Subject: Re: [sipcore] draft-ietf-sipcore-sec-flows-01: document scope and intent

From: Robert Sparks <[email-masked]>
Date: Wed, 9 Dec 2009 13:27:14 -0600

On Nov 24, 2009, at 3:25 PM, Brian Hibbard wrote:

> A new version of the SIP Sec Flows draft is now available at http://www.ietf.org/internet-drafts/draft-ietf-sipcore-sec-flows-01.txt 
> .
>
>
> The feedback on the draft so far raises some interesting points  
> about the scope of the Sec Flows draft.  There are some basic issues  
> that need to be resolved for the draft to proceed.  Responses to  
> some of these issues may indicate the need for additional  
> document(s) or a change in scope of the draft.
>
>
> == Informative vs Normative ==
>
> The draft states in the first line of the introduction that it is  
> not normative for SIP.  That raises the question as to whether this  
> should be on the standards track.  Should this be informational or  
> BCP?

I don't remember why this was PS. Informational seems right. BCP is not.
>
>
> == Tutorial or Reference ==
>
> Is the draft intended to be a hitchhikers' guide to security for SIP  
> implementers?
I don't believe so - it was a set of examples.
>
> Does the draft intend to be a training tool to educate implementers  
> in PKI?
No.
> How far do we want to go in teaching developers how to generate and  
> manage certificates?
Only to the point that it's needed in order to explain what's  
happening in the examples.
> For example, are we trying to teach how to administer a Certificate  
> Authority and want to deal with how certs are generated in the real  
> world?
Very much no. Is something in the draft looking like it does that to  
you now?
> Or are we only concerned with the cryptography of the messages, and  
> we are only providing certificates and
>
> Are we only trying to provide specific reference examples for  
> helping verify implementations?
The last.
>
> If so, should we be providing test vectors instead?
I think you're focusing only on the crypto generation part of the  
draft (it is the hard part you jumped in to help with), but the examples
frame when what type of security mechanisms get used.
>  Is the document intending to recommend how things should be done,  
> how they might be done, or how they must be done?
The document provides some example flows. It is not intended to be  
comprehensive. In some cases it shows the only way
to do a certain thing. In others, it chooses from a range of options.

>
> == Document Title ==
>
> Depending on the resolution of the above, we may need to consider  
> changing the document's title.
I don't think we should be changing the document's scope to that  
degree at this time.

---

From: Cullen Jennings <[email-masked]>
Date: Wed, 9 Dec 2009 23:14:11 -0700

On Nov 24, 2009, at 2:25 PM, Brian Hibbard wrote:

> The draft states in the first line of the introduction that it is not normative for SIP.  That raises the question as to whether this should be on the standards track. Should this be informational or BCP?

I think we decided it need to be standards track when we added the normative statements about binary a long time ago. (I note that the "should" should be a "SHOULD".

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Fri, 11 Dec 2009 15:07:43 +0100

If so, you arbitrarily decided to change it because as far as I know it was informational during its complete lifetime in the SIP group, and I remember no discussion in the transfer to SIPCORE that made it standards track. Certainly my final SIP status slides (and the ones before and the ones before that ...) also say "Candidate: Informational". The first version that carries an "intended status" line is the 1st sipcore version, and this is at variance with the charter pages.

The last SIP charter pages clearly say:
Mar 2009    Example security flows to WGLC (Informational) 
Jul 2009    Example security flows to IESG (Informational)  

And the SIPCORE charter pages state:

Oct 2009    Example security flows to IESG (Informational) 

And from my own perspective this should still be informational. If you feel there is standards track information in here, then pull it out and submit it as a separate draft, and then the WG can decide whether they want to proceed with such a standards track document.

I'd also note to all authors that if you receive private messages of interest, then at least please let the WG chairs know that you have had those expressions of interest. If you received any of those messages on sec-flows during its SIP lifetime, the ex SIP WG chairs certainly have no evidence of them ever having been received - and that is essential information to the PROTO writeups. I assume the SIPCORE chairs are now in the same boat, having no email evidence because a small set of exchanges in the past on SIP and SIPCORE that anyone is even interested in this document.

regards

Keith

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Cullen Jennings
> Sent: Thursday, December 10, 2009 6:14 AM
> To: Brian Hibbard
> Cc: SIPCORE; Kumiko Ono
> Subject: Re: [sipcore] draft-ietf-sipcore-sec-flows-01: 
> document scope and intent
> 
> 
> > The draft states in the first line of the introduction that 
> it is not normative for SIP.  That raises the question as to 
> whether this should be on the standards track. Should this be 
> informational or BCP?
> 
> I think we decided it need to be standards track when we 
> added the normative statements about binary a long time ago. 
> (I note that the "should" should be a "SHOULD".
>  
> _______________________________________________
> sipcore mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sipcore
>