[saag] Re: [EXT] Interests on Initiating the standardiza tion work related to "Zero Trust"?

Hi all,

Thank you for the thoughtful feedback and guidance in this thread — in
particular the point that *if there is real protocol work to do, it should
be done, but justified clearly*. We fully agree with this principle.

We believe the *Network-infrastructure Hiding Protocol (NHP)* is an example
of such protocol work that merits discussion and review in the IETF,
because it addresses a concrete and increasingly important gap:

*Problem being addressed*
Existing Internet protocols generally assume network reachability by
default and rely on post-reachability controls (TLS, authentication,
authorization) to enforce security. In today’s environment — especially
with AI-driven reconnaissance, autonomous vulnerability scanning, and
pre-authentication exploits — this default visibility itself has become a
primary attack vector.

*What NHP contributes (at the protocol level)*
NHP introduces a *cryptographically enforced, pre-connect authorization
mechanism* that makes network resources *non-discoverable and non-reachable*
unless explicit authorization is proven *before* any TCP/TLS or application
handshake occurs. This goes beyond policy, deployment guidance, or
rebranding of existing mechanisms, and instead defines:

   -

   A concrete message flow and state machine
   -

   Cryptographic constructions for pre-authentication and mutual validation
   -

   Explicit interaction between control and data planes
   -

   A protocol-level approach to reducing attack surface *prior to
   reachability*

*Why this becomes more important in the AI age*
As AI systems increasingly automate scanning, correlation, and exploitation
at machine speed, any exposed IP/port/service — even briefly — becomes a
liability. Reducing *network visibility itself* is no longer just an
operational preference but a structural requirement for scalable security.

*Current status*

   -

   An Internet-Draft has been submitted for community review:
   https://datatracker.ietf.org/doc/html/draft-opennhp-saag-nhp
   -

   A full open-source implementation is available under the Apache 2.0
   license:
   https://github.com/OpenNHP/opennhp

We are not proposing to standardize the term “Zero Trust,” nor to duplicate
existing authorization or encryption work. Instead, we hope to invite
focused technical review on whether *network-infrastructure hiding as a
protocol primitive* is a gap worth addressing in the IETF, and if so, how
it should evolve.

We welcome critical feedback, gap analysis against existing standards, and
guidance on whether this work belongs in SAAG or elsewhere in the Security
Area.

Best regards,
Benfeng

On Tue, Dec 30, 2025 at 10:08 PM Aijun Wang <[email protected]>
wrote:

> We can try to limit the scope of the "zero trust" in the WG charter
> description, based on the unsolved problem statements, and interested
> topics.
>
> The aim of standard is to clear the mess, step by step.
>
> Best Regards
>
> Aijun Wang
> China Telecom
>
> -----Original Message-----
> From: Nico Williams [mailto:[email protected]]
> Sent: Wednesday, December 31, 2025 1:10 PM
> To: Salz, Rich <[email protected]>
> Cc: Harry Halpin <[email protected]>; Blumenthal, Uri - 0553 - MITLL
> <[email protected]>; Aijun Wang <[email protected]>; [email protected];
> Benfeng Chen <[email protected]>; Erik Johnson
> <[email protected]>; [email protected];
> [email protected]; Hillary Baron <[email protected]>; Aijun
> Wang <[email protected]>
> Subject: Re: [saag] Re: [EXT] Interests on Initiating the standardization
> work related to "Zero Trust"?
>
> On Fri, Dec 26, 2025 at 05:53:58PM +0000, Salz, Rich wrote:
> > >  the term "zero-trust" is a mess and some clear standards are in order.
> >
> > That ship has sailed, the cow is out of the barn, etc. etc.
>
> It's not just that term.  PKI, Kerberos, TLS, GSS, SASL, EAP, IPsec, SSH
> -- these and others tend to use similar terms in different ways.  It's all
> a
> mess.  We have a glossary, but it can't change all that, and nothing can.
> IMO.
>
> Nico
> --
>
>

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]