Subject: [Suit] SUIT Charter: RFC4108 Reference in the charter

From: Suhas Nandakumar <[email-masked]>
Date: Wed, 22 Nov 2017 15:31:14 -0800

Hello All

The charter current says the following on the CMS or RFC 4108

"""

RFC 4108 provides a manifest format that uses the Cryptographic Message
Syntax (CMS) to protect firmware packages. More than ten years have passed
since the publication of RFC 4108, and greater experience with IoT
deployments has led to additional functionality, requiring a contemporary
standardized solution to be defined.

"""

I feel this para is not adding value to the WG objectives and should be
removed from the charter. IIRC the BOF discussions also indicated something
on the similar lines and RFC4108 is not in widespread use as of today.

Cheers

Suhas Nandakumar

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 23 Nov 2017 07:40:36 +0000

Hi Suhas,

I think it is helpful in two ways:

-          First RFC 4108 illustrates that the IETF has published a document in this area already.

-          Second, it is useful background material. I always find it interesting to take the state-of-the-art into account. Too often we ignore prior work and repeat the same mistakes over and over again.

I agree that RFC 4108 is not in widespread use but is the text does not claim that.

Ciao
Hannes

From: Suit [mailto:[email-masked]] On Behalf Of Suhas Nandakumar
Sent: 23 November 2017 00:31
To: [email-masked]
Subject: [Suit] SUIT Charter: RFC4108 Reference in the charter

Hello All

"""

RFC 4108 provides a manifest format that uses the Cryptographic Message Syntax (CMS) to protect firmware packages. More than ten years have passed since the publication of RFC 4108, and greater experience with IoT deployments has led to additional functionality, requiring a contemporary standardized solution to be defined.

"""

I feel this para is not adding value to the WG objectives and should be removed from the charter. IIRC the BOF discussions also indicated something on the similar lines and RFC4108 is not in widespread use as of today.

Cheers

Suhas Nandakumar

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Henk Birkholz <[email-masked]>
Date: Thu, 23 Nov 2017 09:58:32 +0100

Hello,

calling RFC 4108 "state-of-the-art" is some kind of euphemism, right?

I know it is the only good reference in the RFC space - the Concise 
Software Identifier I-D also references 4108 for over a year now... but 
we decided to leave only the very basic information elements from RFC 
4108 in the CoSWID draft, will finish the current draft and create a 
corresponding extension draft when SUIT has come to life and agreed on 
mandatory metadata and optional metatdata information elements to be 
included in the manifest.

RFC 4108 is "pre-IoT" and is based on assumptions that mostly do not 
exactly apply anymore today, especially encoding wise.

I am strongly against encoding wars: but either we extend the 
expressiveness of 4108 and continue the use of CMS (which, I think, is a 
lesson learned and might be one of the things we do not want to repeat) 
or we create a way forward that take into account the requirements 
today. And Richard and others, for example, had some very good use cases 
at the first Bar BoF, if I remember correctly.

Viele Grüße,

Henk

On 11/23/2017 08:40 AM, Hannes Tschofenig wrote:
> -First RFC 4108 illustrates that the IETF has published a document in 
> this area already.
> 
> -Second, it is useful background material. I always find it interesting 
> to take the state-of-the-art into account. Too often we ignore prior 
> work and repeat the same mistakes over and over again.
> 
> *From:*Suit [mailto:[email-masked]] *On Behalf Of *Suhas Nandakumar
> *Sent:* 23 November 2017 00:31
> *To:* [email-masked]
> *Subject:* [Suit] SUIT Charter: RFC4108 Reference in the charter
> 
> Hello All
> 
> Syntax (CMS) to protect firmware packages. More than ten years have 
> passed since the publication of RFC 4108, and greater experience with 
> IoT deployments has led to additional functionality, requiring a 
> contemporary standardized solution to be defined.
> 
> """
> 
> removed from the charter. IIRC the BOF discussions also indicated 
> something on the similar lines and RFC4108 is not in widespread use as 
> of today.
> 
> Cheers
> 
> Suhas Nandakumar
> 
> IMPORTANT NOTICE: The contents of this email and any attachments are 
> confidential and may also be privileged. If you are not the intended 
> recipient, please notify the sender immediately and do not disclose the 
> contents to any other person, use it for any purpose, or store or copy 
> the information in any medium. Thank you.
> 
> 
> _______________________________________________
> Suit mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/suit
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 23 Nov 2017 09:01:39 +0000

Hi Henk,

This is not about coding wars. We are only talking about whether it is useful to mention prior IETF work in the charter. Nothing more.

