Subject: [Nea] Results of Consensus check on EAP-based PT

From: Susan Thomson <[email-masked]>
Date: Thu, 18 Aug 2011 18:35:26 -0400

We have come to the end of the consensus check period for selecting an
EAP-based approach to PT.

By  my count, the results were as follows:
PT-EAP: 11
EAP-TLV: 8

Since there is still no consensus, we will follow the process outlined in
the original call for consensus check message (see below), where our AD,
Stephen Farrell, will make a decision. As discussed at the last meeting, we
expect to receive a decision in August. The next step after that is to
publish the individual submission corresponding to the selected approach as
a -00 NEA WG I-D, and we will proceed with the normal process of editing the
document within the WG.

I want to thank everyone for participating in the consensus check, and to
those who provided the reasons behind their decision. I especially want to
thank the proponents of the two proposals for providing a framework for
evaluating the approaches. I think the discussion provides valuable input
into the decision-making process and shows that due diligence has been done.

Thanks
Susan

------ Forwarded Message
> From: sethomso <[email-masked]>
> Date: Tue, 2 Aug 2011 16:04:25 -0500
> To: <[email-masked]>
> Subject: Consensus check on EAP-based PT
> 
> At IETF81 and several prior IETF meetings, as well as on the mailing
> list, the WG has evaluated the pros and cons of 2 architectural
> approaches to carrying posture within an EAP tunnel method:
> 
> - EAP method 
> http://www.ietf.org/internet-drafts/draft-hanna-nea-pt-eap-01.txt
> 
> - EAP TLV.
> http://www.ietf.org/internet-drafts/draft-cam-winget-eap-tlv-03.txt
> 
> So far, there has been no WG consensus to adopt one architecture versus
> the other. (At the recent F2F meeting in Quebec City, the consensus
> check at the meeting showed an equal number in favor of each approach.)
> 
> This email is a final call to determine WG consensus on the L2 PT
> approach. 
> 
> The consensus check is to choose one of the following 3 options:
> 1) PT-EAP approach
> 2) NEA-TLV approach
> 3) Neither (please state the reason if you choose this option)
> 
> Please respond to the above question by Tues Aug 16 at 5pm PT. Please do
> so even if you have already expressed your opinion, either at a WG
> meeting or on the mailing list. The answer can be as brief as selecting
> option 1), 2) or 3). If you would like to add your reasons for your
> choice, that would be appreciated too, especially if you choose option
> 3).
> 
> If we have consensus on the mailing list, we will adopt the selected
> approach.
> 
> If we still do not have consensus, the WG chairs and AD (Stephen
> Farrell) have agreed that the AD will make a decision. The proponents of
> both approaches have agreed to abide by this decision. This resolution
> plan was discussed at the F2F meeting at IETF81. This plan was also
> communicated to the list in an email on Jun 30, 2011. No objections have
> been received.
> 
> In either case, the individual submission corresponding to the selected
> approach will be adopted as a -00 NEA WG I-D, and we will proceed with
> the normal process of editing the document within the WG.
> 
> Thanks
> Susan
> 
> ------------------
> References:
> IETF81 audio session (start at approx 44 mins into session):
> http://www.ietf.org/audio/ietf81/ietf81-2103-20110727-1256-pm.mp3
> 
> IETF81 draft meeting minutes:
> http://tools.ietf.org/wg/nea/minutes
> 

------ End of Forwarded Message

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 24 Aug 2011 23:42:15 +0100

Hi all,

The requested decision is at the end, so you can skip
there first if you're only keen on the outcome:-)

Firstly, I entirely agree with the WG that picking one
way to do this is the way to go - other WGs with which
I've been involved have regretted standardising two
ways to do the same thing for years afterwards, so
thanks for being open to even a pretty unqualified
selection process, (i.e. having me pick) - I think
you're doing the right thing in pushing hard for one
standard. I'd also like to thank the chairs for
their leadership of what could have been a quite
divisive discussion - they're either good at that or
else you're all much more polite than the average
set of IETF participants:-)

Second, I also agree with the WG that basically either
approach could work so there's not much difference
here, and that's probably one of the reasons why its
been hard to reach a decision.

Third, I also agree with the chairs that there is
no rough consensus in the WG, neither on the list nor
at the last couple of face to face meetings.

My own reading of the situation is that PT-EAP
does provide a firmer basis on which to go forward
at this stage, given that there are implementations
that have been deployed that are very similar.

That was also backed up by a few off-list responses
I got from people who know more about this than I
but who are not involved in the WG. When I asked
which way they thought would be better, one said
doing it in EAP is crazy for size reasons, but most
(4 to 2) said that the running code should win.

However, I also agree with the argument that EAP-TLV
is more in line with the direction in which EAP
standardisation has been going, i.e. avoiding new
less-secure EAP method definitions. OTOH, there are
so many existing EAP methods, that its hard to see
this as a showstopper.

The other thing that strikes me is that neither
approach is yet fully baked, in particular, the
WG will still need to figure the detail of how
to handle requirement PT-2 from RFC 5209, copied
below:

   "PT-2 The PT protocol MUST be capable of supporting mutual
         authentication, integrity, confidentiality, and replay
         protection of the PB messages between the Posture Transport
         Client and the Posture Transport Server."

My feeling is that the two already-similar proposals
might look even more similar when a solution meeting
that requirement is developed in the WG. (That solution
might involve just an EAP tunnel or maybe more.) And
that might (or might not) lead to a change in the WG
consensus depending on how that solution looks. If a
change in the WG opinion did happen later on I don't
believe that switching to TLVs would be that much work at
that point (as otherwise the WG consensus would presumably
not be for change), so even if a change were done later
I don't see it adding much delay. But of course, we
don't want to get wedged again on a lack of consensus.

So, taking all the above into account, I propose the
following:

- Proceed with PT-EAP: make draft-hanna-nea-pt a WG draft,
   and develop that until its ready for WGLC
- At WGLC time, if called upon to do so by a WG participant,
   the chairs are to hold a new consensus call to see if
   WG consensus has in fact moved to using TLVs rather than
   an EAP method, *but* with a default that no consensus
   for change to TLVs at that point means staying with the
   EAP method approach of PT-EAP

Note that this does not call for the proponents of
EAP-TLV to continue developing their approach independently.
My hope is that they get involved with the WG document and
then, when that's ready, make their argument for a
change to TLVs again, if they still feel that's useful.

Regards,
Stephen.