Paul Thorpe

5/16/2002

8:53:46 AM

Hi Monica

Paul Thorpe

5/16/2002

8:53:53 AM

You are the first one here.

Paul Thorpe

5/16/2002

8:54:30 AM

Hello Paul

Paul Thorpe

5/16/2002

8:54:46 AM

Our Chairman is not here yet

Paul GEROME

5/16/2002

8:55:15 AM

Hello I am here

Paul Thorpe

5/16/2002

8:55:52 AM

We will wait for others to join, then put up the agenda and minutes.

Paul GEROME

5/16/2002

8:55:58 AM

any idea how long this meeting may last?

Paul Thorpe

5/16/2002

8:56:07 AM

Phil suggested 1 hour

Paul GEROME

5/16/2002

8:56:38 AM

wonderful I stand by my laptop

Paul Thorpe

5/16/2002

8:56:56 AM

Welcome John

John Larmouth

5/16/2002

8:57:10 AM

Hi folks

Paul Thorpe

5/16/2002

8:57:36 AM

Still waiting for Phil

John Larmouth

5/16/2002

8:57:51 AM

Can't start without the Chairman!

John Larmouth

5/16/2002

8:58:04 AM

Is Bancroft and Alessandro joining us?

John Larmouth

5/16/2002

8:58:09 AM

And Ed Day?

Paul GEROME

5/16/2002

8:58:15 AM

I spoke at lenght with Dr. Phil Griffin in Seoul and he said that I may input in the device level categorization

Paul Thorpe

5/16/2002

8:58:48 AM

Ed Day ran a test with me, so I expect him to join.

John Larmouth

5/16/2002

8:58:52 AM

What sort of input have in mind for the device level categorisation?

John Larmouth

5/16/2002

8:59:05 AM

Do you have a document to share?

Paul GEROME

5/16/2002

9:00:20 AM

Greetings to Pr. John, your friend Harold (Hal) Folts was in Seoul and remember you with happiness , he'll like to talk to you sometimes, I'll send you his details in afurther e-mail

John Larmouth

5/16/2002

9:00:20 AM

No reply. Have I dropped out?

John Larmouth

5/16/2002

9:00:45 AM

It would be nice to meet with Hal again.

John Larmouth

5/16/2002

9:00:54 AM

How is his submariner activities going?

Paul GEROME

5/16/2002

9:01:14 AM

docs will be sent soon to you

Paul GEROME

5/16/2002

9:01:30 AM

Phil have them, said he

John Larmouth

5/16/2002

9:01:35 AM

And Monica, I don't think we have met????

John Larmouth

5/16/2002

9:01:45 AM

Are you from the security or the biometrics area?

Paul Thorpe

5/16/2002

9:01:54 AM

Monica was in Barcelona

John Larmouth

5/16/2002

9:01:59 AM

OOps!

John Larmouth

5/16/2002

9:02:07 AM

I often do that! Sorry Monica!

John Larmouth

5/16/2002

9:02:36 AM

Ah, we have Alessandro

Alessandro Triglia

5/16/2002

9:02:50 AM

Hi everybody

Paul Thorpe

5/16/2002

9:02:50 AM

Welcome Phil

Bancroft Scott

5/16/2002

9:03:00 AM

Howdy, y'all.

Paul Thorpe

5/16/2002

9:03:13 AM

Who put up the whiteboard?

Phil Grifin

5/16/2002

9:03:19 AM

Hello.

John Larmouth

5/16/2002

9:03:21 AM

Gosh, we must be almost quorate!

Paul Thorpe

5/16/2002

9:03:32 AM

Do we have a document to share to get started? Agenda?

Paul GEROME

5/16/2002

9:03:43 AM

I am currently engaged in categorization (coherent!) of all possible telebiometric devices to modelize them neatly

Phil Grifin

5/16/2002

9:03:59 AM

Lets start with the text file I just sent to the list named

Phil Grifin

5/16/2002

9:04:05 AM

Agenda.txt

Monica Martin

5/16/2002

9:04:18 AM

How do we get voice? I called the number and was unsuccessful.

Paul Thorpe

5/16/2002

9:04:20 AM

Can your share it, or would you like me to find the email

Phil Grifin

5/16/2002

9:04:44 AM

Paul, please share agenda.txt

Paul Thorpe

5/16/2002

9:04:51 AM

We can't use voice with multiple people in this version of NetMeeting.

Monica Martin

5/16/2002

9:05:11 AM

Do we have a call in number other than NetMeeting to supplement?

Paul Thorpe

5/16/2002

9:05:21 AM

Not this time.

Monica Martin

5/16/2002

9:05:24 AM

Ok

Phil Grifin

5/16/2002

9:05:29 AM

Let me announce that the meeting is underway and that we have a quorum.

Paul Thorpe

5/16/2002

9:05:42 AM

Ed Day has joined.

Phil Grifin

5/16/2002

9:05:42 AM

Let me ask that Paul keep minutes please.

Paul Thorpe

5/16/2002

9:06:13 AM

Ok

Paul Thorpe

5/16/2002

9:06:33 AM

I will open a document, but it would be good to have the agenda up first.

Paul GEROME

5/16/2002

9:06:34 AM

I hope you mean Paul Thorpe not Paul G.

Paul GEROME

5/16/2002

9:06:59 AM

ready

Paul Thorpe

5/16/2002

9:07:00 AM

Phil, if you have that Agenda.txt handy please open it. I don't have it yet.

Phil Grifin

5/16/2002

9:07:06 AM

Yes Paul Gerome, I meant Paul Thorpe.

Paul GEROME

5/16/2002

9:07:14 AM

I do not either

Ed Day

5/16/2002

9:07:37 AM

This is Ed Day signing on.. what have I missed?

Paul Thorpe

5/16/2002

9:07:53 AM

Nothing yet. we are just starting

Phil Grifin

5/16/2002

9:08:55 AM

Paul, I've added the agenda.txt file to the shared

Phil Grifin

5/16/2002

9:09:04 AM

files list but I do not know how to display the file

John Larmouth

5/16/2002

9:09:15 AM

Does this help?

John Larmouth

5/16/2002

9:09:20 AM

You should all be able to see the Agenda.