There is separate text in the charter that says the group will pick one or multiple encoding formats.

Ciao
Hannes

-----Original Message-----
From: Suit [mailto:[email-masked]] On Behalf Of Henk Birkholz
Sent: 23 November 2017 09:59
To: [email-masked]
Subject: Re: [Suit] SUIT Charter: RFC4108 Reference in the charter

Hello,

I know it is the only good reference in the RFC space - the Concise Software Identifier I-D also references 4108 for over a year now... but we decided to leave only the very basic information elements from RFC
4108 in the CoSWID draft, will finish the current draft and create a corresponding extension draft when SUIT has come to life and agreed on mandatory metadata and optional metatdata information elements to be included in the manifest.

RFC 4108 is "pre-IoT" and is based on assumptions that mostly do not exactly apply anymore today, especially encoding wise.

I am strongly against encoding wars: but either we extend the expressiveness of 4108 and continue the use of CMS (which, I think, is a lesson learned and might be one of the things we do not want to repeat) or we create a way forward that take into account the requirements today. And Richard and others, for example, had some very good use cases at the first Bar BoF, if I remember correctly.

Viele Grüße,

Henk

On 11/23/2017 08:40 AM, Hannes Tschofenig wrote:
> -Second, it is useful background material. I always find it
> interesting to take the state-of-the-art into account. Too often we
> ignore prior work and repeat the same mistakes over and over again.
>
> RFC 4108 provides a manifest format that uses the Cryptographic
> Message Syntax (CMS) to protect firmware packages. More than ten years
> have passed since the publication of RFC 4108, and greater experience
> with IoT deployments has led to additional functionality, requiring a
> I feel this para is not adding value to the WG objectives and should
> be removed from the charter. IIRC the BOF discussions also indicated
> recipient, please notify the sender immediately and do not disclose
> the contents to any other person, use it for any purpose, or store or
> copy the information in any medium. Thank you.
>
>

---

From: Henk Birkholz <[email-masked]>
Date: Thu, 23 Nov 2017 10:10:27 +0100

Very good,

still, the information elements derived from the data model of RFC 4108 
would have to be discussed,revised with scrutiny and have to be 
refactored. It is only state-of-the-art in the sense that VHS is 
state-of-the-art for analog video tapes, I think.

The point here is, is the content of 4108 vital enough to be included in 
the charter? And I would dare to say it is not.

Starting with requirements from scratch seems to be more productive to 
me in contrast to make some of the "old things" fit into the "old thing" 
just because it is there (and afak not even used significantly).

Viele Grüße,

Henk

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 23 Nov 2017 10:01:50 +0000

Hi Henk,

I fail to understand why you are so much against even mentioning prior art in the charter. Just because RFC 4108 or the IAB workshop are mentioned in the charter text does not mean that the group cannot list the requirements in a document again. Where do you get this impression from?

I am not sure the comparison with VHS is appropriate since we are not writing a charter for a technology that replaces VHS.

As mentioned to Suhas the purpose of mentioning RFC 4108 and also the IAB workshop is to highlight that the IETF has been looking into this topic before. You prefer not to mention anything about prior IETF work in this area to the reader. Is that correct?

Ciao
Hannes

-----Original Message-----
From: Henk Birkholz [mailto:[email-masked]]
Sent: 23 November 2017 10:10
To: Hannes Tschofenig; [email-masked]
Subject: Re: [Suit] SUIT Charter: RFC4108 Reference in the charter

Very good,

still, the information elements derived from the data model of RFC 4108 would have to be discussed,revised with scrutiny and have to be refactored. It is only state-of-the-art in the sense that VHS is state-of-the-art for analog video tapes, I think.

The point here is, is the content of 4108 vital enough to be included in the charter? And I would dare to say it is not.

Starting with requirements from scratch seems to be more productive to me in contrast to make some of the "old things" fit into the "old thing"
just because it is there (and afak not even used significantly).

