Subject: [dispatch] Secure Credential Transfer Charter & BoF

From: Matthew Byington <[email-masked]>
Date: Tue, 25 Jan 2022 11:36:13 -0800

Hi there,

I wanted to send an email out communicating an upcoming virtual BoF meeting scheduled for Thursday February 10th.

This is a follow-on to the initial presentation at IETF week 112 given last year.

I am posting the information below to a few different IETF mailing lists, so apologies if you receive duplicate notifications on the subject.

A big “thank you” to Francesca for helping us to get this scheduled and organized.

Latest draft:
	https://www.ietf.org/archive/id/draft-secure-credential-transfer-03.html

Charter:
	https://github.com/dimmyvi/secure-credential-transfer/blob/main/charter.md
	
BoF Request:
	https://datatracker.ietf.org/doc/bofreq-secure-credential-transfer-bof-request/
	
Virtual BoF (Francesca is finalizing this schedule still, but this is the proposed date and time):
	Thursday February 10th 17:00-19:00 UTC (https://www.worldtimebuddy.com/?qm=1&lid=2673730,5,8,100&h=2673730&date=2022-2-10&sln=18-20&hf=1)

Mailing list:
	https://www.ietf.org/mailman/listinfo/secret <https://www.ietf.org/mailman/listinfo/secret> 

Thanks,
Matt

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 25 Jan 2022 11:38:08 -0800

Can you clarify what the status of a "virtual BoF" is, here? I.e., is this
in lieu of an actual BoF at the next IETF? Is this WG forming?

-Ekr

On Tue, Jan 25, 2022 at 11:36 AM Matthew Byington <mbyington=
[email-masked]> wrote:

> Hi there,
>
> I wanted to send an email out communicating an upcoming virtual BoF
> meeting scheduled for Thursday February 10th.
>
> I am posting the information below to a few different IETF mailing lists,
> so apologies if you receive duplicate notifications on the subject.
>
> *Latest draft:*
> *Charter:*
> *BoF Request:*
> *Virtual BoF (Francesca is finalizing this schedule still, but this is the
> proposed date and time):*
> Thursday February 10th 17:00-19:00 UTC (
> https://www.worldtimebuddy.com/?qm=1&lid=2673730,5,8,100&h=2673730&date=2022-2-10&sln=18-20&hf=1
> )
>
> *Mailing list:*
> https://www.ietf.org/mailman/listinfo/secret
>
> Thanks,
> Matt
> _______________________________________________
> dispatch mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dispatch
>

---

From: Matthew Byington <[email-masked]>
Date: Tue, 25 Jan 2022 17:00:37 -0800

Hi Eric,

My understanding is that the BoF will be handled virtually (not in-person). It has also been scheduled outside of the normal IETF week.

The BoF is working-group forming, yes.

Matt

> On Jan 25, 2022, at 11:38 AM, Eric Rescorla <[email-masked]> wrote:
> 
> Can you clarify what the status of a "virtual BoF" is, here? I.e., is this in lieu of an actual BoF at the next IETF? Is this WG forming?
> 
> -Ekr
> 
> 
> On Tue, Jan 25, 2022 at 11:36 AM Matthew Byington <mbyington=[email-masked] <mailto:[email-masked]>> wrote:
> Hi there,
> 
> 	https://www.ietf.org/archive/id/draft-secure-credential-transfer-03.html <https://www.ietf.org/archive/id/draft-secure-credential-transfer-03.html>
> 
> Charter:
> 	https://github.com/dimmyvi/secure-credential-transfer/blob/main/charter.md <https://github.com/dimmyvi/secure-credential-transfer/blob/main/charter.md>
> 	
> BoF Request:
> 	https://datatracker.ietf.org/doc/bofreq-secure-credential-transfer-bof-request/ <https://datatracker.ietf.org/doc/bofreq-secure-credential-transfer-bof-request/>
> 	
> 	Thursday February 10th 17:00-19:00 UTC (https://www.worldtimebuddy.com/?qm=1&lid=2673730,5,8,100&h=2673730&date=2022-2-10&sln=18-20&hf=1 <https://www.worldtimebuddy.com/?qm=1&lid=2673730,5,8,100&h=2673730&date=2022-2-10&sln=18-20&hf=1>)
> 
> Mailing list:
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/dispatch <https://www.ietf.org/mailman/listinfo/dispatch>

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 27 Jan 2022 11:17:44 +1100

I'm a little surprised to hear this. 

