Subject: [Isms] Rough Consensus Declaration: ISMS Architecture is EK

From: Ken Hornstein <[email-masked]>
Date: Wed, 04 May 2005 12:21:46 -0400

Dear ISMS WG members,

As you all know, there has been a lot of discussion relating to different
security architectures.  Juergen and I have talked it over, and we both
have agreed that there is a _very_ rough consensus for EK as the security
architecture for the ISMS WG.

Unfortunately, we know this decision will not be popular with a number
of WG members.  The exact preferences from people who expressed their
opinions on the mailing list is as follows (we've included Michael Bear
and David Nelson, who sent in their preferences a little bit late):

 Keying|      For             | Against | Abstain
 ------+----------------------+---------+-------------
 OOB   | 13 (9 Yes, 4 Maybes) |  6 No   | 3 no comment
 IB    | 12 (9 Yes, 3 Maybe)  |  5 No   | 5 no comment
 EK    | 14 (7 Yes, 7 Maybe)  |  4 No   | 3 no comment

 Key:  Y=YES/preference    (y=second pref/implied pref)
       M=MAYBE/second pref (m=implied second pref)
       N=NO
       -=no explicit rejection (no comment)

 OOB | IB  | EK  | Name (alphabetical by first name)
 ----+-----+-----+----------------------------------
  M  |  M  |  Y  | David Harrington
  -  |  Y  |  -  | David Perkins
  N  |  Y  |  M  | Ira McDonald
  M  |  -  |  Y  | Juergen Schoenwaelder
  Y  |  M  |  N  | Kaushik Narayan
  Y  |  -  |  -  | Marcus Leech
  Y  |  -  |  M  | Martin Soukup
  N  |  Y  |  M  | Robert Story
  N  |  y  |  y  | Sam Hartman
  N  |  Y  |  M  | Ken Hornstein
  Y  |  -  |  m  | Sharon Chisolm
  Y  |  -  |  -  | Tom Petch
  -  |  Y  |  Y  | Uri Blumenthal
  N  |  Y  |  M  | Wes Hardaker
  -  |  N  |  Y  | Juergen Quittek
  m  |  M  |  Y  | Wayne Kading
  m  |  Y  |  m  | Eric Fleischman
  Y  |  N  |  N  | Martin Soukup
  Y  |  N  |  N  | Keith McCloghrie
  Y  |  N  |  N  | Joe Salowey
  N  |  Y  |  M  | Michael Baer
  Y  |  N  |  Y  | David Nelson

Just from looking at the raw numbers, it's a very close call.  But from
the tone of the discussions, I think that a reasonable majority of the
WG can accept EK as the security architecture.  We don't expect this
decision to satisfy everyone, but sadly I doubt that we will be able to
come any closer to a consensus given the way the discussions are
going.  We believe at this point, we're left with two choices: declare
a rough consensus for EK, or decide that the WG has not reached
consensus and shut down.  We hope everyone can live with this decision
and move onto the important work of actually specifying the ISMS
protocol.

Speaking not as a WG chair, but as a WG participant, I think that the
best model for security lies with IBK.  I understand the evaluation
team's issues with SBSM, but I believe that it would be possible to
incorporate an existing IETF protocol as the key exchange protocol
instead of SBSM.  I understood what the authors of EUSM were trying to
do, but since the applicability statements for EAP and IKE placed them
off-limits for things like EUSM, I'm not sure what exactly was _left_
for a key exchange protocol, which puts us back in the same spot as
SBSM.  I'm not a huge fan of the EK approach, but it _is_ well
understood and is used by a number of protocols successfully.  I am
confident that a reasonable protocol can be designed using it and
it should be able to meet nearly everyone's needs.

--Ken

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 04 May 2005 11:07:00 -0700

>>>>> On Wed, 04 May 2005 12:21:46 -0400, Ken Hornstein <[email-masked]> said:

Ken> As you all know, there has been a lot of discussion relating to
Ken> different security architectures.  Juergen and I have talked it
Ken> over, and we both have agreed that there is a _very_ rough
Ken> consensus for EK as the security architecture for the ISMS WG.

I don't envy being in the WG chair's shoes for having to make this
decision.  The numbers show that a fair number of people don't find EK
their favorite (in fact it's the least of favorites; it wasn't my
favorite for instance) but it is one I think everyone can at least
settle on.

