Subject: [saag] Moving forward draft-gont-predictable-numeric-ids

From: Fernando Gont <[email-masked]>
Date: Mon, 11 Apr 2016 19:43:15 -0300

Folks,

We got a lot of good feedback both on-list and off-list since we
published version -00 of our ID, and we're working on a rev to address
such feedback (thanks a lot!).

During our presentation at saag, we got some feedback on possible ways
to move this document forward. So we'd like folks to comments on this
meta issue, such that we can possibly address this one in the next rev
of this document.

Option #1: Keep the document "as is" -- i.e., address technical
feedback, but keep al the contents in the same document.

Option #2: Split the document into three documents:

   1) A Informational document which discusses all the attacks that
      have affected IETF protocols due to predictable numeric IDs

   2) A second document (BCP) that would update RFC3552 and would
      basically contain what's currently in Section 9 of our I-D.

   3) A third (BCP) document with what's left from #1 and #2 above.
      (i.e., categories, and possible algorithms for each).

Any other "option"? / Thoughts?

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 11 Apr 2016 23:53:01 +0100

> Any other "option"? / Thoughts?

Yes, I think your #1 vs. "something else" is good enough input
for the moment. (And I'd be in the "something else" camp myself
fwiw.)

I'd like to have a chance to chat with Kathleen about how we
think might be best to update 3552 before we ask folks to
commit to an opinion here. (That'll take a few more weeks as
Kathleen is still on parental leave.)

Updating 3552 involves more than just this issue, and arguably
ought not be particularly driven by this issue, so I'd prefer
that we ask another question about that later on and not right
now.

So, I'd ask for your patience and for patience from other
readers of this.

Thanks,
S.

PS: Fernando - if your thesis that it takes us 40 years to fix
stuff is correct, then I'm sure you'll also be entirely happy
to be patient for a few weeks too:-)

---

From: Fernando Gont <[email-masked]>
Date: Mon, 11 Apr 2016 20:08:21 -0300

Hi, Stephen,

> Kathleen is still on parental leave.)

Fair enough. FWIW, we'll rev the doc as a single document (option #1).
Then may change this for rev -02 based on wg input.

That said, I think Update RFC3552 != revise RFC3552. i.e., this document
could simply update RFC3552, and eventually a rev of RFC3552 could
incorporate the update (i.e., I don't think we necessarily need to
revise RFC3552 to incorporate the advice in our document...).

> ought not be particularly driven by this issue, 

I agree -- that's why I said "update RFC3552"" rather than "trigger a
revision of RFC3552".

> to be patient for a few weeks too:-)

We can certainly wait for a few weeks. That said, for correctness sake,
the amount of time it has taken to fix stuff is not really a thesis, but
empirical evidence ;-). Actually, I'd say "30+ years and counting" (as
per <https://tools.ietf.org/html/rfc7739#appendix-B>).  ;-)

Thanks,