Viele Grüße,

Henk

On 11/23/2017 10:01 AM, Hannes Tschofenig wrote:
> Software Identifier I-D also references 4108 for over a year now...
> but we decided to leave only the very basic information elements from
> RFC
>> Message Syntax (CMS) to protect firmware packages. More than ten
>> years have passed since the publication of RFC 4108, and greater
>> experience with IoT deployments has led to additional functionality,
>> requiring a contemporary standardized solution to be defined.
>>
>> """
>>
>> something on the similar lines and RFC4108 is not in widespread use
>> as of today.
>>
>> Cheers
>>
>> Suhas Nandakumar
>>

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 23 Nov 2017 11:13:59 +0100

> As mentioned to Suhas the purpose of mentioning RFC 4108 and also the IAB workshop is to highlight that the IETF has been looking into this topic before. You prefer not to mention anything about pr…

I’m not Henk, but the charter is there to guide (and constrain) the work of the WG.

I believe it is good if WG participants know about RFC 4108 and the IoTSU workshop.
But what guidance, what constraints are you trying to derive from these?
The reference to IoTSU is somewhat unambiguous, but, as I mentioned previously a few times already, it is too easy to raise the misconception that SUIT is the RFC 4108 tweaking WG.  The sense of the BOF in Singapore was quite different.

Grüße, Carsten

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 23 Nov 2017 10:22:06 +0000

Carsten,

The purpose of a charter is not only to guide the work but also to provide some background. Just look at other charters in the IETF.

The audience of a charter text is also not just for the WG participants since it is  also supposed to attract others who are not yet in the IETF. Since one Cisco person at the SUIT BOF said that "nobody listens to the IETF in this area" I believe it is even more important to make the background info understood beyond the typical IETF community.

If the BOF chairs feel that the RFC 4108 reference upsets readers too much then I will not fight for it.

Ciao
Hannes

-----Original Message-----
From: Carsten Bormann [mailto:[email-masked]]
Sent: 23 November 2017 11:14
To: Hannes Tschofenig
Cc: Henk Birkholz; [email-masked]
Subject: Re: [Suit] SUIT Charter: RFC4108 Reference in the charter

Grüße, Carsten

---

From: Henk Birkholz <[email-masked]>
Date: Thu, 23 Nov 2017 12:17:27 +0100

Hello Hannes,

because it is misleading, I think (and I was only talking about the RFC 
not the WS) in combination with:

> greater experience with IoT deployments has led to additional functionality

SUIT is not about additional functionality, I think. It is about new work.

And I think the VHS analogy is okay, because like RFC 4108 it is a 
standard and only a relatively small number of stakeholders are planning 
to use it as a guideline for future technology. It is a good reference 
for an existing standard though.

In consequence, RFC 4108 should be mentioned in a corresponding 
documents that cover actual information elements or structure.

In respect to referring to a whole workshop... I have no strong opinion. 
It is just little bit general, I think.

Viele Grüße,

Henk

---

From: Suhas Nandakumar <[email-masked]>
Date: Thu, 23 Nov 2017 07:37:02 -0800

Hello Hannes,

  Comments inline

Thanks

On Wed, Nov 22, 2017 at 11:40 PM, Hannes Tschofenig <
[email-masked]> wrote:

> -          Second, it is useful background material. I always find it
> interesting to take the state-of-the-art into account. Too often we ignore
> prior work and repeat the same mistakes over and over again.
>
>
Not disputing it is useful as background information and i do think it
should be mentioned in the architecture document, for example .
FWIW its preferred the charter text focus on the work the group will
perform and more streamlined it is , the better it is.

> *From:* Suit [mailto:[email-masked]] *On Behalf Of *Suhas
> Nandakumar
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
>

---

From: Michael Richardson <[email-masked]>
Date: Thu, 23 Nov 2017 13:07:07 -0500

Carsten Bormann <[email-masked]> wrote:
    >> As mentioned to Suhas the purpose of mentioning RFC 4108 and also the
    >>IAB workshop is to highlight that the IETF has been looking into this
    >>topic before. You prefer not to mention anything about prior IETF work
    >>in this area to the reader. Is that correct?

    > I believe it is good if WG participants know about RFC 4108 and the

+1.

    > The reference to IoTSU is somewhat unambiguous, but, as I mentioned
    > previously a few times already, it is too easy to raise the
    > misconception that SUIT is the RFC 4108 tweaking WG.  The sense of the
    > BOF in Singapore was quite different.

I am happy with the reference that occurs in the text posted on the
datatracker now.  I was unhappy with the prior version.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-