Holding BoFs during IETF weeks gives them elevated visibility during a period when IETF folks have already reserved their attention and time for IETF matters. Scheduling one out of an IETF week means that people need to accommodate it in their schedules, not only for the event but also for preparation work. 

Holding such a BoF virtually compounds that -- especially when there has been ZERO consultation with the broad community about timing. E.g, if I wanted to attend this BoF, I'd need to be up before 4am.

The icing on the cake, though, is announcing it with only two weeks' notice -- a period of time shorter than many vacations.

As a result, I have very little confidence that this BoF will reflect community consensus and input. Of course, you will confirm consensus on lists, etc., but holding the BoF in such a limited forum taints the outcome.

IESG, this is a horrible precedent and while I won't specifically argue to cancel or delay this BoF, I do expect you to be much more thoughtful about these issues.

Cheers,

> On 26 Jan 2022, at 12:00 pm, Matthew Byington <mbyington=[email-masked]> wrote:
> 
> Hi Eric,
> 
>> On Tue, Jan 25, 2022 at 11:36 AM Matthew Byington <mbyington=[email-masked]> wrote:
>> Hi there,
>> 

--
Mark Nottingham   https://www.mnot.net/

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 26 Jan 2022 16:21:49 -0800

I share Mark's concerns about this BoF. Is there a reason this wasn't held
during IETF week?

-Ekr

On Wed, Jan 26, 2022 at 4:17 PM Mark Nottingham <[email-masked]> wrote:

> Holding BoFs during IETF weeks gives them elevated visibility during a
> period when IETF folks have already reserved their attention and time for
> IETF matters. Scheduling one out of an IETF week means that people need to
> accommodate it in their schedules, not only for the event but also for
> preparation work.
>
> Holding such a BoF virtually compounds that -- especially when there has
> been ZERO consultation with the broad community about timing. E.g, if I
> wanted to attend this BoF, I'd need to be up before 4am.
>
> The icing on the cake, though, is announcing it with only two weeks'
> notice -- a period of time shorter than many vacations.
>
> As a result, I have very little confidence that this BoF will reflect
> community consensus and input. Of course, you will confirm consensus on
> lists, etc., but holding the BoF in such a limited forum taints the outcome.
>
> IESG, this is a horrible precedent and while I won't specifically argue to
> cancel or delay this BoF, I do expect you to be much more thoughtful about
> these issues.
>
> Cheers,
>
>
> > My understanding is that the BoF will be handled virtually (not
> in-person). It has also been scheduled outside of the normal IETF week.
> >
> >> Can you clarify what the status of a "virtual BoF" is, here? I.e., is
> this in lieu of an actual BoF at the next IETF? Is this WG forming?
> >>
> >> -Ekr
> >>
> >>
> >> I am posting the information below to a few different IETF mailing
> lists, so apologies if you receive duplicate notifications on the subject.
> >>

---

From: Richard Barnes <[email-masked]>
Date: Wed, 26 Jan 2022 20:38:58 -0500

I have the opposite concerns from Eric and Mark.  Holding a BoF outside the
IETF week means less competition for peoples' attention.  And in the era of
easy, high-quality conferencing, it's ridiculous to delay work for months
on the basis that we can only get the right group of people together three
weeks a year.

+1 for virtual BoFs

--Richard

On Wed, Jan 26, 2022 at 7:22 PM Eric Rescorla <[email-masked]> wrote:

>> IESG, this is a horrible precedent and while I won't specifically argue
>> to cancel or delay this BoF, I do expect you to be much more thoughtful
>> about these issues.
>>
>> Cheers,
>>
>>

---

From: Lucas Pardue <[email-masked]>
Date: Thu, 27 Jan 2022 02:08:12 +0000

Either way, there's not really much detail to help prepare for the BoF.
With it being two weeks away I'd expect to see an agenda at least.

Cheers,
Lucas

On Thu, Jan 27, 2022 at 1:39 AM Richard Barnes <[email-masked]> wrote:

> I have the opposite concerns from Eric and Mark.  Holding a BoF outside
> the IETF week means less competition for peoples' attention.  And in the
> era of easy, high-quality conferencing, it's ridiculous to delay work for
> months on the basis that we can only get the right group of people together
> three weeks a year.
>
> +1 for virtual BoFs
>
> --Richard
>
>> I share Mark's concerns about this BoF. Is there a reason this wasn't
>> held during IETF week?
>>
>> -Ekr
>>
>>

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 26 Jan 2022 19:04:38 -0800

At this point I'm going to repeat my ask  (in my review when this was
DISPATCHED) for some document which describes the problem and the assumed
constraints.