Paul Thorpe

5/16/2002

9:09:27 AM

Yes. Thanks John

John Larmouth

5/16/2002

9:09:52 AM

Agenda item 1 then?

John Larmouth

5/16/2002

9:10:29 AM

All dates in 1 to 3 are Ok with me. What about the rest of you?

Paul Thorpe

5/16/2002

9:10:54 AM

May 30 is not good for me

John Larmouth

5/16/2002

9:11:22 AM

Phil? Suggest another date?

Paul GEROME

5/16/2002

9:11:32 AM

everything perfect so far

Paul Thorpe

5/16/2002

9:11:32 AM

June 27 may also be a problem

Paul Thorpe

5/16/2002

9:11:47 AM

June 13 is fine

Phil Grifin

5/16/2002

9:11:50 AM

One moment and I will suggest another date for Ma7 30

Monica Martin

5/16/2002

9:11:51 AM

June 27 is Interoperability Summitt

Phil Grifin

5/16/2002

9:12:24 AM

Paul, How about May 29, May 28 or 31

Paul Thorpe

5/16/2002

9:12:56 AM

May 28 is fine, May 29 overlaps UBL

Phil Grifin

5/16/2002

9:13:44 AM

Is May 28 at noon OK for each of you?

John Larmouth

5/16/2002

9:13:47 AM

May 28 is OK with me.

Monica Martin

5/16/2002

9:13:50 AM

Yes

Ed Day

5/16/2002

9:13:54 AM

Yes

Paul GEROME

5/16/2002

9:14:01 AM

yes

Bancroft Scott

5/16/2002

9:14:02 AM

Yes

John Larmouth

5/16/2002

9:14:10 AM

Has Paul brought up the minutes?

John Larmouth

5/16/2002

9:14:23 AM

We need to document May 28.

Alessandro Triglia

5/16/2002

9:14:37 AM

May 28 is OK for me

Phil Grifin

5/16/2002

9:15:02 AM

So we agree the next meeting is May 28 at noon.

Phil Grifin

5/16/2002

9:15:22 AM

What about 2.? How is June 13 at noon?

John Larmouth

5/16/2002

9:16:00 AM

OK with me.

Ed Day

5/16/2002

9:16:01 AM

OK with me

Alessandro Triglia

5/16/2002

9:16:06 AM

OK

Monica Martin

5/16/2002

9:16:09 AM

Yes

John Larmouth

5/16/2002

9:16:37 AM

Everyone else?

Bancroft Scott

5/16/2002

9:17:02 AM

Fine by me.

Phil Grifin

5/16/2002

9:17:07 AM

Let's make sure Paul can come as he has the IP address.

Paul Thorpe

5/16/2002

9:17:22 AM

June 13 is fine

John Larmouth

5/16/2002

9:17:23 AM

Paul said he was OK for that one.

John Larmouth

5/16/2002

9:17:29 AM

Not for the 27th tho'

Phil Grifin

5/16/2002

9:17:47 AM

Then I assume that we can minute that June 13 is agreed.

Paul Thorpe

5/16/2002

9:17:58 AM

Done

Paul GEROME

5/16/2002

9:18:01 AM

ok

John Larmouth

5/16/2002

9:18:06 AM

Paul already has!

Phil Grifin

5/16/2002

9:18:10 AM

Now item 3. How about June 26

Paul Thorpe

5/16/2002

9:18:14 AM

Have I missed any attendees?

John Larmouth

5/16/2002

9:18:33 AM

Looks OK to me

Monica Martin

5/16/2002

9:18:37 AM

Conflicts with Interoperability Summit (day or travel day).

Paul Thorpe

5/16/2002

9:18:56 AM

I will be away on June 27

Phil Grifin

5/16/2002

9:19:07 AM

How about June 25?

Monica Martin

5/16/2002

9:19:12 AM

OK

John Larmouth

5/16/2002

9:19:16 AM

OK

Ed Day

5/16/2002

9:19:20 AM

OK

Alessandro Triglia

5/16/2002

9:19:35 AM

OK

Paul Thorpe

5/16/2002

9:19:48 AM

The last two weeks of June are not good for me.

Monica Martin

5/16/2002

9:20:03 AM

How about early July?

Paul Thorpe

5/16/2002

9:20:23 AM

Sorry, My calendar was forward one month

Paul Thorpe

5/16/2002

9:20:29 AM

June is fine July is not

Phil Grifin

5/16/2002

9:20:31 AM

How about July 11?

Paul GEROME

5/16/2002

9:20:34 AM

ealy july ok too

John Larmouth

5/16/2002

9:20:43 AM

Try agan for June 27?

Paul Thorpe

5/16/2002

9:20:50 AM

Not for Monica

John Larmouth

5/16/2002

9:21:07 AM

Suggestion Monica?

Monica Martin

5/16/2002

9:21:08 AM

You can proceed without me if it works for team.

John Larmouth

5/16/2002

9:21:19 AM

Let's try and keep you in.

Paul Thorpe

5/16/2002

9:21:23 AM

Is anothere day that week ok for you Monica?

Phil Grifin

5/16/2002

9:21:28 AM

Bancroft, Can you host the NetMeeting if Paul can not?

John Larmouth

5/16/2002

9:21:46 AM

Paul is not the problem at the moment.

Paul Thorpe

5/16/2002

9:21:51 AM

Phil, I will be here in June. I mixed up the months

Monica Martin

5/16/2002

9:21:51 AM

June 28 later

Bancroft Scott

5/16/2002

9:22:04 AM

Regarding hosting, I'll have to check. Potential firewall problems.

John Larmouth

5/16/2002

9:22:12 AM

June 28 is OK with me.

Paul Thorpe

5/16/2002

9:22:21 AM

Fine with me.

Bancroft Scott

5/16/2002

9:22:25 AM

June 28 is okay with me

Ed Day

5/16/2002

9:22:29 AM

OK

Phil Grifin

5/16/2002

9:22:35 AM

June 28 is OK by me

John Larmouth

5/16/2002

9:22:44 AM

Sounds like time to minute it!

