Re: [security-services] Draft Minutes for SSTC Conference Call, Mar14, 2006

[Olivier Dubuisson <Olivier.Dubuisson@francetelecom.com>]

Hi everybody,

first of all, thanks for these detailed minutes.

Reid, Irving wrote:
[...]
> 
> 5. Remarks from Abbie Barbir, Olivier Dubuisson, on ITU-T
> standardization status
> 
> Prateek Mishra: Some question about the role of errata in the ITU-T 
> standardisation process
> 
> Abbie Barbir: Thought that errata could be ignored, but on closer review 
> some are required for interoperability.

This is an interesting remark from which I understand that, without 
having some knowledge of the potential errata, one cannot easily produce 
an interoperable implementation of SAML 2.0. Is this correct?

> Rob: None are normative changes, but some are clarification of intent.

I like this choice of words ;)

> Abbie: Erratum #36 is an example of one that is significant. For an 
> implementer of the ITU-T version of the spec, lack of access to the 
> errata would cause grief.
> 
> 
> Abbie: Could publish errata as non-normative ITU-T note
> 
> Jamie: ITU-T want to put their stamp on a stable version; they need to 

In this case, the ITU-T is not really putting their stamp!

> understand that our errata do not indicate an unstable specification.

I don't think anybody ever said that. Since defects have been 
identified, some ITU-T Members are surprised (I think) that they are not 
solved. One reason is probably that OASIS doesn't have a concept of 
"Technical Corrigendum" (which helps to quickly correct defects).
But let's try to make some progress.

> Jamie: ITU-T only want to deal with things that are declared OASIS 
> Standard; 

I don't think this is correct. Providing a document conforms to ITU-T 
Rec. A.5, it can be referenced in the normative part of an ITU-T Rec 
(whether it has the status of an OASIS Standard or not).
As far as the potential errata are concerned, the intention has never 
been to reference them in a normative part (because they aren't 
normative on the OASIS side).

 > need to be more formal about real specs, while having a
> non-normative channel to convey to users of the ITU-T versions of the 
> specs that there is an errata process within OASIS.

I'm a bit concerned by this "non-normative channel". At list, the 
channel has to be official and ITU-T Members have been requesting more 
than once that the communication channel with OASIS be formalized so 
that any defect issued on the ITU-T side is handled by OASIS. Abbie 
promised at the ITU-T WP2/17 meeting in January that the ITU-T SG17 
Chairman would receive a letter from OASIS. I haven't been yet notified 
that such a document was available for the April meeting of ITU-T SG17.

> Prateek: As Rob suggested, perhaps the TC needs to declare the current 
> set of errata as a CD.

How is a CD stable? What if the SS TC is disbanded? Will a CD stay 
forever on the OASIS website? (I guess yes.)

> Abbie: This could add a significant turnaround time

I understand Abbie's concerned. If we want to go for Consent next month, 
we would need to have this CD ready by mid-April.

> Rob: Would CD be enough for ITU-T, or does it have to be OASIS standard?
 >
> Abbie: We don't need to rework our errata, we just need to publish a 
> current version at a stable location so that the ITU-T version of the 
> spec can refer to it.

Considering that the list of errata is not a normative text and would 
not be referenced in a normative part of the ITU-T Rec., Abbie is correct.
So the question is (sorry it's late in the night here in France and I 
haven't checked on the website!): Is the list of potential errata freely 
accessible on the OASIS website (without requiring a login/password)?
-- 
Olivier DUBUISSON
France Telecom
Pilotage de la normalisation/Deputy Director Standards Steering
R&D/TCH/NOR - BP 50702 - 22307 Lannion Cedex - France
tel: +33 2 96 05 38 50 - fax: +33 2 96 05 10 08