Subject: Question about how to proceed on PIC

From: Paul Hoffman / VPNC <[email-masked]>
Date: Fri, 2 May 2003 08:12:50 -0700

Greetings again. As many of you know, PIC was sent to the RFC Editor
for publication, and before the RFC came out, a security problem with
the way that PIC, EAP, and other related protocols do authentication
was discovered. The problem is described in detail in
<http://www.ietf.org/internet-drafts/draft-puthenkulam-eap-binding-02.txt>.

We now have a clearer idea on how to modify PIC to avoid the security
problem, but in the meantime, IKEv2 has moved much closer to being
finished. IKEv2 includes a single standard method for doing legacy
authentication. Also, we have heard little or no interest in
deploying PIC.

So our question to you is, should we fix PIC and get a standards-track
RFC, an informational RFC, or should we withdraw it? There is no reason
for us to create an RFC that no one will implement. We want to hear
from folks in the WG about this so we can decide to go forwards.

--Paul Hoffman and Sara Bitan, WG chairs

---

From: Jean-Jacques Puig <[email-masked]>
Date: Fri, 2 May 2003 20:08:16 +0200

Hello,

	I was interested in PIC mainly because IKEv1 does not address legacy
	auth, and a bootstrap method from legacy auth to tunnel
	establishment sounds reasonable. IKEv2 supports legacy auth, but I
	don't think PIC does exactly the same thing. However, the market will
	certainly accept only one protocol here, and it will be IKEv2, thus
	I think going further with PIC is pointless.

	Whether it is coherent for IKEv2 to handle legacy auth is another
	debate though (on which I have no opinion :-).

--
Jean-Jacques Puig

---

From: "Glen Zorn" <[email-masked]>
Date: Fri, 2 May 2003 13:14:38 -0700

> Greetings again. 

Hi, Paul.

> As many of you know, PIC was sent to the RFC 
> Editor for publication, and before the RFC came out, a 
> security problem with the way that PIC, EAP, and other 
> related protocols do authentication was discovered. The problem is
described in 
> detail in 
<http://www.ietf.org/internet-drafts/draft-puthenkulam-eap-binding-02.tx
t>.

> We now have a clearer idea on how to modify PIC to avoid the security
problem, 

Cool!  How is it done? 
 
...

> So our question to you is, should we fix PIC and get a standards-track
RFC, an informational > RFC, or should we withdraw it? There is no
reason for us to create an RFC that no one will > 
> implement. 

Serious question: was anybody actually planning to implement PIC
_before_ the problems were discovered?

> We want to hear from folks in the WG about this so we can decide to go
forwards.