OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

security-services message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]

Subject: [security-services] Minutes for SSTC Telecon, Tuesday Nov 27

Minutes for SSTC Telecon, Tuesday Nov 27
Dial in info: +1 334 262 0740 #856956
Minutes taken by Steve Anderson

1 -- Roll Call

- Attendance attached to bottom of these minutes.  Quorum achieved.

2 -- Review of agenda

- Creating agenda on the fly
    - Vote on issue raised by Prateek concerning Bindings/Profile
    - Review action items sent out by Prateek
    - Eve’s issue of ‘outreach’

3 -- Vote on creation of Bindings/Profile Registry, proposed by Prateek

- Charles: curious about mechanism, as this seems to be ongoing process
- Hal: in short term, TC will continue, in long term OASIS will provide
    - We’re only talking about human-readable descriptions
- Text of proposal from Prateek’s email sent 25 Nov 2001 with subject
  "Please read BEFORE formal vote at TC call on November 27"
    - "(1) The SSTC will maintain a web-page titled "Additional SAML
      Bindings and Profiles". This page will include text explaining (1)

      How to submit a binding or a profile for publication (2)
      information describing the status of such submissions (such drafts

      do not have standard status) (3) a list of drafts received by the
- Prateek: a short summary of what a bindings or profile should answer
  will be in bindings document
- Carlisle: wrt item 2, there’s no mechanism for making publications
- Prateek: OASIS provides such mechanism, but publication in this
  registration does not equate standards status
- Prateek: open to friendly amendment
- Carlisle looking for clarification that standards status is not
- RLBob: agrees, points out that other standards bodies may be used
- Hal: might want to add wording to clarify the possible existence of
  other registries
- Carlisle amendment:  "inclusion of such documents in this area does
  imply anything about their standards status"
- Prateek also amends with "(4) guidelines for structuring such drafts
  will also be published on this web page."
- [VOTE] passes by unanimous consent

4 -- Eve’s Issue over ‘Outreach’

- Eve sent email on this 20 Nov 2001 with subject "Issue: Outreach and
  rollout plans"
- Looking for consistent whitepaper generation and publicity generation
- Concerned that spec will be delivered, but no one will notice
- Eve doesn’t have bandwidth, nor does Jeff
- Hal offers to contribute, but looking for more direction
- Eve: need someone to drive issue, identify all the necessary output
  items, and see that they are completed
- Prateek: many represented companies have developed similar material,
  can they be used?
- Eve: very much would like to see that happen, and would contribute
  material herself
- Darren offers to assist, will call Eve directly to try to break down
  the more detailed to-do bits
- Hal: willing to write up some overview/FAQ material
- Prateek: willing to have a bindings -08 by 21-Dec, but guess is that
  conformant style & boilerplate won't be done
- [ACTION] Eve to check with BobB by 21-Dec to see if he will own

5 -- Action Items

- Prateek urges a 2-week timelimit on the remaining action items
- Items from Prateek’s email sent 20 Nov 2001 with subject "Bindings
  action items from F2F#4" (should be "F2F#5")
    - Item 1: lines 472-473, Section 4.1.3, Bob Blakley will provide
      improved text to replace
        - BobB not on call
        - Not done
    - Item 2: lines 732-733, Section, Bob Morgan and Phil Baker.

        - Proposed text has been sent to list this morning
        - renamed "targetRestrictions"
        - Action Item is closed
    - Item 3: lines 788-791, Section 4.2.2, Irving to propose text to
      make the language more precise and clarify any connections with
      SAML faultcode.
        - Irving no longer on call
        - Scott: suggests any text must consider work in general SAML
          status codes
        - Prateek: agrees
        - Therefore, this action item is dependent upon the "status code

          proposal" discussion Scott has begun on list
        - Not done
    - Item 4: lines 824-829, Section, Irving to research and
      propose language to weaken requirement on signing over entire
      message (body and headers).
        - Not done
    - Item 5: Need for additional ConfirmationMethod identifiers
      and Phil)
        - Not done
        - Prateek & Phill will send text to list by end of the week
    - Item 6: Section 3.1, SAML SOAP binding, Simon Godik to review and
      add text to reflect F2F#5 discussion
        - Simon has sent draft to list
        - Prateek: has Simon reviewed raw minutes from F2F#5?
        - Simon: no
        - Prateek: can you resubmit after reviewing those minutes
        - Jeff: suggests that Prateek extract part of minutes he’s
          concerned with and send to Simon & the list
        - [Action Item] Prateek to send relevant portions of raw notes
          the list
        - Stays open
    - Item 7: Prateek to publish bindings-07 during week of December 3.
        - Just a deadline reminder
    - Item 8: In depth reviewers for bindings-07
        - Noted
    - Item 9: Prateek to publish bindings-08 during week of December 17
        - Also just a deadline reminder
- Supplementary Items from Prateek’s email sent 27 Nov 2001 with subject

