Subject: RE: IETF 65 BOF Announcement: Digital Identity Exchange (DIX)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 13 Feb 2006 07:32:00 -0800

Perhaps it is just me but I find the two assertions implicit/explicit in
your messages to be incompatible:

1) That identity is a topic that the IETF has failed to do useful work
on in the past

2) That the organizers of the BOF have need of more extensive input from
those who have failed to do productive work on the topic before
proceding.

While learning lessons from past failures is an important part of the
design process this does not appear to be the type of input into the
procedings that you appear to have in mind.

It is reasonable to tell the builders of the new bridge to ask the
architects of the old one why it fell down. It is completely
unreasonable to tell the builders of the new bridge to ask the
architects of the old one how to build the new bridge and wait on their
reply.

This BOF is not the only initiative underway in this space. The internet
is under attack, phishing is a form of identity theft. So working out
how to fit theft proof credentials into the Internet infrastructure is
an important problem.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Dave Crocker
> Sent: Monday, February 13, 2006 10:04 AM
> To: Hollenbeck, Scott
> Cc: [email-masked]
> Subject: Re: IETF 65 BOF Announcement: Digital Identity Exchange (DIX)
> 
> 
> 
> >>>>   My immediate concern is that we know better than to 
> conduct this 
> >>>> sort of BOF in this sort of manner.
> >>> What sort of manner is that, Dave?  
> > 
> > I ask a serious question and I get a sarcastic reply.  
> That's a great 
> > way to have a productive conversation.
> 
> 1. You are right.  My only excuse is that I felt/feel I had 
> made two postings that largely already answered your 
> question, and your query reflected none of that content.  So 
> the sarcasm was a reaction to having to repeat myself.
> 
> See:
>    http://www1.ietf.org/mail-archive/web/ietf/current/msg40484.html
> and, of course:
>    <http://www1.ietf.org/mail-archive/web/ietf/current/msg40496.html>.
> 
> 2. Other than having the opening tone be questionable, the 
> note very much *did* provide content intended to be strictly 
> productive.
> 
> 
> > The proponents of this BOF are following the community's documented
> > procedures [1].  What I'm hearing is that there is a 
> underlying problem
> > with the adequacy of those procedures.
> 
> That's a worthy discussion, but my real concerns are the 
> realities surrounding 
> this type of BOF for this type of topic.
> 
> In simplistic (but productive and non-sarcastic) terms, I 
> think things reduce to 
> the hurdles that an AD can/should impose prior to approving a 
> BOF.  Some topics 
> warrant higher hurdles.  There is ample basis for viewing DIX 
> as one of them, IMO.
> 
> I think the title of Thomas Narten's draft is particularly 
> apt, because it 
> focuses on productivity rather than formal process.
> 
> 
> d/
> -- 
> 
> Dave Crocker
> Brandenburg InternetWorking
> <http://bbiw.net>
> 
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ietf
> 
> 

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Richard Shockey <[email-masked]>
Date: Mon, 13 Feb 2006 11:17:28 -0500

> 1) That identity is a topic that the IETF has failed to do useful work

That is a unfair statement. 1. There is lots of useful work being done 
on Identity Management its just not being done at the IETF. We are not 
the only standards body on the planet.

2. There is lots of interest in Identity all over the IETF specifically 
in the RAI area where there are several important drafts being worked on 
the relationship of SIP to SAML. I think this work extremely important.

Are you familiar with the existent SIP SAML work?

The question continues to be what areas _could_ or _should_ the IETF 
make a useful contribution on and how does that relate if any to the 
existing body of work on SAML and Liberty's Federated Identity 
Management work. I have some suspicion that W3C is also looking at this 
area.

You were correct earlier post that the current work in Liberty has been 
oriented towards the enterprise single sign on problem but that does not 
mean it cannot be generalized to the cross domain problem that is the 
focus of the current Liberty Federation work. As everyone knows modern 
Identity management theory came out of the violent reaction to 
Microsoft's Passport proposal.

I remain very cautious about reinventing the wheel here.

> procedings that you appear to have in mind.

You incorrectly assume there are failures in this space. In fact there 
are several successes. I for one agree that the IETF has not looked 
correctly at Identity management in general but I also strongly believe 
the IETF has ignored the significant body of existing work in the space.

> architects of the old one why it fell down.

I also do not want to build a new bridge if in fact the existing tunnels 
  can handle the demand.

  It is completely
> how to fit theft proof credentials into the Internet infrastructure is

Yes but what I and many others would like to see first better grasp of 
the problem statement, a survey of what is existent in Identity 
Management, a determination of what currently exists can be reasonably 
adapted to the problem ..then and only then attempt to design something new.

There are lots of folks at IETF that are very familiar with Identity 
related problems and protocols. I am a bit disturbed that a solution is 
being proposed before the problem and the alternatives are throughly 
investigated.

Richard Shockey, Director - Member of Technical Staff
NeuStar Inc.
46000 Center Oak Plaza  -   Sterling, VA  20166
sip:rshockey(at)iptel.org   sip:57141(at)fwd.pulver.com
ENUM +87810-13313-31331
PSTN Office +1 571.434.5651 PSTN Mobile +1 703.593.2683
Fax: +1 815.333.1237
<mailto:richard(at)shockey.us> or
<mailto:richard.shockey(at)neustar.biz>
<http://www.neustar.biz> ; <http://www.enum.org>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

---

From: Dave Crocker <[email-masked]>
Date: Mon, 13 Feb 2006 08:36:33 -0800

> being proposed before the problem and the alternatives are throughly

Right.

Some IETF work items involve narrow topics that are well-understood and have a 
core of interested folk who are clear about both of these facts, and clear about 
their goals.

Other work items are not so lucky.

As part of our efforts to ensure timely, useful output, we should work pretty 
hard to assess likely risks for IETF work, from before its inception (and on an 
on-going basis, of course.)

Some items are clearly *very* important and *very* risky.  They warrant pursuit 
but they are prime candidates for wasting the IETF's time.  So they require 
extra efforts to find ways to make things be both timely and productive.

At the very least, a wasted BOF consumes an expensive slot and delays the topic 
by at least 4 months.

Note, however, that the opportunity costs associated with a BOF that is a public 
debacle can, in fact, have strategic impact, essentially poisoning the IETF waters.

d/
-- 

Dave Crocker