Having now settled on a path forward, is there alternative proposals
aside from DTLS to consider?  Certainly DTLS is a framework and we'll
likely need instantiations of that framework for individual
technologies (TLS, SSH, DTLS, ...).  Or are there people that have
alternative proposals to how DTLS itself is defining the solution space?

-- 
Wes Hardaker
Sparta, Inc.

---

From: "David T. Perkins" <[email-masked]>
Date: Wed, 4 May 2005 11:30:16 -0700 (PDT)

HI,

I'm glad that a direction has been set to move forward.

With this choice, it seems like the next questions are:
1) is it possible to use the same default ports (161 & 162)
   with DTLS and TLS(SSL)?
2) is it possible to add another mechanism to DTLS and TLS
   to use the SSH server's key and the SSH client keys,
   because I believe that would be better than supporting
   both SSH and DTLS (and TLS) encapsulation. However,
   I need to consult with some friends that just went
   through this situation.

Back in the fall, there were some discussions about the
technical issues in using EK.
Ken - do you want a summary, and a list of other technical
issues that need to be reviewed and resolved?

> alternative proposals to how DTLS itself is defining the solution space?

Regards,
/david t. perkins

---

From: Ken Hornstein <[email-masked]>
Date: Wed, 04 May 2005 14:31:59 -0400

>issues that need to be reviewed and resolved?

Actually, if you wanted to do that, I think that would be a good jumping-off
point.  So, "yes".

--Ken

---

From: Eliot Lear <[email-masked]>
Date: Wed, 04 May 2005 20:55:18 +0200

Ken,

Why doesn't this look to you like a 3 way tie?  Not that I like the 
results, mind you, but then I am up for option (d) which is not on the 
table.

Eliot

---

From: Ken Hornstein <[email-masked]>
Date: Wed, 04 May 2005 15:04:33 -0400

>results, mind you, but then I am up for option (d) which is not on the 

I admit, it's close to a three-way tie.  But the WG was told that we
had to have an architecture picked by the end of April.  Given that, we
have to pick SOMETHING, or shut down.  If people think that shutting
down is the appropriate option, let's hear about it.  But I don't think
we have the opportunity to pick option (d).

Juergen and I are of the opinion that EK seems to be the architecture
that most people can live with (it had the least number of "no" votes,
but again, not by a lot).  This is why we decided there was rough
consensus for it.  It was not easy to make that decision, but ....
well, shoot.  I'm not sure what else we could have done.

--Ken

---

From: Sam Hartman <[email-masked]>
Date: Wed, 04 May 2005 16:02:25 -0400

>>>>> "Eliot" == Eliot Lear <[email-masked]> writes:

    Eliot> Ken, Why doesn't this look to you like a 3 way tie?  Not
    Eliot> that I like the results, mind you, but then I am up for
    Eliot> option (d) which is not on the table.

  If you have some alternative path forward by all means present it.
  I think I'd rather also assume that the consensus call will hold and
  go forward with the work of designing a solution while listening to
  other things we could have done from a process standpoint.  My goal
  is not to shut anyone out, simply to make sure that we can try to be
  efficient.

Here are some things I'd like to avoid:

1) Try all three (the IMPP option)

2) Argue for a month about how to make a decision.

---

From: Eliot Lear <[email-masked]>
Date: Wed, 04 May 2005 22:07:19 +0200

Ken Hornstein wrote:
> have to pick SOMETHING, or shut down.

Look, I don't want us to shut down, but I think this isn't right.  While 
it is true that the chairs are given wide latitude when it comes to 
consensus, I think this violates the spirit of the rule.

Can we please all recognize that we really don't have consensus, and 
that we all need to step back a bit and figure out why not?  Often times 
when this happens different people are trying to solve different 
problems.  And I see some evidence of that in the discussion between 
David, Wes and Joe, for instance.  Maybe we even need two solutions? 
Maybe we need to get more enterprise/soho/sp operator input?  Roadshow, 
anyone?  A few of us including Bert, Andy, and I did this for NETCONF. 
Wasn't happy with what they told me but at least they told me stuff.

Eliot

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Wed, 4 May 2005 22:08:45 +0200

> alternative proposals to how DTLS itself is defining the solution space?

Did you mean s/DTLS/TLSM/g ? I do think if this WG continues, we should 
try to define a general approach to do EK and than map to concrete
protocols, whether that is TLS, DTLS, SSH, ...