This protocol has a number of features which seem surprising, and without
understanding the context it is essentially impossible to determine whether
those are necessary or misfeatures.

It would be extremely helpful if you posted this with sufficient time for
people to read this *prior* to the BoF, say in the next week or so.

-Ekr

On Wed, Jan 26, 2022 at 6:08 PM Lucas Pardue <[email-masked]>
wrote:

>>>> Holding such a BoF virtually compounds that -- especially when there
>>>> has been ZERO consultation with the broad community about timing. E.g, if I
>>>> >> Can you clarify what the status of a "virtual BoF" is, here? I.e.,
>>>> is this in lieu of an actual BoF at the next IETF? Is this WG forming?
>>>> >>
>>>> >> -Ekr
>>>> >>
>>>> >>

---

From: Matthew Byington <[email-masked]>
Date: Thu, 27 Jan 2022 09:01:03 -0800

Hi Eric, Lucas,

Thank you very much for the feedback. It is really valuable to me as I am navigating IETF and BoFs in general to learn and better my understanding of how these things should work.

Mark/Eric/Richard thank you as well for your input on timing and the fact that it is not being held at IETF week. I will circle back with Francesca to discuss, but I’m personally really looking forward to discussing the topic with the broader community sooner than IETF 113 so that we can continue the discussion.

Eric/Lucas - I will type up some supplemental material in addition to the draft and charter that we published earlier this week to the mailing lists and I will respond here with that material by EOD tomorrow (Friday Jan 28) describing the problem statement in additional detail.

In addition to responding here I’ll post it on our GitHub so that it is available to folks who aren’t on this list.

Thanks,
Matt

> On Jan 26, 2022, at 7:04 PM, Eric Rescorla <[email-masked]> wrote:
> 
> At this point I'm going to repeat my ask  (in my review when this was DISPATCHED) for some document which describes the problem and the assumed constraints.
> 
> This protocol has a number of features which seem surprising, and without understanding the context it is essentially impossible to determine whether those are necessary or misfeatures.
> 
> It would be extremely helpful if you posted this with sufficient time for people to read this *prior* to the BoF, say in the next week or so.
> 
> -Ekr
> 
> 
> On Wed, Jan 26, 2022 at 6:08 PM Lucas Pardue <[email-masked] <mailto:[email-masked]>> wrote:
> Either way, there's not really much detail to help prepare for the BoF. With it being two weeks away I'd expect to see an agenda at least.
> 
> Cheers,
> Lucas
> 
> On Thu, Jan 27, 2022 at 1:39 AM Richard Barnes <[email-masked] <mailto:[email-masked]>> wrote:
> I have the opposite concerns from Eric and Mark.  Holding a BoF outside the IETF week means less competition for peoples' attention.  And in the era of easy, high-quality conferencing, it's ridiculous to delay work for months on the basis that we can only get the right group of people together three weeks a year.
> 
> +1 for virtual BoFs
> 
> --Richard
> 
> On Wed, Jan 26, 2022 at 7:22 PM Eric Rescorla <[email-masked] <mailto:[email-masked]>> wrote:
> I share Mark's concerns about this BoF. Is there a reason this wasn't held during IETF week?
> 
> -Ekr
> 
> 
> On Wed, Jan 26, 2022 at 4:17 PM Mark Nottingham <[email-masked] <mailto:[email-masked]>> wrote:
> > On 26 Jan 2022, at 12:00 pm, Matthew Byington <mbyington=[email-masked] <mailto:[email-masked]>> wrote:
> > 
> > Hi Eric,
> > 
> >> On Jan 25, 2022, at 11:38 AM, Eric Rescorla <[email-masked] <mailto:[email-masked]>> wrote:
> >> 
> Mark Nottingham   https://www.mnot.net/ <https://www.mnot.net/>
>

---

From: Matthew Byington <[email-masked]>
Date: Fri, 28 Jan 2022 14:30:28 -0800

Hello everyone,

Happy Friday. 

We have created a set of slides that endeavors to answer some of the questions that have come up on this mailing list distribution.

I am going to attach the slides in PDF format to this email - I hope that works for everyone to be able to open them.

These are the slides that we will use to guide the BoF discussion. We will of course have additional color to add in the BoF discussion verbally but hopefully these are helpful in written format for now.

Note that these slides are *not* final yet, but as promised I wanted to get some additional information to everyone ASAP given the feedback we received on this thread around timing.

I also wanted to take a moment to thank everyone for their feedback thus far.

