Subject: Re: IETF65 hotel location

From: "Tom.Petch" <[email-masked]>
Date: Fri, 3 Feb 2006 11:37:21 +0100

----- Original Message -----
From: "Bob Braden" <[email-masked]>
To: <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, January 30, 2006 6:16 PM
Subject: Re: IETF65 hotel location

> I don't understand why this discussion keeps going on and on, much
> less why it started in the first place.
>
> Folks, surely we have more important issues of Internet technology to
> talk about, rather than jaw-boning about a task that we have delegated
> to a competant organization.  That organization has in general done an
> excellent job over the past many years, and I for one am confident they
> will continue.  They are sensitive to input, but they get the job
> done.  Site selection and contracting requires a difficult balancing
> act to perform, between the ideal and the real.  As far as I can see,
> they do a much better job of than the IETF could possibly hope for.  I
> am thankful for their dedication and expertise.
>
> Let's stop spending our resources micro-managing the Secretariat,
> and deal with the problems that we are supposed to be solving.
>
> Bob Braden
>
Bob

(tongue only partly in cheek)

I wonder if you have the same feelings about virus'; after all, no rational
person would be fooled into doing what the spammers want and so sending virus'
on their way - yet they do propagate.

Trouble is, humans are not always rational, scientific, technological,
engineering beings.  They also have a dark side, one which repays study and the
findings of which are collected in the sometimes under-rated discipline of
psychology.

Any experienced meeting chair will know that there are times when a meeting has
a mind of its own and gets its teeth into some irrelevant topic.  Such a chair
will also know that it needs a very forceful personality to stop this; better
usually to let the fire burn for a while, and then intervene to get things back
on track, as the flames die down.  But the chair will also know that this
behaviour is a symptom, a displacement of some other issue that it is worth
trying to identify and deal with.  In face-to-face meetings, it is possible to
look for physical clues in the people, to cast back over what happened just
beforehand and maybe get some insight.  On mailing lists, this is much more
difficult but sometimes still possible.

So while I see the frustration that you, Bert and others express, these times
are for me a chance to reflect on what lies at the bottom of the behaviour and
what I could do about it.  No clues on this occasion but perhaps one day I will
study the archives and see enough to produce an I-D on it.

Tom Petch

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: "Tom.Petch" <[email-masked]>
Date: Fri, 17 Feb 2006 17:14:48 +0100

The phrase 'monotonic increasing' seems to be a Humpty-Dumpty one, used with a
different sense within RFC to that which I see defined elsewhere; and this
could lead to a reduction in security.

Elsewhere - dictionaries, encyclopaedia, text books -  I see it
defined so that when applied to a sequence of numbers, then each number is not
less than its predecessor, so that
1 1 1 1 1 1 1 1 1 1
1 1 2 3 5 8 13
1 2.71828 3.14159 4.18 42
are all monotonic increasing sequences whereas
1 2 3 4 5 6 7 9 8 10
is not.

Within RFC, mostly those related to security or network management, the context
of its use implies, in addition, one or more of
a) each number in the sequence is different (as in number used once)
b) each number is an integer
c) each number is one greater than its predecessor (as in message sequencing) .

Most likely, an implementation that conforms to the rest of the world definition
would interwork with one that conforms to the RFC one, but with some loss of
security, since numbers that are intended to be used only once could be reused.

Q1) Can anyone point me to an authoritative source that endorses the RFC usage?

Q2) Even so, since the  rest of the world usage seems to be so widely defined,
should we change our terminology, eg specifying seqences to be strictly
increasing when that is what is needed?

Tom Petch

---

From: Ken Raeburn <[email-masked]>
Date: Fri, 17 Feb 2006 12:46:47 -0500

> less than its predecessor, so that

That's "non-decreasing".  As far as I've ever heard (math classes as  
well as CS), a monotonic increasing sequence is one where each  
element is strictly greater than the previous element.