  "Additional bindings action items"
    - Item 1: [Bob Blakley] doc structuring issue: sections 3.1.2 thru
      3.1.8 refer to a family of bindings, where 3.1.9 refers to a
      specific binding
        - BobB to provide text
        - Still open
    - Item 2: [Jeff Hodges] Research Cipher suites and related
        - Jeff: thinks it is basically done
        - Prateek: next step is to incorporate into bindings draft
        - Jeff: text also to incorporate into security considerations
        - Jeff: direction has been to go with TLS and to find a cipher
          suite for AES
        - What is the state of affairs in Browsers?
        - V3 browsers not in common use at this point
        - Hal determined NS comm 4.7x supports 3des + rc4
        - Hal: Still question over patent issues with RC4
        - Jeff: effective statement is to support what is widely used in

          the installed base
        - Prateek: just point to the ‘strong enough’ cipher suite
        - Jeff: agreed, with addition of ‘widely used’
        - RLBob: is ‘mandatory to implement’ really necessary here,
          this is not interop among ourselves, but rather interop with
          the browsers?
        - Prateek: can we just state some weak cipher suites that are
        - Hal: but we will need to test against something
        - Jeff Bohren: do we need to consider possibility of renewed
          export restrictions
        - RLBob: possibility does not appear to have any traction
        - <<extended discussion ...>>
        - discussion evolved to specifying RSA-WITH-3DES for web browser

        - discussion moved to SOAP binding
        - Jeff: proposes TLS-rsa-3des as MUST, TLS-RSA-AES as a SHOULD
        - RLBob: suggests that in this context, just say TLS, no SSL
        - conclusion: prateek to take Jeff's suggested text for binding
          doc & recast for web brows. contesxt (ssl-rsa-3des-sha must) &

          soap binding context separately (tls-rsa-3des must, rsa-aes
          should, SHA each)
    - Item 3: [Simon Godik] Renumber 3.1.9 to 3.2.  Explain why this
      section is required in a SAML spec
        - Tried, but cannot renumber
        - Simon will look into question of ‘why required’
    - Item 4: [Prateek]  Add high-level diagram for web browser profile
      in Section 4.1.1
        - Will appear in next rev of bindings doc
    - Item 5: [Bob Blakley] lines 481-482, Provide revised text that
      reflects that we are generating a new 20 byte string for every new

      assertion and that these 20 bytes contain somewhere between 20
      bytes and 8 bytes of entropy.
        - Not done
    - Item 6: [Simon Godik] lines 549 - 569, Would like additional text
      indicating that before Step 6 the source and destination site
      have additional interactions using SAML protocol (e.g., additional

        - Not done
        - Simon will provide text
- Simon: where can all action items from last F2F be viewed?
- Jeff/Joe will publish such a list by next week
- Prateek: two sub-lists are already being maintained, one by Phill for
  core-related items and one by Prateek for bindings-related items
    - Should be consolidated

6 -- Adjourn



Attendence of Voting Members:

  Irving Reid Baltimore
  Larry Hollowood Bank of America
  Ken Yagen Crosslogix
  Simon Godik Crosslogix
  Gil Pilz E2open
  Hal Lockhart Entegrity
  Carlisle Adams Entrust
  Robert Griffin Entrust
  Jason Rouault HP
  Marc Chanliau Netegrity
  Prateek Mishra Netegrity
  Jeff Hodges Oblix
  Charles Knouse Oblix
  Steve Anderson OpenNetwork
  Jeff Bohren OpenNetwork
  Mark Griesi OpenNetwork
  Darren Platt RSA
  Jahan Moreh Sigaba
  Eve Maler Sun
  Aravindan Ranganathan Sun
  Marlena Erdos Tivoli
  Bob Morgan UWashington
  Phillip Hallam-Baker Verisign
  Thomas Hardjono Verisign

Attendance of Observers or Prospective Members:

  Scott Cantor OSU

Membership Status Changes:

  Mary Ellen Zurko IBM -- granted voting status after concall
  Joe Hawkins Novell -- granted voting status after concall
  Emily Xu Sun -- granted voting status after concall

Steve Anderson
OpenNetwork Technologies
727-561-9500 x241

tel;work:727-561-9500 x241
org:OpenNetwork Technologies
title:Product Architect
adr;quoted-printable:;;13577 Feather Sound Drive=0D=0ASuite 330;Clearwater;Florida;33762;USA
fn:Steve Anderson

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]

Powered by eList eXpress LLC