Subject: Key Maintenance requirements draft.

From: "Olaf M. Kolkman" <[email-masked]>
Date: Wed, 9 Nov 2005 10:00:34 -0800

Dear Colleagues,

In order to get forward progress on the key-management issues we  
decided to do one little step back and concentrate on a requirements  
document.

We have found two volunteers to edit such document:
    Howard Eland <[email-masked]>
    and
    Russ Mundy <[email-masked]>

The timeline for this requirements draft is tight:
    Version 00 in a month from now.
    Version 01 in two months from now.
    Last call shortly after that.

In order to bootstrap the work please mail any requirements you might  
have directly to the editors, alternatively talk to them in the  
Vancouver hallways.

--Olaf

-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Thu, 10 Nov 2005 23:58:18 -0800

I wrote:

> decided to do one little step back and concentrate on a  
> requirements document.
>

and forgot to add Steve Crocker <[email-masked]>.

If we could meet an earlier closure of this document we obviously  
should. Please send your requirements fast.

--Olaf

-------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/

---

From: Paul Vixie <[email-masked]>
Date: Fri, 11 Nov 2005 16:46:38 +0000

# > In order to get forward progress on the key-management issues we decided
# > to do one little step back and concentrate on a requirements document.

i propose that "back" is not the direction we should step.  if it takes two
months (best case) to agree on requirements, it'll take more months to agree
on an approach, more months after that to code it and interoperability-test
it.  and this assumes no IPR-related debates or delays.

right now the best case is "dnssec in 2007".  if we "step back" and work on
requirements in the usual way, the best case will become "dnssec in 2008".

i have a counter-proposal.  google for "kde developer days" to see how another
community, larger and more diverse than this one, tries to get things done.

if the three original members of MODA were to arrange for conference rooms in
tokyo, redwood city, and stockholm to be dedicated to "dnssec developer days"
for a week, with videoconferencing, sake/beer/glug, and so on, and opened this
up to anyone in the namedroppers community who could afford the travel costs...

...could we possibly explore the key management space from a "what's desired,
what's the minimum we can all live with, what will actually work?" point of
view, including writing two I-D's (one justifying the selection and one
describing it) and coding it up and testing it?

it's possible that the videoconferencing could be multicast somehow, and made
available to folks who couldn't travel.  there'd be jabber rooms, shared
whiteboards, voip-reachable conference calls and speakerphones, etc.

i think the infrastructure could be in place by the second/third week in jan06,
if the WGchairs don't shoot this down and if there's general interest in it.
(note that i've not spoken to johan or kato about the tokyo/stockholm rooms.)

if this worked, we could stand to do it once a quarter until dnssec is "out".

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Fri, 11 Nov 2005 19:12:04 +0000

On Fri, Nov 11, 2005 at 04:46:38PM +0000, Paul Vixie wrote:
> i propose that "back" is not the direction we should step. 
> 
> if the three original members of MODA were to arrange for conference rooms 

	shouldn't that be a big IF?

> describing it) and coding it up and testing it?

	hum... from what i heard during the YVR mtgs, there are now five(5)
	varients on key mgmt/rollover and more may emerge from the woodwork.
	from what i can deduce, three of the five have workable (sort of)
	methods in place now... if they would like to test them, i offer
	up the rs.net testbed.  (now that I have the KSKs in place to get the
	ZSK signed...)

> whiteboards, voip-reachable conference calls and speakerphones, etc.

	so we "don't" have to travel to a MODA site... wonderful!

> (note that i've not spoken to johan or kato about the tokyo/stockholm rooms.)

	we -could- do this, even w/o IETF permission/approval.
	and we don't need conference rooms and shared video, et.al. to
	get started.  Shared jabber space and a framework to hang the
	keys on/in is needed.
	Perhaps a M/L to create/keep an archive of discussion.

> if this worked, we could stand to do it once a quarter until dnssec is "out".

	er, yeah.. 
	We -COULD- do the engineering evaluation independently of the politics
	and (possibly) the IPR headaches.

--bill (ready and willing)