Phil Grifin

5/16/2002

9:22:55 AM

Yes minute June 28 at noon

Paul Thorpe

5/16/2002

9:23:17 AM

done

Phil Grifin

5/16/2002

9:23:19 AM

To cap this, we have May 28, June 13 and June 28 at noon

John Larmouth

5/16/2002

9:23:26 AM

Can I suggest item 4 is approved Nem Con?

Paul GEROME

5/16/2002

9:23:43 AM

ok

Phil Grifin

5/16/2002

9:23:46 AM

ok

Ed Day

5/16/2002

9:23:49 AM

ok

Monica Martin

5/16/2002

9:24:06 AM

I abstain. I am not a security expert but will do my best

Bancroft Scott

5/16/2002

9:24:13 AM

okay

John Larmouth

5/16/2002

9:24:40 AM

I forgot to say "Assuming Monica is willing!"

Paul Thorpe

5/16/2002

9:24:42 AM

What do you want in the minutes for this?

Phil Grifin

5/16/2002

9:25:04 AM

I talked with Monica about doing this as I have a goal to add to SSJC the users of security standards, the other groups in OASIS that must use our work.

Monica Martin

5/16/2002

9:25:04 AM

Just provide some criteria and I'll go for it.

John Larmouth

5/16/2002

9:25:06 AM

A copy of the agenda item, I suggest,, saying "Approved Nem Con.

Phil Grifin

5/16/2002

9:25:24 AM

On to the Schema Issues item 1

Phil Grifin

5/16/2002

9:25:50 AM

I wish only to support those algorithms approved for use in X9, for financial services industry.

John Larmouth

5/16/2002

9:25:54 AM

Why do you want to restrict things like these items, Phil?

John Larmouth

5/16/2002

9:26:14 AM

X9 is not the only actor in the world. The US does not run the world!

John Larmouth

5/16/2002

9:26:23 AM

Where is Olivier or Fabrice?

Phil Grifin

5/16/2002

9:26:23 AM

So that I do not support algorithms that will result in a

Phil Grifin

5/16/2002

9:26:40 AM

protocol that X9 will not use

Monica Martin

5/16/2002

9:26:53 AM

What are other options that could be considered?

Phil Grifin

5/16/2002

9:26:54 AM

Remember that the set of algorithms will be extensible, so

John Larmouth

5/16/2002

9:27:16 AM

Surely X9.84 is independent of actual algorithms, and we should be as well.

Phil Grifin

5/16/2002

9:27:20 AM

others can add any that they need. For example, in IETF work you might see MD5 used

John Larmouth

5/16/2002

9:27:33 AM

They have OIDs, and that is all we care about, surely????

Monica Martin

5/16/2002

9:27:53 AM

Perhaps we should consider verbage in the specification that says SHOULD and allow for the use of others? Thoughts?

John Larmouth

5/16/2002

9:28:10 AM

What do we mean by "suppport"?

Phil Grifin

5/16/2002

9:28:19 AM

But MD5 will not be used by most banks in the world, as this family of algorithms has been attacked. SHA-1 has no known attacks

Alessandro Triglia

5/16/2002

9:28:26 AM

Phil, I assumed the priority of XCBF work was, initially, on aligning X9.84 to the BioAPI BIR (phase 1). Why are we dealing with algorithm and certificate issues now?

Phil Grifin

5/16/2002

9:28:43 AM

By support, I mean that we state for digests that the

Monica Martin

5/16/2002

9:28:45 AM

I am approaching it from a specification requirements standpoint - perhaps initially SHA-1 is used.

Phil Grifin

5/16/2002

9:28:54 AM

compliant application shall support SHA-1.

John Larmouth

5/16/2002

9:29:11 AM

I agree with Alessandro. We have a protocol that makes no decisions on algorithms- and rightly so. We should not change that.

Paul Thorpe

5/16/2002

9:29:48 AM

Phil, are you saying "at least" SHA-1?

John Larmouth

5/16/2002

9:29:57 AM

If you want to mandate some algorithms that people have to support, I guess yo could, but that is not in the spirit of most security protocolks.

Bancroft Scott

5/16/2002

9:30:00 AM

I too agree with Alessandro.

Phil Grifin

5/16/2002

9:30:24 AM

No. You guys are wrong. X9.84 says right in the ASN.1 that only X9 algorithms are apporved. I wish only to flesh this statement out and list the actual algorithms and parameters that are to be specifically supported.

John Larmouth

5/16/2002

9:30:28 AM

Algotiyhms get invented, get busted, are the flavour of the month, etc.

Phil Grifin

5/16/2002

9:30:50 AM

In practice there are few signature schemes that have

John Larmouth

5/16/2002

9:30:54 AM

We are NOT an X9 standard. We are an international standard.

Monica Martin

5/16/2002

9:30:59 AM

Paul, could you document this pre-requisite Phil provided?

Phil Grifin

5/16/2002

9:31:11 AM

commercial value. But we use ... to allow for what you state.

Paul Thorpe

5/16/2002

9:31:24 AM

Please let me know what you want in the minutes.

Phil Grifin

5/16/2002

9:31:33 AM

We are based on X9.84 as our schema.

Bancroft Scott

5/16/2002

9:31:34 AM

Should we not be focussing the discussion on Phase 1 issues (BIR and X9.84 alignment) instead of Phase 2 and 3?

John Larmouth

5/16/2002

9:31:50 AM

If you want to say "Only X9 approved", I would much prefer that text to a listing of actual algorithms.

John Larmouth

5/16/2002

9:31:55 AM

Otherwise, we will be dated.

John Larmouth

5/16/2002

9:32:00 AM

Approved as of what date?

Paul Thorpe

5/16/2002

9:32:58 AM

Shall I minute something here? If so what?

Phil Grifin

5/16/2002

9:33:01 AM

You have this wrong John. If we do not list the actual algorithms such as SHA-1, we leave wach implementor to go ut and find the OID and parameters

Alessandro Triglia

5/16/2002

9:33:13 AM

Is everybody still there?

John Larmouth

5/16/2002

9:33:17 AM

I think that to take decisions on things like these issues really needs them to have been aired and discussed on e-mail prior to the meeting, not simply asking for approval when no-one has seen the proposal before the meeting, and has not had any chance to discuss it.

