Subject: [saag] Predictable Numeric Identifiers -- progress?

From: Fernando Gont <[email-masked]>
Date: Mon, 3 Jul 2017 22:49:59 +0300

Folks,

We have published a revision of a number of I-Ds we had published on the
topic of "security/privacy properties of numeric identifiers", in the
hopes of helping improving the security and privacy properties of the
numeric identifiers employed in IETF protocols.

The main revised I-D is available at:
<https://www.ietf.org/internet-drafts/draft-gont-predictable-numeric-ids-01.txt>

Based on feedback received from SAAG, we have also published the same
content, but split into three stand-alone document (which might be
easier to digest and progress):

* History of flawed numeric identifiers:
<https://www.ietf.org/internet-drafts/draft-gont-numeric-ids-history-02.txt>

* Generation of numeric identifiers:
<https://www.ietf.org/internet-drafts/draft-gont-numeric-ids-generation-01.txt>

* A proposed update to RFC3552, wrt numeric identifiers:
<https://www.ietf.org/internet-drafts/draft-gont-numeric-ids-sec-considerations-01.txt>

The first version of these I-Ds were published one year ago now, and to
some extent were stalled waiting for progress on rfc3552bis. As
expected, rfc3552bis will take time to be published, but the IETF is
still published documents with no proper requirements regarding numeric
I-Ds... which is not a good thing.

At this point we'd like to receive feedback on the topic (whether for
the main/big document, or for the split I-Ds), and also would like to
make progress on these document.

Thoughts?

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: Yoav Nir <[email-masked]>
Date: Mon, 3 Jul 2017 23:57:47 +0300

> On 3 Jul 2017, at 22:49, Fernando Gont <[email-masked]> wrote:

<snip/>

> I-Ds... which is not a good thing.

I think at this point it is very clear that there is no energy behind the rfc3552bis effort, and that it is not going forward.

Whatever the merits and disposition of the predictable numeric identifier work, it should not be stalled waiting for rfc3552bis.

Hope this helps

Yoav

---

From: Fernando Gont <[email-masked]>
Date: Tue, 4 Jul 2017 00:57:17 +0300

> Whatever the merits and disposition of the predictable numeric identifier work, it should not be stalled waiting for rfc3552bis.

Agreed.

> Hope this helps

Indeed!

Thanks,

---

From: Loganaden Velvindron <[email-masked]>
Date: Tue, 4 Jul 2017 11:51:52 +0400

>> Whatever the merits and disposition of the predictable numeric identifier work, it should not be stalled waiting for rfc3552bis.

[Speaking for myself],

What is there left to be done for RFC3552bis ?

-- 
Join us for the AFRINIC-27 meeting in Lagos, Nigeria, 26November to 02
December 2017

---

From: Yoav Nir <[email-masked]>
Date: Tue, 04 Jul 2017 13:15:54 +0300

> What is there left to be done for RFC3552bis ?

Pretty much everything.

I've converted the old RFC 3552 into XML and updated some of the
references to newer RFCs for things like IPsec, TLS and the like. 

We asked for community participation in making substantive changes, but
got no emails at all, even after prodding a few times in SAAG meetings.

So we figured there was not enough energy to do this.

It's missing a modernization of the advice, probably a replacement or
elimination of the examples, and perhaps some privacy / mass
surveillance text.

Yoav