By the way, @Mark, I too share your concern of waking up early - totally get it. When we presented at IETF 112 last year I had to get up at 3 AM for that and needless to say, many cups of coffee were consumed.

The slides contain detail around the assumptions, requirements, use cases, and problem statement.

Hope everyone has a great weekend.

Thanks!
Matt

> On Jan 27, 2022, at 9:01 AM, Matthew Byington <[email-masked]> wrote:
> 
> Hi Eric, Lucas,
> 
>> On Jan 26, 2022, at 7:04 PM, Eric Rescorla <[email-masked] <mailto:[email-masked]>> wrote:
>>

---

From: John C Klensin <[email-masked]>
Date: Sun, 30 Jan 2022 01:13:15 -0500

Hi.

I've read the thread to date but it seems more appropriate to
respond to this message since this is not about the timing issue
raised by others.

Having read the charter and other materials, including skimming
the slides, I would like to better understand why this is being
proposed in ART rather than in the Security Area.  The expertise
is there (and not in ART except by happy accident) on most of
the "primary goals" and requirements in the charter.  It is
clear why an application or application protocol would want to
use the credential-sharing protocol being proposed, but it does
not seem to me that qualifies it as ART work (or, if it does,
why a significant amount of other work in the Security Area does
not belong in ART).

Just wondering...
    john

--On Tuesday, January 25, 2022 17:00 -0800 Matthew Byington
<mbyington=[email-masked]> wrote:

> Hi Eric,
> 
> My understanding is that the BoF will be handled virtually
> (not in-person). It has also been scheduled outside of the
> normal IETF week.
> 
>> Can you clarify what the status of a "virtual BoF" is, here?
>> I.e., is this in lieu of an actual BoF at the next IETF? Is
>> this WG forming?
>> 
>> -Ekr
>> 
>> 
>> On Tue, Jan 25, 2022 at 11:36 AM Matthew Byington
>> <mbyington=[email-masked]
>> <mailto:[email-masked]>> wrote: Hi there,
>> 
>> I wanted to send an email out communicating an upcoming
>> virtual BoF meeting scheduled for Thursday February 10th.
>> 
>> I am posting the information below to a few different IETF
>> mailing lists, so apologies if you receive duplicate
>> notifications on the subject.
>> 
>> A big "thank you" to Francesca for helping us to get this
>> scheduled and organized.
>> 
>> Latest draft:
>> 	<https://www.ietf.org/archive/id/draft-secure-credential-tra
>> 	nsfer-03.html>
>> 
>> Charter:
>> 	<https://github.com/dimmyvi/secure-credential-transfer/blob/
>> 	main/charter.md>
>> 	
>> BoF Request:
>> 	<https://datatracker.ietf.org/doc/bofreq-secure-credential-t
>> 	ransfer-bof-request/>
>> 	
>> Virtual BoF (Francesca is finalizing this schedule still, but
>> this is the proposed date and time): Thursday February 10th
>> 	17:00-19:00 UTC
>> 	(https://www.worldtimebuddy.com/?qm=1&lid=2673730,5,8,100&h=
>> 	2673730&date=2022-2-10&sln=18-20&hf=1
>> 	<https://www.worldtimebuddy.com/?qm=1&lid=2673730,5,8,100&h=
>> 	2673730&date=2022-2-10&sln=18-20&hf=1>)
>> 
>> Mailing list:
>> 	<https://www.ietf.org/mailman/listinfo/secret> 
>> 
>> Thanks,
>> Matt
>> <https://www.ietf.org/mailman/listinfo/dispatch>
>

---

From: [email-masked] (Dale R. Worley)
Date: Sun, 30 Jan 2022 16:36:31 -0500

And so that we can possibly lure in people who we haven't motivated to
think about this, I copy this from the BoF request so y'all can skim it
with minimal effort:

    The goal is to allow users with secure credentials on their mobile
    devices to be able to shares entitlements that these credentials
    grant to other users.

    This would be achieved by defining and standardizing a protocol that
    will facilitate such credential transfers from individual to
    individual. The protocol will leverage a "relay server" to transfer
    data from sender to recipient. The scope of the transfer is limited
    to a single origin device and a single destination device. This
    system does not exist today in a standards-based, cross-platform and
    cross-channel capacity.

    The goal of this BoF is to answer some of the questions that came up
    during the Dispatch meeting (such as, why can't these credentials
    simply be lifted and cloned and then sent to the recipient?). We
    also want to provide additional detail into the applicable use
    cases, and some of the security and privacy requirements for the
    solution. The ultimate goal is to form a WG to discuss the
    initiative in an ongoing capacity.

Dale