Subject: [SECMECH] Desire to standardize some specific EAP mechanisms

From: Sam Hartman <[email-masked]>
Date: Thu, 14 Jul 2005 16:37:28 -0400

Comments from the EAP chairs and the IESG suggest there is a strong
desire to standardize some specific EAP mechanisms probably before the
GUAM work is done.

I think this might be doable particularly if the EAP mechanisms
standardized are things like eap-tls where there are already
alternatives for other frameworks.  The issue is simply one of timing.

The original proposal was to do that work in the EAP working group and
to (depending on BOF results) spin up secmech to do the more general
work.

I'm uncomfortable with that work being done outside the security area.
I'm also uncomfortable with two ongoing parallel efforts without
strong coordination.

I propose that if we want to take that approach we standardize the
specific mechanisms in the secmech group along with doing the more
general work.  For timing reasons we might even need to prioritize
some of the EAP work.  I think there are many advantages to doing so:

1) We become more familiar with the requirements of EAP and the same group of people doing general work get specific practical experience.

2) Since the same group of people are doing both the general and
   specific work you are likely to get better sanity checking across
   the projects.

3) You make sure the efforts don't diverge.

4) You leverage security review experience from the GSS and SASL
   comnunities and practical deployment experience from the EAP community.

If we take that approach, two things need to happen.  First, we need
to get a specific set of mechanisms to standardize early into the
charter.  Second, we would need at least one int-area chair--possibly
one of the existing EAP chairs if willing to serve--by the time a WG
is chartered.

Thanks for your consideration,

--Sam

_______________________________________________
SECMECH mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/secmech

---

From: "T. Charles Clancy" <[email-masked]>
Date: Fri, 15 Jul 2005 07:32:37 -0400 (EDT)

As an author of EAP-PAX, I've been frustrated with the standards track 
options available.  Doing the work in the EAP WG is the fastest route to 
RFC.  IMHO, there is sufficient security talent within the EAP WG to 
guarantee quality protocol development.

I certainly understand the concerns about diverging or duplicate work; 
however, my biggest concern is the overhead time.  I've been trying to get 
standards-track action for EAP-PAX for 8 months.  I suppose the existince 
of this conversation indicates progress, but I'm not enthusiastic about 
waiting another year or so.  If the proposed approach can be done in a 
timely manner, then I'm all for it.

[ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]

On Thu, 14 Jul 2005, Sam Hartman wrote:

> 1) We become more familiar with the requirements of EAP and the same 
> group of people doing general work get specific practical experience.
>