAP, so please make any comments, suggestions as soon as
>> possible.
> [snip]
>>
>> work...
> Just a very, very minor comment: is this supposed to be "any other work"
> instead of "and"?

If we were to do that, I would think it would be and any, rather than any.  However, I read "and any other" as more permissive than "and other"

	Christopher

>
>> ...will also not unduly delay the closure of the working group
> G'luck,
> Peter
> -- 
> Peter Pentchev  [email-masked] [email-masked] [email-masked]
> PGP key:        http://people.FreeBSD.org/~roam/roam.key.asc
> Key fingerprint 2EE7 A7A5 17FC 124C F115  C354 651E EFB0 2527 DF13

-- 
李柯睿
Avt tace, avt loqvere meliora silentio
Check my PGP key here: http://www.asgaard.org/cdl/cdl.asc
Current vCard here: http://www.asgaard.org/cdl/cdl.vcf
keybase: https://keybase.io/liljenstolpe

---

From: "Christopher LILJENSTOLPE" <[email-masked]>
Date: Wed, 03 Jun 2015 17:36:35 -0700

Greetings,

	Sorry about the silence for the last two days - out on a few day holiday.

> needed. (It'd appear as a pseudo-BoF as we're a WG in the

I am not sure I'm going to be in Prague, although if the group wants to meet, that would prod me a bit more.  What do we think, do we want a meeting in Prague, or do we want to start on the list?

Christopher

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Wed, 03 Jun 2015 21:18:02 -0400

On Wed 2015-06-03 20:36:35 -0400, Christopher LILJENSTOLPE wrote:
> I am not sure I'm going to be in Prague, although if the group wants
> to meet, that would prod me a bit more.  What do we think, do we want
> a meeting in Prague, or do we want to start on the list?

Well, we're already started on the list. :)

i think offering a meeting in Prague sounds reasonable if enough people
will be present and interested, and if there are specific agenda items
we want to have in-person discussion on.  No hard decisions would be
made in-person -- it would be information-gathering (and hopefully
consensus-building), with the results sent back to the mailing list for
review.

Are there other folks on the list who plan to be in Prague who would
like to meet?  

Three things i think would be useful for in-person discussion, if we
have concrete proposals to review would be:

 * ECDH for 25519
 * signalling mechanisms for the use of a revised AEAD symmetric cipher
 * Fingerprint content and representations

Do people have any proposed agenda items?

        --dkg

---

From: Werner Koch <[email-masked]>
Date: Thu, 04 Jun 2015 10:38:04 +0200

> Are there other folks on the list who plan to be in Prague who would

I do not plan to go to Prague but my schedule would allow me to come if
there is a need for it.

Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Thu, 04 Jun 2015 08:30:54 -0400

> I do not plan to go to Prague but my schedule would allow me to come if

If the group does meet in Prague, we should have the usual IETF remote
participation setup, so people who can't make it should be able to
participate as well (though it's never the same as in-person).

Remote participation usually uses xmpp as a text-based backchannel (in
the [email-masked] MUC, iirc), and http://www.meetecho.com/ for
videoconferencing support.

        --dkg

---

From: Derek Atkins <[email-masked]>
Date: Thu, 04 Jun 2015 11:46:22 -0400

> Are there other folks on the list who plan to be in Prague who would

I expect to be there, but I've not confirmed my availability.

> Do people have any proposed agenda items?

Assuming I'm there I'd like to discuss my two drafts.

>         --dkg

-derek
-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 4 Jun 2015 11:57:46 -0400

> Do people have any proposed agenda items?

I would like to discuss my UDF fingerprint draft.

https://tools.ietf.org/html/draft-hallambaker-udf-00

Most of the design follows the discussion on the list. The question that
people might want to discuss is whether to put an OpenPGP specific
identifier in the fingerprint value or if it is sufficient to put this in
the data that is fingerprinted.

So far we have two slots used out of 256 possible version identifiers (128
before we might have to think about strategies to make more version ids.)
So assigning 2 slots for general purpose fingerprints and two for OpenPGP
is not a big issue as far as registry space goes. I would much prefer to
have fingerprints be a general building block that every app uses in the
same way though.

---

From: "Christopher LILJENSTOLPE" <[email-masked]>
Date: Fri, 05 Jun 2015 08:21:17 -0700

> videoconferencing support.

One thing (since I'm a frequent remote participant over the years) that 
I'm sensitive to is the vigorous (virtual) standing at the mic that 
happens from time to time on XMPP.  What I like to do is have one of the 
chairs watching the XMPP stream to insure that participants that are 
remote can get a (timely) word in.

	Christopher