Subject: RE: [dix] Proposed Charter for DIX Working Group

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 13 Jan 2006 19:05:47 -0800

The job that needs doing here is for someone to join the dots up. That
is what DIX really needs to do. The common identifier format is the key
to joining up the dots.

In SAML and WS-Security we made the mistake of trying to please
everyone. We ended up with a framework but no base case.

There is a big problem with proliferating security mechanisms, the
security you achieve tends to be the security of the weakest link in the
chain. Digest Authentication was not a real step forward for HTTP
security because we were not allowed to depricate BASIC, not even when
it was only a week old.

I think that we need to be able to show that we have selected a secure
mechanism for password authentication (including One time passwords) and
a secure mechanism for public key authentication and that it is possible
to plug in biometric based authentication mechanisms if required.

I do not think that it is acceptable to do the usual IETF move of
punting and saying we will use everything. 

The specification process is a process of removing degrees of freedom by
making decisions. I do not think that there is any value in creating yet
another meta-framework in this area. We already have two of those - WS-*
and SAML. 

What we need is an actionable strategy, a protocol, a set of bits on the
wire, not yet another set of diagrams with bubbles marked 'user',
'user's agent', 'relying party' &ct.

> -----Original Message-----
> From: Lisa Dusseault [mailto:[email-masked]] 
> Sent: Friday, January 13, 2006 7:21 PM
> To: Hallam-Baker, Phillip
> Cc: [email-masked]; John Merrells
> Subject: Re: [dix] Proposed Charter for DIX Working Group 
> 
> I agree with this.  I got the impression from talking to Dick 
> a while back, that DIX was going to leave a few very 
> important pieces completely unspecified, which pretty much 
> means no interoperability.
> 
> I would expect that the group would have to produce at least 
> one technical (though not necessarily complete) 
> Internet-Draft *before* getting chartered, rather than making 
> those post-charter milestones.
> 
> lisa
> 
> On Jan 13, 2006, at 1:56 PM, Hallam-Baker, Phillip wrote:
> 
> >
> > I would however insist on a distinction between considering an 
> > authentication mechanism and considering authentication. 
> The group is 
> > going to need to specify how to use at least one authentication 
> > mechanism in the context of the chosen identifier.
> 
> 
> 

_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: Dick Hardt <[email-masked]>
Date: Fri, 13 Jan 2006 19:14:23 -0800

I completely agree on joining the dots!

I also agree on the common identifier!

I don't see why authentication needs to be specified. There are  
already lots of ways of authenticating. The one with the required  
amount of security will be what is required in a given  
implementation. A key goal of DIX is to provide a spectrum of  
security. The web would have never taken off if every server needed  
an SSL cert. I think this will be pretty clear as we share our  
thoughts on how this all might work.

DIX is for connecting a number of disparate things together in  
various ways so that there are real, deployable solutions.

Summary: I think we are very aligned Phillip. I come from the Perl  
world, and am a very pragmatic on creating useful solutions to real  
problems. :-)

-- Dick