Markdown Version | Session Recording

Session Date/Time: 26 Jul 2023 00:00

secdispatch

Summary

The secdispatch meeting addressed four topics: difficulties with application client certificates, hybrid signature methods, source address validation (Risav), and workload identity across multisystem environments. The discussion focused on the applicability of the presented drafts within the IETF's scope and identifying appropriate next steps.

Key Discussion Points

• Application Client Certificates (David):
  • The core issue is the difficulty users experience in configuring applications to utilize client certificates stored in various formats and locations (e.g., PKCS#11 tokens, TPMs, certificate stores).
  • Current solutions are inconsistent across applications, crypto libraries, and operating systems, leading to user frustration and security vulnerabilities.
  • Several attendees suggested that addressing API inconsistencies may be outside the scope of the IETF, with suggestions for addressing the PKS CS related 1, 8, and 12 stuff in lamps.
  • Some discussion about the value of "doing API work" in the IETF.
• Hybrid Signature Method (Yav):
  • The draft proposed a strongly non-separable hybrid signature scheme combining classic and post-quantum algorithms to ensure both signatures are always verified.
  • Concerns were raised regarding the loss of backward compatibility, potential FIPS certification issues, and overall usefulness of hybrid signatures.
  • Some argued that the proposed construction might be a solution to the wrong problem.
  • The need for guidance from CFRG on the security properties of combining signature algorithms was highlighted.
• Source Address Validation (Risav) (Ben Schwartz):
  • Risav proposes using RPKI to distribute IPsec configuration data, enabling automated setup of site-to-site IPsec tunnels and enhancing inter-AS traffic security.
  • Questions were raised about scalability, operational complexity, and the applicability of the solution to large ASs.
  • Some attendees suggested that it wasn't solving the right problem, and that a clearer use case was needed.
  • The proposed solution was viewed by some as potentially conflicting with the end-to-end principle, despite claims that is preserves it.
• Workload Identity Across Multisystem Environments (Justin):
  • A new mailing list (whimsy) and potential BoF were announced to discuss workload identity challenges in diverse environments.
  • The scope of the effort (security, operations, etc.) remains to be determined.

Decisions and Action Items

• Application Client Certificates: Dispatch the draft to the lamps working group for further evaluation and refinement of the scope.
• Hybrid Signature Method: Requires discussion with the CFRG chair to evaluate security properties.
• Source Address Validation (Risav): Create a new mailing list for discussion. Subnet is a possibility.
• Workload Identity Across Multisystem Environments: No immediate action items other than further discussion on the new mailing list, whimsy.

Next Steps

• David to communicate the secdispatch outcome to the lamps chairs.
• Yav to contact the CFRG chairs to arrange a review of the hybrid signature method.
• Ben Schwartz to create a new mailing list for Risav discussions.
• Kathleen Moriarty to step down as a chair. A new chair will be identified before the next meeting in Prague.