Monica Martin

5/16/2002

9:33:18 AM

Yes

Phil Grifin

5/16/2002

9:33:21 AM

SHA-1 is the only algorithm approved by X9

Bancroft Scott

5/16/2002

9:34:08 AM

I agree with John. Further, I think that the first objective should be to settle Phase 1 issues, not Phase 2/3 ones.

Monica Martin

5/16/2002

9:34:09 AM

From a high-level draft and requirements perspective, should we allow for SHA-1 and discuss if other requirements must be derived or defined?

Phil Grifin

5/16/2002

9:34:50 AM

Monica, yes. That is the point of stating support for SHA-1 and leaving the set open...

John Larmouth

5/16/2002

9:35:16 AM

At the end of the day, this comes down to saying which information objects HAVE to be supported, and which have to be rejected as unsupported. It is a conformance detail that really does not affect our work.

Phil Grifin

5/16/2002

9:35:19 AM

When AES is approved we will likely need to add this

Monica Martin

5/16/2002

9:35:22 AM

I would suggest then that we consider the first point on SHA-1 and leave a shell to open discussion on future support.

John Larmouth

5/16/2002

9:35:50 AM

Supporting different algorithms has NO implications on the protocols and/or formats we are producing.

Phil Grifin

5/16/2002

9:36:08 AM

But also, if any of us has customers that need to support some other algorithm, the set is still open to such use.

John Larmouth

5/16/2002

9:36:17 AM

What do you mean by "support", Monica?

Monica Martin

5/16/2002

9:37:14 AM

I am using requirements legalese...if you look at ISO 11179 it talks about SHOULD, SHALL, etc. You can provide the capability (open option) to support another digest in the future. If you don't agree with "support," please suggest the appropriate text.

Phil Grifin

5/16/2002

9:37:22 AM

Support for algorithms has EVERYTHING to do with interworking John. We must have at least one SHALL support for each category of algorithm or there will be no way to interoperate.

John Larmouth

5/16/2002

9:37:51 AM

Boy! That differs a lot from X9.84. But I agree with the sentiment!

John Larmouth

5/16/2002

9:38:29 AM

But I still say that this is detailed text to be embedded in the right place in our document. In some places we may require such support, in other places not.

Phil Grifin

5/16/2002

9:39:07 AM

For digest, PKIX supports MD2, MD5 and SHA-1. But MD2 has been deprecated and MD5 is suspect, so X9 will support neither MD algorithm.

John Larmouth

5/16/2002

9:39:21 AM

I will go along with "It was agreed that we should make support for SHA-1 mandatory in relevant places in our standard."

Phil Grifin

5/16/2002

9:39:31 AM

Great.

John Larmouth

5/16/2002

9:39:58 AM

"But the standard should be capable of working with any algorithm that might be approved in the future."

Monica Martin

5/16/2002

9:40:01 AM

Work requirements specifically later - concentrate on objectives.

Phil Grifin

5/16/2002

9:40:34 AM

Can we minute Monica's text should form the basis in our document and we will revisit this issue as we go along and refine? And yes John, XCBF must be open to work with any algorithm.

John Larmouth

5/16/2002

9:40:36 AM

Anything we can now minute?

John Larmouth

5/16/2002

9:40:49 AM

My feeling is that decisions on this stuff are very premature.

Monica Martin

5/16/2002

9:40:52 AM

:<)

Bancroft Scott

5/16/2002

9:41:09 AM

I too feel that any decision on this is also VERY premature.

Monica Martin

5/16/2002

9:41:11 AM

I understand, John. That is why I suggest capture objectives.

Phil Grifin

5/16/2002

9:41:31 AM

Immature, perhaps. But we need a straw man to start with and future discussion and refinement.

Paul Thorpe

5/16/2002

9:41:34 AM

Please tell me what to type.

John Larmouth

5/16/2002

9:41:48 AM

"The objective of the security-related work is to provide protocol and format definitions that are independent of actual algorithms used ...

John Larmouth

5/16/2002

9:42:03 AM

... but requirements on support for specific algorithms may be added later.

Phil Grifin

5/16/2002

9:42:12 AM

Almost

Phil Grifin

5/16/2002

9:42:30 AM

We need to state that for now we will pick likely

Phil Grifin

5/16/2002

9:42:48 AM

candidate algorithms, and discuss and refine in the future

Monica Martin

5/16/2002

9:43:06 AM

Candidate sounds workable (think objective)

Phil Grifin

5/16/2002

9:43:21 AM

I suggest that we apply this statement to items 2 and 3 as well

John Larmouth

5/16/2002

9:43:23 AM

Why do we need to get to this sort of detail?

John Larmouth

5/16/2002

9:43:39 AM

In some communities, some algorithms will not be used. In others they may be.

John Larmouth

5/16/2002

9:43:44 AM

In the future there will be many others

Phil Grifin

5/16/2002

9:43:50 AM

So we can build product

Phil Grifin

5/16/2002

9:44:05 AM

The ... lets you do as you need in your community

John Larmouth

5/16/2002

9:44:24 AM

Then we need specific profiles, in an Annex, that can be easily changed and updated.

Phil Grifin

5/16/2002

9:44:28 AM

And you are very much right that different countries will want to use their favorite algorithm

John Larmouth

5/16/2002

9:44:43 AM

And producing that before the last minute would not be a good idea.

Phil Grifin

5/16/2002

9:45:19 AM

Not really profiles, a less formal mechanism. We do need at least ONE SHALL support digest for everyone

Paul Thorpe

5/16/2002

9:45:20 AM

Please look at the proposed minute entry

John Larmouth

5/16/2002

9:45:31 AM

I think we are into the incorporation of what OSI called "ISPs" into our base stanmdard. Not really a good idea. Maybe OK in an Annex.

John Larmouth

5/16/2002

9:46:10 AM

Please change "will be required" to "is likely to be required".

Phil Grifin

5/16/2002

9:46:18 AM

Paul, I do not see the proposed entry

Paul Thorpe

5/16/2002

9:47:02 AM

It is just above Future meetings

Monica Martin

5/16/2002

9:47:18 AM

Note we will need to revise verbage to adhere to ISO 11179. Suggest this be a normative reference.