> b) each number is an integer

Well, we deal with integers a lot...

> Q1) Can anyone point me to an authoritative source that endorses  

Actually, I'd be surprised to see sources for the other usage.  The  
first few hits on google support the strictly-greater definition....

Ken

---

From: Frank Ellermann <[email-masked]>
Date: Fri, 17 Feb 2006 19:34:21 +0100

Ken Raeburn wrote:

> I'd be surprised to see sources for the other usage.

A "Dictionary of mathematics" offers both definitions, first
what you found f(x) > f(y) for x > y.   Followed by the other
definition f(x) >= f(y), where the first case would be called
"strictly monotone".  I vaguely recall that "strict" (in the
German version), it's not completely unusual.

                          Bye, Frank

---

From: Henrik Levkowetz <[email-masked]>
Date: Fri, 17 Feb 2006 19:41:40 +0100

Hi Ken,

> element is strictly greater than the previous element.

Tom's definition is also correct.  A "strictly monotonically increasing
sequence" has each term larger than its predecessor, but a "monotonically
increasing sequence" in most definitions has each term equal to or
larger than its predecessor.  However in some contexts "monotonically
increasing" seems to be synonymous with "strictly monotonically increasing",
conforming to your definition.

This is both what I remember from studies a long time ago, and what
seems to be indicated in the online references I checked.

As to IETF usage, I would applaud us using the same definitions
as the rest of the world.

	Henrik

---

From: Elwyn Davies <[email-masked]>
Date: Fri, 17 Feb 2006 19:19:19 +0000

Hi.

> less than its predecessor, so that
On the definition of monotonic increasing: I just checked my memory with 
my copy of Apostol (Mathematical Analysis, vintage 1968 or so) and 
monotonic increasing implies element (n+1) greater than or equal to 
element n for all n.  'Strictly monotonic increasing' implies greater 
than.  On line 
http://www-history.mcs.st-and.ac.uk/~john/analysis/Lectures/L8.html 
confirms this.
> increasing when that is what is needed?
I just did a full text search of all the RFCs using the zvon repository 
which covers up to RFC3999.  the fragment 'monotonic' (including 
'monotonically') appears in RFCs 1323, 1379, 1644, 1889, 2326, 2681, 
3571 and 3550.  All these cases (either about timestamps or TCP sequence 
numbers)  appear to use monotonically increasing in line with the 
mathematical definition although it is possible that a couple of them 
(e.g., RFC3571, s4) ought to use strictly monotonic, although the usage 
is clear from the additional words.

In many cases the phraseology is explicitly used because the sequence 
(of tiimestamps used, for example)  does not have every possible integer 
represented.

Do you have a concrete example of your problem?

Regards,
Elwyn

---

From: "Tom.Petch" <[email-masked]>
Date: Fri, 17 Feb 2006 19:45:57 +0100

Elwyn

To be more concrete, I have some 1800 RFC readily available and find monotonic
in 54 of them from RFC677 (1975) to RFC4303.

Plucking a few at random, RFC3412 (SNMP) suggests that monotonic increasing
would avoid reuse while RFC2406 (IPsec) suggests monotonic increasing can be
used in the context of replay attacks.  (I accept that in the latter, as in many
cases, understanding the context, the whole document or set of RFC, does imply
that the sequence should be strictly increasing).  RFC2679 (IPPM) is more
mathematical in its approach, where I would expect the term to be informed by
its use in mathematical textbooks, but it appears not to be

Tom Petch

---

From: Francis Dupont <[email-masked]>
Date: Fri, 17 Feb 2006 21:37:39 +0100

In your previous mail you wrote:

=> in French we have the same thing: "monotone" is either
f(x) >= f(y) or f(x) <= f(y) for x > y and "strictement monotone"
is either f(x) > f(y) or f(x) < f(y) for x > y.

Regards

[email-masked]

PS: the preliminary agenda for the next IETF is supposed to be published
today but is not yet on the IETF meeting page?