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

---

From: Sam Hartman <[email-masked]>
Date: Wed, 04 May 2005 16:29:35 -0400

I'm very interested in concrete suggestions on how to make forward
progress.  If you think we don't have consensus, what would you do
instead? Be specific.

I don't have any good answers myself so I'm quite interested in your
input.

It is important to me that we have well bounded time for anything we
propose.

In particular I do not wish to be in the position of continually
extending deadlines missing them and then extending them again without
a clear understanding of why extending the deadline this time will be
different than the previous time.

--Sam

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 04 May 2005 19:47:55 -0700

>>>>> On Wed, 4 May 2005 22:08:45 +0200, Juergen Schoenwaelder <[email-masked]> said:

>> alternative proposals to how DTLS itself is defining the solution space?

Juergen> Did you mean s/DTLS/TLSM/g ?

Yes, minus the third one which was correct.  Sorry about that.

-- 
Wes Hardaker
Sparta, Inc.

---

From: Eliot Lear <[email-masked]>
Date: Thu, 05 May 2005 08:24:31 +0200

Sam,

You think *any* decision is a good decision.  I think that's only 
reasonable if and only if the implementors have bought into that and the 
decisions are roughly technically equivalent.  You need consensus on 
this point.  Otherwise you end up precisely with the IMPP mess because 
people walk away from the table.

As to timelines, you owe us some slack, having thrown the group into 
turmoil just before MSP.  I'm not saying you had no cause, nor am I 
asking for years, but holding The Sword of Damocles over our heads at 
this point is premature, and risks repeating technical mistakes you were 
attempting to correct simply because people are making *any* decision.

Eliot

---

From: Sam Hartman <[email-masked]>
Date: Thu, 05 May 2005 08:07:16 -0400

>>>>> "Eliot" == Eliot Lear <[email-masked]> writes:

    Eliot> Sam, You think *any* decision is a good decision.  I think
    Eliot> that's only reasonable if and only if the implementors have
    Eliot> bought into that and the decisions are roughly technically
    Eliot> equivalent.  You need consensus on this point.  Otherwise
    Eliot> you end up precisely with the IMPP mess because people walk
    Eliot> away from the table.

No, I actually think I agree with your statement 100%.  If the working
group has bought into the idea that making a decision (no matter what
it is) is sufficiently important then it is reasonable to make a
decision even given a very rough consensus.  If the working group has
not bought into the idea that a decision is sufficiently important
then we do not have consensus.

I have tried not to state an opinion (or really to form one to the
extent that I can avoid doing so) on whether the working group has
bought into the idea that a decision of any kind is sufficiently
important.  Judging that consensus is the job of the chairs and unless
required to do so it would be inappropriate for me to second guess the
chairs.

--Sam

---

From: Ken Hornstein <[email-masked]>
Date: Thu, 05 May 2005 14:02:07 -0400

>people walk away from the table.

In fairness, we (the WG chairs) should have made this clearer.  We had
assumed that by this point, people wanted a decision made and that
since (in our opinion) the more recent discussions hadn't really
brought anything new to the table, further discussion wasn't going to
help.  I guess implied in our call for consensus was the idea that we
were going to have to make a decision for one of the architectures, but
that was not explicitly spelled out.

So, to all WG participants: do you feel that we have to make _some_
decision on an architecture at this point?  If not, do you think more
discussion is useful?  If you don't, do you have any suggestions as to
how we should reach consensus?  Or do you think we should declare no
consensus and shut down?  Specifically, if you're not happy with how
things turned out, we need to hear from you!

(I know we've already heard from a few WG participants on this subject;
you don't need to resend your email).

As a WG member ... I think that the discussions that we've had to date
has shown me that people approach SNMP security with very different
assumptions and needs and I doubt further discussion will result in
anything useful.  I do want the WG to go forward, so I feel that
any decision at this point is what we need.

--Ken

---

From: "Wayne Kading" <[email-masked]>
Date: Thu, 5 May 2005 13:40:25 -0500

Ken,

My personal view is that the ISMS keying can be accomplished with any of the
three architecture choices and that it is more important to move ahead with
the decision which was made by the WG chairs.  I also don't believe that
refining the count or prolonging the voting or evaluation will substantially
change my view.  However, I did notice a subtle error in your rough
consensus summary.  There were 8 (vs 7) Maybe votes for EK which would
increase the For votes for EK to 15.