Paul Thorpe

5/16/2002

9:47:25 AM

Who dropped out?

Monica Martin

5/16/2002

9:47:48 AM

John Gerome and Ed Day

Paul Thorpe

5/16/2002

9:47:52 AM

It looks like Ed Day is gone

Phil Grifin

5/16/2002

9:48:02 AM

Agree with the minute. Also will agree to minute Monicas proposal on 11179

John Larmouth

5/16/2002

9:48:16 AM

Certainly if we wish to mandate support for SHA-1, we absolutely have to have a normative reference!

Phil Grifin

5/16/2002

9:48:25 AM

We still have a quorum

Phil Grifin

5/16/2002

9:48:43 AM

John, yes on SHA-1

John Larmouth

5/16/2002

9:48:59 AM

But what has an ISO standard got to do with this work? I have seen no reference so far to ISO 11179. Is it an IS or a DIS? What is its subject?

Phil Grifin

5/16/2002

9:49:18 AM

John, X9.84 references this as BS 1179

Phil Grifin

5/16/2002

9:49:31 AM

The 11179 is a better reference

Phil Grifin

5/16/2002

9:49:49 AM

We could also suggest this change in X9.84

Monica Martin

5/16/2002

9:49:50 AM

It defines the terminology used in requirements development - ISO 11179. It is used as a reference on many OASIS specifications.

John Larmouth

5/16/2002

9:49:53 AM

I need to check that - still fuzzy on X9.84. Is this the Security Requirements stuff?

Paul Thorpe

5/16/2002

9:49:53 AM

What would you like in the minutes?

Phil Grifin

5/16/2002

9:50:09 AM

Paul, yes please minute

Paul Thorpe

5/16/2002

9:50:36 AM

What is the agreement?

Phil Grifin

5/16/2002

9:50:36 AM

Moving on to 2 and 3. Can we go the same way as on one?

Phil Grifin

5/16/2002

9:51:00 AM

Paul the agreement was Monicas suggestion that 11179 be normative ref

Paul Thorpe

5/16/2002

9:51:02 AM

Ed Day has rejoined

Bancroft Scott

5/16/2002

9:51:11 AM

Paul, you did not capture John's request: John Larmouth Please change "will be required" to "is likely to be required".

John Larmouth

5/16/2002

9:51:16 AM

On a broader front, do these proposals mean tht we primarily see the XCBF work as contributing on the security front, not the biometric integration front?

Phil Grifin

5/16/2002

9:52:11 AM

XCBF is a security standard

Paul Thorpe

5/16/2002

9:52:11 AM

John's change has been added, but what was the new item about 11179 to be added?

Phil Grifin

5/16/2002

9:52:32 AM

Please look at Monica's proposal/

Paul Thorpe

5/16/2002

9:53:40 AM

Please give me text.

Paul Thorpe

5/16/2002

9:53:52 AM

Ed Day has dropped again

Paul Thorpe

5/16/2002

9:54:58 AM

Anyone still there?

Bancroft Scott

5/16/2002

9:55:01 AM

Yup

Monica Martin

5/16/2002

9:55:08 AM

Yes

Phil Grifin

5/16/2002

9:55:11 AM

Monica suggested that ISO/IEC 11179 be added to XCBF as a normative reference.

John Larmouth

5/16/2002

9:55:33 AM

I would like to suggest that Phil e-mails a coherent proposal for conformance requirements related to the schema issues bullets, with proposed text and and a rationale, and we discuss it on e-mail and take a decision at our next meeting

John Larmouth

5/16/2002

9:55:50 AM

None of us have had enough time to think about these issues, of which there are two:

John Larmouth

5/16/2002

9:56:07 AM

Do we really want to list algorithms, and if so where and in what way?

John Larmouth

5/16/2002

9:56:14 AM

Second, which algorithms.

Phil Grifin

5/16/2002

9:56:24 AM

John, I agree and ask Paul to also minute this

Phil Grifin

5/16/2002

9:56:26 AM

John,

Phil Grifin

5/16/2002

9:56:39 AM

See the ASN.1 schema I posted. Look at the IOSets

Phil Grifin

5/16/2002

9:56:50 AM

for algorithms I started fleshing out

Paul Thorpe

5/16/2002

9:57:33 AM

Paul Gerome has rejoined

John Larmouth

5/16/2002

9:57:43 AM

On the Monica minute, as we don't have a base document yet (unless that is supposed to be the doc that *I* sent round) I am not sure what we are adding to!

Phil Grifin

5/16/2002

9:58:07 AM

John, this does not mean to spend a lot of text in XCBF discussing algorithms. It is an ASN.1 schema issue so that folks who build product can interwork primarily

Phil Grifin

5/16/2002

9:58:15 AM

John yours is the base document

Phil Grifin

5/16/2002

9:59:04 AM

Paul, I'm waiting for the minutes to refresh.

Paul Thorpe

5/16/2002

9:59:28 AM

Is that better?

Phil Grifin

5/16/2002

9:59:30 AM

Paul please minute John's request that I send

John Larmouth

5/16/2002

9:59:34 AM

OK. We have no normative references yet. I agree to adding IS 1179 (I prsume it IS and IS?), but we need e-mail contributions on what else should be added.

Phil Grifin

5/16/2002

9:59:42 AM

more argument for dscussion to the list

John Larmouth

5/16/2002

9:59:53 AM

I guess it is basically X9.84, CMS.CBEFF, and BioAPI 1.1?

Paul Thorpe

5/16/2002

10:00:02 AM

Ed Day has rejoined

Paul Thorpe

5/16/2002

10:01:18 AM

Phil, is that what you wanted?

John Larmouth

5/16/2002

10:01:20 AM

"Suggestions for what should be our full set of normative referfences should be sent to the mailing list"

Phil Grifin

5/16/2002

10:01:22 AM

X9.84 is the glue that binds into a common format BioAPI and CBEFF. See the head of the XCBF web page.

Phil Grifin

5/16/2002

10:02:13 AM

John, I suggest that you look at the normative references in X9.84 for a straw man list of references and add the new X.693

John Larmouth

5/16/2002

10:02:49 AM

We want to simply add all the X9.84 references?