---

From: Elwyn Davies <[email-masked]>
Date: Fri, 17 Feb 2006 20:50:33 +0000

Hmm!  I don't think I see your problem with any of the usages in the 
RFCs mentioned.  In all cases monotonically is used to express that the 
sequence is non-decreasing which is in line both with the mathematical 
definition and the Merriam-Webster online dictionary #2 sense.  In some 
of the cases the sequence required is actually strictly monotonically 
increasing but the other words make this clear, and since strictly 
monotonic sequences are also monotonic, it is not wrong.  The only one 
where there could be (IMO) a soupçon of doubt is RFC2679 where it isn't 
absolutely clear whether or not T in the (n+1)-th pair needs to be 
strictly greater than T in the nth pair, and I suspect it doesn't  
matter in this case - it certainly wouldn't break interoperability.

Regards,
Elwyn

Tom.Petch wrote:
>>> The phrase 'monotonic increasing' seems to be a Humpty-Dumpty one, used with
>>>       
> a
>   
>>> defined so that when applied to a sequence of numbers, then each number is
>>>       
> not
>   
>>> Within RFC, mostly those related to security or network management, the
>>>       
> context
>   
>>> c) each number is one greater than its predecessor (as in message
>>>       
> sequencing) .
>   
>>> Most likely, an implementation that conforms to the rest of the world
>>>       
> definition
>   
>>> security, since numbers that are intended to be used only once could be
>>>       
> reused.
>   
>>> Q1) Can anyone point me to an authoritative source that endorses the RFC
>>>       
> usage?
>   
>>> Q2) Even so, since the  rest of the world usage seems to be so widely
>>>       
> defined,
>

---

From: "Tom.Petch" <[email-masked]>
Date: Fri, 17 Feb 2006 22:06:30 +0100

I agree that there is no clear cut case where security will be compromised, but
as long as RFC eg RFC1510 (kerberos) tie the concept of nonce to a monotonic
increasing sequence, I think the risk is there and could easily be avoided if we
started using the term 'strictly increasing' instead.

Of the RFC I have looked at, RFC3412 (SNMP) is probably the one I would most
question, since it suggests that a monotonically increasing integer will avoid a
reuse of outstanding values; for me, this is a clear case of 'strictly
increasing'.

Tom Petch

---

From: Ken Raeburn <[email-masked]>
Date: Fri, 17 Feb 2006 18:09:39 -0500

Huh.  You learn somethin' new every day...

> started using the term 'strictly increasing' instead.

Fortunately, it just so happens that we dropped that text in updating  
1510=>4120. :-)

Ken

---

From: Joe Touch <[email-masked]>
Date: Sat, 18 Feb 2006 10:55:16 -0800

> less than its predecessor, so that

There are two variants:

	monotonic increasing
		sequence where (i+1)>=(i)
		which applies to all of the above

		in math, monotonic always includes equality

	strictly monotonic increasing
		sequence where (i+1)>(i)
		which applies to all except the first two examples

		this is also known as "non decreasing", as Ken noted

a constant sequence is one which is both monotonic increasing and
monotonic decreasing.

> c) each number is one greater than its predecessor (as in message sequencing) .

RFCs tend to describe integer sequences (vs. real or other kinds of
numbers). Most of the uses I'm familiar with for sequence numbers in
RFCs don't care if numbers are skipped, so I'm not sure this definition
is typical. (can you give an example if not?)

The above is an arithmetic integer sequence (constant delta between
terms) that is strictly monotonic increasing and maximally compact.
Informally, this might be referred to as a "sequential", but
mathematically a sequence is just an ordered list of numbers.

If (c) is changed to omit "one", this defines is monotonic increasing
integer sequence.

If (c) is changed to "at least one", this defines a strictly monotonic
integer sequence.

> increasing when that is what is needed?

I would agree with Q2.

Joe