Wayne

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Ken Hornstein
Sent: Thursday, May 05, 2005 1:02 PM
To: [email-masked]
Subject: Re: [Isms] Rough Consensus Declaration: ISMS Architecture is EK 

--Ken

---

From: Ken Hornstein <[email-masked]>
Date: Thu, 05 May 2005 14:49:34 -0400

>increase the For votes for EK to 15.

That's definately true; someone else brought that to my attention.  If
you add up the missed "preferences" (I hate using the word "votes") that
people brought up on the mailing list (Lakshminath and Khanh), I get:

14 Yes, 6 No for OOBK
13 Yes, 5 No for IBK
17 Yes, 4 No for EK

Which pushes things sligher more toward EK, but again, it's still pretty
close.

--Ken

---

From: Juergen Quittek <[email-masked]>
Date: Thu, 05 May 2005 23:16:45 +0200

Eliot,

Not *any* decision is a good decision.

But please consider that there was (not just rough but) full consensus
at the last meeting on making a decision on the architecture first.

We also agreed at that time on limiting the discussion by the end of
April.  At the end of April, I could see a clear consensus on the
mailing list for making a decision in time.  However, the consensus
on what to decide was not obvious.

In that situation Ken and I clearly preferred to make a decision
based on the past discussions instead of giving up and closing the WG.

And in fact we considered the implementer's situation and we do not
think that implementers would have fundamental problems with the EK
approach.

Thanks,

    Juergen
-- 
Juergen Quittek        [email-masked]       Tel: +49 6221 90511-15
NEC Europe Ltd.,       Network Laboratories        Fax: +49 6221 90511-55
Kurfuersten-Anlage 36, 69115 Heidelberg, Germany   http://www.netlab.nec.de

--On 5/5/2005 8:24 AM +0200 Eliot Lear wrote:

> reasonable if and only if the implementors have bought into that and
> the decisions are roughly technically equivalent.  You need consensus
> on this point.  Otherwise you end up precisely with the IMPP mess
> because people walk away from the table.
>
> asking for years, but holding The Sword of Damocles over our heads
> at this point is premature, and risks repeating technical mistakes
> you were attempting to correct simply because people are making
> *any* decision.
>
> Eliot
>

---

From: Eliot Lear <[email-masked]>
Date: Fri, 06 May 2005 08:41:30 +0200

> at the last meeting on making a decision on the architecture first.

No, we were ordered to do so.

> on what to decide was not obvious.

No, we were ordered to have consensus by May 1 or disband.

Eliot

---

From: Juergen Quittek <[email-masked]>
Date: Fri, 06 May 2005 10:53:42 +0200

Eliot,

> No, we were ordered to do so.

We we got the strong recommendation by our ADs not to use EAP.
But when we discussed how to proceed facing this situation,
there was full consensus on rather deciding on the architecture first
instead of modifying the proposed solutions and having another
round of protocol evaluation.

> No, we were ordered to have consensus by May 1 or disband.

Certainly, we have an obligation to specify time limits at the IETF.
But this was not an ordered deadline.  We decided at our last meeting to
limit this discussion by the end of April (you were there).  We could also
have chosen another month say May or June, but this would probably have
been a waste of time and resources.

Thanks,

    Juergen

---

From: "David B Harrington" <[email-masked]>
Date: Fri, 6 May 2005 09:26:37 -0400

Hi Eliot,

I notice that you didn't express an opinion on which architecture you
prefer.

I'm having trouble understanding what you are attempting to accomplish
with your line of argument.

Are you trying to force the WG to not reach consensus by the deadline
(i.e. reject the chairs statement of rough consensus), and thus force
the WG to disband? If not that, what resolution are you shooting for? 

Thanks,
David Harrington
[email-masked] 

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Eliot Lear
> Sent: Friday, May 06, 2005 2:42 AM
> To: Juergen Quittek
> Cc: Sam Hartman; [email-masked]

---

From: Sam Hartman <[email-masked]>
Date: Fri, 06 May 2005 10:14:43 -0400

Eliot> Juergen Quittek wrote:
    >> But please consider that there was (not just rough but) full
    >> consensus at the last meeting on making a decision on the
    >> architecture first.

    Eliot> No, we were ordered to do so.