John Larmouth

5/16/2002

10:02:54 AM

I am opposed to that.

Phil Grifin

5/16/2002

10:03:06 AM

Paul, the More arguments minute needs to state that Phil will do this to start a broader discussion

Paul GEROME

5/16/2002

10:03:07 AM

I trust in full confidence in your aptitudes and talents to solve the formal languages issues, of which I am not great expert, I shall depart now to a meeting

John Larmouth

5/16/2002

10:03:19 AM

A large part of X9.84 is tutorial, and I am not sure we want references related to the tutorial aspects.

Paul Thorpe

5/16/2002

10:03:55 AM

Monica has rejoined

Phil Grifin

5/16/2002

10:04:03 AM

John, I merely sugeested that this list in X9.84 be considered. You are right that is has too many and also not enough.

Monica Martin

5/16/2002

10:04:04 AM

I am back - blue screen of death.

Phil Grifin

5/16/2002

10:04:47 AM

Let's hold for a second and catch up

Phil Grifin

5/16/2002

10:05:01 AM

Paul please change the "More arguments" minute

Paul Thorpe

5/16/2002

10:05:16 AM

What change would you like?

Phil Grifin

5/16/2002

10:05:27 AM

to state that Phil will send text to the list to start a discussion

John Larmouth

5/16/2002

10:05:32 AM

Action on Phil to e-mail a proposed set of normative references for agreement at our next meeting?

Phil Grifin

5/16/2002

10:05:44 AM

John, agree

Monica Martin

5/16/2002

10:05:51 AM

Yes

Phil Grifin

5/16/2002

10:05:58 AM

But let's not say for the next meeting.

Phil Grifin

5/16/2002

10:06:11 AM

Rather for discussion and resolution on the list

John Larmouth

5/16/2002

10:06:37 AM

OK by me. But I think in the OASIS rules anything that is a decision needs to be made at a meeting.

Paul GEROME

5/16/2002

10:06:52 AM

I shall send my ravings to the list to include the bottom layer specs: sensors listed, classified, categorized for your encoding super-system on which Phil has brillantly demonstrated how nicely security levels may be enhanced by your high level formal languages. So long and encouragements. I am please to contribute/ if any template available, I'll happily use them in my contributions to xcbf TC;

John Larmouth

5/16/2002

10:07:04 AM

But if we have e-mail agreement, as Editor I can add it with change marks and we can accept the changes at the next meeting.

Phil Grifin

5/16/2002

10:07:12 AM

John, If we get concensus on the list that is almost

Paul GEROME

5/16/2002

10:07:21 AM

by

Phil Grifin

5/16/2002

10:07:23 AM

like doing this Net Meeting.

Paul Thorpe

5/16/2002

10:07:27 AM

bye Gerome

Paul Thorpe

5/16/2002

10:07:37 AM

How long are we planning to go on?

Paul Thorpe

5/16/2002

10:07:45 AM

1 hr has passed.

Phil Grifin

5/16/2002

10:07:47 AM

John, yes. Editing and resolving is a great way forward

John Larmouth

5/16/2002

10:08:10 AM

I have a feeling that we have failed to let Paul G present his ideas.

Phil Grifin

5/16/2002

10:08:29 AM

No, I talked with Paul G in Seoul

John Larmouth

5/16/2002

10:08:40 AM

We have a lot of agenda items left!

Phil Grifin

5/16/2002

10:08:45 AM

I agreed to write ASN. schema for this ideas

John Larmouth

5/16/2002

10:09:00 AM

Are any of them urgent?

Phil Grifin

5/16/2002

10:09:14 AM

Items 2 and 3 I suggest that we do as we did with SHA-1 and minute text as such

Phil Grifin

5/16/2002

10:09:45 AM

Agree on items 2 and 3?

John Larmouth

5/16/2002

10:09:50 AM

I agree on agenda items 2 and 3

Monica Martin

5/16/2002

10:09:53 AM

I'll defer to the security experts on items 2 and 3.

Bancroft Scott

5/16/2002

10:09:56 AM

Phil, one more time - I think we are doing the agenda in reverse order. The issues we are tackling are ones that can be delayed without affecting our deadlines. The ones towards the bottom of the agenda are ones that we need to complete in order to make any real progress.

John Larmouth

5/16/2002

10:10:25 AM

Move to the end of the agenda and work back?

Phil Grifin

5/16/2002

10:10:40 AM

No. Agree on 2 and 3?

Paul Thorpe

5/16/2002

10:10:42 AM

Again, how long do we plan to go on?

John Larmouth

5/16/2002

10:11:12 AM

2 and 3 are agreed, I think. Just needs Paul's, minutes.

Phil Grifin

5/16/2002

10:11:20 AM

I'd like to agree on 2 and 3 first

John Larmouth

5/16/2002

10:11:30 AM

I have no dead-line. Others may.

Phil Grifin

5/16/2002

10:11:51 AM

Good. Can Paul minute 2 and 3 that I will start more discussion on these on the mailing list?

Monica Martin

5/16/2002

10:12:17 AM

Agree.

Alessandro Triglia

5/16/2002

10:12:21 AM

I disagree on EC algorithms - They are not supported by many common cryptographic libraries

Phil Grifin

5/16/2002

10:12:38 AM

Since we are running over, can we agree that I will start further discussion on each of the remaining items on the list and try to resolve these issues there?

John Larmouth

5/16/2002

10:12:44 AM

Onb agenda item 12, I agree with the spirit of it, but we must be careful that this does not produce more divergence from the BioAPI, or if it does, to resolve the divergence.

John Larmouth

5/16/2002

10:13:12 AM

I have no problems agreeing to item 11.

John Larmouth

5/16/2002

10:13:41 AM

Item 10 needs more discussion - action as proposed by Phil - discuss on the list.

Monica Martin

5/16/2002

10:13:42 AM

Other members agree?

Phil Grifin

5/16/2002

10:13:50 AM

Alessandro. I too am having trouble finding EC support that is affordable. I woudl say that this is a MAY support or a SHOULD support rather than a SHALL. I can get DSA and RSA for free anywhere

Bancroft Scott

5/16/2002

10:13:59 AM

I don't think that what Paul minuted for 2 and 3 is what we have agreed.

Paul Thorpe

5/16/2002

10:14:01 AM

Please look at the minutes for EC and DES. We have disagreement from AT

Paul Thorpe

5/16/2002

10:14:16 AM

I copied them from the Agenda

John Larmouth

5/16/2002

10:14:24 AM

You have disagreement from me top!

Paul Thorpe

5/16/2002

10:14:25 AM

Please tell me how you want it reworded

Alessandro Triglia

5/16/2002

10:14:27 AM

So, Phil, just DSA and RSA should be OK

John Larmouth

5/16/2002

10:14:38 AM

No, no, no!

Bancroft Scott

5/16/2002

10:14:47 AM

Absolutely NO.

John Larmouth

5/16/2002

10:14:55 AM

We want a similar minute to the one on algorithms (the SHA-1 stuff).

Paul Thorpe

5/16/2002

10:15:34 AM

Is adding "at least" enough

John Larmouth

5/16/2002

10:15:36 AM

We will support all algorithms at the protocol level, and will consider conformance requirements which ***is likely to include*** .....

John Larmouth

5/16/2002

10:15:52 AM

NO. "Is likely" is a key phrase.

Phil Grifin

5/16/2002

10:15:55 AM

Likely to include DSA and RSA

Monica Martin

5/16/2002

10:16:09 AM

Per 11179, you can use SHOULD, MUST or RECOMMENDED - all which leave some latitude.

Alessandro Triglia

5/16/2002

10:16:11 AM

I would like to have EC deleted

Phil Grifin

5/16/2002

10:16:22 AM

Same minute for number 3, Triple DES. Likely to include

John Larmouth

5/16/2002

10:16:26 AM

And it is key to say that the base protocol will support all algorithms, as we said in relation to SHA-1.

John Larmouth

5/16/2002

10:16:36 AM

Absolutely.

Phil Grifin

5/16/2002

10:17:09 AM

OK. Now to conclude.

John Larmouth

5/16/2002

10:17:30 AM

But don't say "we are likely to support". The phrase is "we are likely to require suppor t for". ***Our work*** will support anything (I hope).

Phil Grifin

5/16/2002

10:17:37 AM

Let us resolve that I post each of the remaining items to the list for further discussion and resolution on the list.

Alessandro Triglia

5/16/2002

10:17:56 AM

Can we get rid of EC, please?

John Larmouth

5/16/2002

10:18:19 AM

for support of at least ...

Phil Grifin

5/16/2002

10:18:23 AM

Let's leave EC as a MAY use, not SHALL

John Larmouth

5/16/2002

10:18:49 AM

"We will choose" is too strong.

Phil Grifin

5/16/2002

10:19:01 AM

AT, I don't want to have to buy crypto to deliver a product

Bancroft Scott

5/16/2002

10:19:09 AM

Monica, regarding "you can use SHOULD, MUST or RECOMMENDED ", what we are minuting is the basis for future discussion. This is not what will go into the actual standard.

Phil Grifin

5/16/2002

10:19:39 AM

Let us resolve that I post each of the remaining items to the list for further discussion and resolution on the list.

John Larmouth

5/16/2002

10:19:40 AM

And delete the minute on Triple DES, I think.

Phil Grifin

5/16/2002

10:19:51 AM

Let us resolve that I post each of the remaining items to the list for further discussion and resolution on the list.

Monica Martin

5/16/2002

10:19:53 AM

I can provide you the reference to the ISO/IEC 11179 and it explains the terminology so once we draft requirements for the specification we can use those guidelines. I can send to the list.

John Larmouth

5/16/2002

10:20:15 AM

Again, "support" is wrong. The protocol will support anything. The requirements Annex may well only list Tripole DES

Alessandro Triglia

5/16/2002

10:20:26 AM

Paul, the sentence you wrote doesn't imply that EC support will be a MAY

Phil Grifin

5/16/2002

10:20:33 AM

Monica, please send to the list as a proposal.

Monica Martin

5/16/2002

10:20:43 AM

I will do so as requested.

Paul Thorpe

5/16/2002

10:21:06 AM

I will delete 3DES for now. We need to agree what we want first.

Phil Grifin

5/16/2002

10:21:29 AM

Let us resolve that I post each of the remaining items to the list for further discussion and resolution on the list.

John Larmouth

5/16/2002

10:21:29 AM

I guess, as Editor, you want me to produce a "Conformance Requirements" Annex that will reflect the decisions in these minutes as tentative agreements?

John Larmouth

5/16/2002

10:21:57 AM

My preference is to touch them briefly, just to check they are not urgent.

Phil Grifin

5/16/2002

10:22:04 AM

John, we may want conformance in an annex. But I see it as

Paul Thorpe

5/16/2002

10:22:38 AM

as?

Phil Grifin

5/16/2002

10:22:45 AM

having the algorithms listed in the schema. When the schema is discussed the MAY, SHALL etc. text will fit in naturally

John Larmouth

5/16/2002

10:22:54 AM

A normative Annex will do for now, but if you want it in the body, we can argue about that. My main concern is that is needs to be easily ripped out and changed.

Phil Grifin

5/16/2002

10:23:12 AM

Ye of little faith ;-)

John Larmouth

5/16/2002

10:23:26 AM

Ca\n we agree Item 11?

Phil Grifin

5/16/2002

10:23:42 AM

Let's agree item 11

John Larmouth

5/16/2002

10:23:52 AM

And for Phil to e-mail on item 10?

Alessandro Triglia

5/16/2002

10:23:57 AM

Paul, your sentence suggests that EC may be required. This is not what we agreed on

Phil Grifin

5/16/2002

10:24:09 AM

Tell him AT

Alessandro Triglia

5/16/2002

10:24:32 AM

We didn't agree that EC will be required. We said that EC may be listed as a MAY item

Monica Martin

5/16/2002

10:24:34 AM

Conformance criteria can be generally gleaned from OASIS Conformance TC specification draft that has recently been released for review, I believe. I can also send.

John Larmouth

5/16/2002

10:24:47 AM

What do we want to do with item 9?