Ordered by whom?  A working group member (not me) came up with the
idea of the architecture discussion and the consensus of the room was
to go that path.

You certainly weren't ordered by me and I don't think you were ordered
by the WG chairs.

    >> We also agreed at that time on limiting the discussion by the
    >> end of April.  At the end of April, I could see a clear
    >> consensus on the mailing list for making a decision in time.
    >> However, the consensus on what to decide was not obvious.

    Eliot> No, we were ordered to have consensus by May 1 or disband.

No, you committed to a milestone.  The milestone was agreed by the
area director and chair as is our process.

I would have been happy with any set of milestones that got us to a
protocol proposal by Paris.

---

From: Eliot Lear <[email-masked]>
Date: Fri, 06 May 2005 16:59:56 +0200

This is my last message on the subject as I get the impression no one 
agrees with my position.  I was in the room and I know what I heard, and 
I remember objecting - LOUDLY - at the time.

> idea of the architecture discussion and the consensus of the room was

There was no other path to go because you had foreclosed other paths. 
See below.

> area director and chair as is our process.

Because you threatened the group with being shut down days after 
throwing out the progress the group had made.  Again, I'm not saying you 
didn't have good reason.  This may sound odd, but sometimes it takes a 
bit to digest your actions, which by the way, thoroughly frustrated a 
number of participants.

> protocol proposal by Paris.

You weren't.  You specifically precluded protocol proposals.  Instead we 
held a vote.  Let me ask you this: did YOU know how OOB could be 
implemented without EAP in a reasonable period of time?  I don't.  We 
probably could have figured something- for instance, Wes suggests that 
the use of TLS I mentioned was in fact OOB.

Now the vote is behind us.  I suggest the vote is meaningless and that 
there is really no consensus.  If you want to call another question, 
that's fine, but please let's not make more of what we got than what we got.

By the way, in answer to Dave, I'm on record on this list for preferring 
something akin to EK.  But I still don't like how we got here, and I 
think other proposals should be entertained if they substantially meet 
your security concerns, because otherwise I'm concerned that those 
people will refuse to participate in the process again, and with good 
reason.

Eliot

---

From: Juergen Quittek <[email-masked]>
Date: Fri, 06 May 2005 18:17:35 +0200

> There was no other path to go because you had foreclosed other paths.

Actually, there was.  Initially I suggested to go immediately through
another round of proposal submission and evaluation under the new discovered
constraints.  But the WG (without any objection) preferred having the
architecture discussion first.

> bit to digest your actions, which by the way, thoroughly frustrated a

Still, milestone and process were chosen by the group, not by the AD.

> people will refuse to participate in the process again, and with good

Do you really think that frustration would be less if follow your
suggestion and decide that we cannot achieve rough consensus?

Thanks,

    Juergen

---

From: "Tom Petch" <[email-masked]>
Date: Fri, 6 May 2005 17:19:15 +0200

<inline>
Tom Petch
----- Original Message -----
From: "Juergen Quittek" <[email-masked]>
To: "Eliot Lear" <[email-masked]>
Cc: <[email-masked]>
Sent: Friday, May 06, 2005 10:53 AM
Subject: Re: [Isms] Rough Consensus Declaration: ISMS Architecture is EK

> limit this discussion by the end of April (you were there).

Weeeell, those of you that were there at the meeting decided:-)  According to
the minutes,

"The WG has to decide on an architecture until April and on a new
charter until August.  the milestones in the current charter will be
updated accordingly"

I was taken by surprise by the post on 29th April to the effect that there were
some 40 hours left in which to decide on an architecture; the call for consensus
on 21st April omitted this deadline.  I think that that could have been handled
better.

But, for all the imperfections in process, I would like now to concentrate on
EK, first of all understanding just what it is (as opposed to the I-D that
floated the idea first) to see if it will fly.

---

From: Robert Story <[email-masked]>
Date: Fri, 6 May 2005 13:59:07 -0400

On Fri, 06 May 2005 16:59:56 +0200 Eliot wrote:
EL> There was no other path to go because you had foreclosed other paths. 

EL> Because you threatened the group with being shut down days after 
EL> throwing out the progress the group had made.

Not true. He just threw out EAP, which was part of the one OOB proposal
submitted. As the rough consensus has shown, there is no guarantee that OOB
would have been chosen even if EAP was left in the picture.