John Larmouth

5/16/2002

10:24:55 AM

I have no technical problems with it.

John Larmouth

5/16/2002

10:25:05 AM

Indeed, if my doc is the base doc, these are already in.

Phil Grifin

5/16/2002

10:25:09 AM

First John, let's all vote on agreeing item 11

John Larmouth

5/16/2002

10:25:16 AM

Agreed.

Phil Grifin

5/16/2002

10:25:49 AM

Others on 11?

Ed Day

5/16/2002

10:25:53 AM

Item 11 is OK with me

John Larmouth

5/16/2002

10:25:54 AM

By the way, could we put the URL for the XCBF page in the minutes? I keep losing it!

Paul Thorpe

5/16/2002

10:26:07 AM

fine with me. I have minuted it. Any disagreements?

Phil Grifin

5/16/2002

10:26:28 AM

Others on 11?

Monica Martin

5/16/2002

10:26:34 AM

Defer to the experts.

John Larmouth

5/16/2002

10:26:54 AM

Move to item 10?

John Larmouth

5/16/2002

10:26:59 AM

Phil to mail on this?

Paul Thorpe

5/16/2002

10:27:25 AM

John, we have already gone over our time

Phil Grifin

5/16/2002

10:27:25 AM

Yes, 10 I will email on. But I will use 10 to do 11

Phil Grifin

5/16/2002

10:27:30 AM

Let us resolve that I post each of the remaining items to the list for further discussion and resolution on the list.

Phil Grifin

5/16/2002

10:27:32 AM

Let us resolve that I post each of the remaining items to the list for further discussion and resolution on the list.

Bancroft Scott

5/16/2002

10:27:34 AM

I disagree on item 10

Phil Grifin

5/16/2002

10:27:42 AM

Let us resolve that I post each of the remaining items to the list for further discussion and resolution on the list.

Phil Grifin

5/16/2002

10:27:56 AM

Let us resolve that I post each of the remaining items to the list for further discussion and resolution on the list. This will allow us to conclude the meeting

Ed Day

5/16/2002

10:28:08 AM

agreed.

Bancroft Scott

5/16/2002

10:28:12 AM

Agreed

Phil Grifin

5/16/2002

10:28:14 AM

Agree on my resolution on a way forward?

John Larmouth

5/16/2002

10:28:15 AM

Leave all the rest for e-mail discussion then?

Paul Thorpe

5/16/2002

10:28:21 AM

yes

Monica Martin

5/16/2002

10:28:26 AM

Agreed. I will provide Conformance and ISO 11179 specifications for use.

John Larmouth

5/16/2002

10:28:35 AM

Including item 8?

Phil Grifin

5/16/2002

10:28:41 AM

I now call the meeting over. Thanks everyone.

Alessandro Triglia

5/16/2002

10:28:44 AM

The EC issue is not solved

Bancroft Scott

5/16/2002

10:28:46 AM

The most important stuff was hardly touched. Pity.

John Larmouth

5/16/2002

10:28:46 AM

Actually, Phil does not need our approval to do item 8.

Phil Grifin

5/16/2002

10:29:03 AM

AT, you and I agree on EC. We'll convince the others

John Larmouth

5/16/2002

10:29:08 AM

B, what agenda items are you referring to?

Paul Thorpe

5/16/2002

10:29:16 AM

I will send the minutes and a copy of our chat session to the list.

Monica Martin

5/16/2002

10:29:22 AM

Reember this is an iterative process and two-way communication is also important. Suggest a voice number next time.

Alessandro Triglia

5/16/2002

10:29:30 AM

I don't wish to leave the minutes in the current state

John Larmouth

5/16/2002

10:29:37 AM

I think we are rushing off rather fast, with the minutes not really agreed.

Bancroft Scott

5/16/2002

10:29:38 AM

Bottom up.

John Larmouth

5/16/2002

10:29:54 AM

Item 12 is bottom, yes?

Phil Grifin

5/16/2002

10:29:59 AM

AT, we'll need to approve the minutes, so we can argue changes

John Larmouth

5/16/2002

10:30:04 AM

Is that important at the moment?

Bancroft Scott

5/16/2002

10:30:20 AM

In particular, aligning X9.84 with BioAPI BIR, which is the Phase 1 stuff the charter rightly says we would first tackle.

John Larmouth

5/16/2002

10:30:23 AM

I made a comment on that - I support it, but the impact on BioAPI needs resolving.

Phil Grifin

5/16/2002

10:30:42 AM

We will agree the minutes later. First Paul will post and we can argue for changes. The meeting is over.

Monica Martin

5/16/2002

10:30:51 AM

OK

Alessandro Triglia

5/16/2002

10:30:55 AM

OK

Bancroft Scott

5/16/2002

10:30:57 AM

OK

John Larmouth

5/16/2002

10:30:58 AM

Ah! B is referring to the charter, not the agenda. I had misunderstood.

Monica Martin

5/16/2002

10:31:23 AM

:<) Remember today is Thursday - day before Friday.>

John Larmouth

5/16/2002

10:31:29 AM

Can we add that the minutes have not yet been approved as a true record of agreements.

John Larmouth

5/16/2002

10:31:48 AM

Normally in ASN.1 work, we try to ensure that any text minuted is agreed text.

Monica Martin

5/16/2002

10:31:49 AM

Suggest list as items for further discussion via eList and/or followup call.

Phil Grifin

5/16/2002

10:31:59 AM

John, the meeting is over. But that is a true statement and the minutes have not been approved.

John Larmouth

5/16/2002

10:32:05 AM

I have no problems working the other way, but it needs to be clear we are doing so.

Monica Martin

5/16/2002

10:32:37 AM

Signoff now?

John Larmouth

5/16/2002

10:32:41 AM

OK.

Paul Thorpe

5/16/2002

10:32:45 AM

bye?

Bancroft Scott

5/16/2002

10:32:48 AM

bye

Phil Grifin

5/16/2002

10:32:50 AM

Bye

Ed Day

5/16/2002

10:32:51 AM

bye

Paul Thorpe

5/16/2002

10:33:03 AM

See you on May 28

Alessandro Triglia

5/16/2002

10:33:06 AM

Bye