Re: [gentoo-nfp] Developer Crypto Hardware (AGM)

[Robin H. Johnson]

On Sun, Aug 19, 2018 at 02:42:23PM -0400, Aaron Bauman wrote:
> Gentoo-bug: https://bugs.gentoo.org/659620
I have some discussion items & questions regarding the details of the
proposal. The questions are explicitly marked with 'Question:' so that
they stand out. I have asked questions in both roles I hold: Treasurer
of the Foundation & lead of the Infrastructure team.

1. Quantity:
(this is mostly to answer other people asking on the lists)
The Foundation has specified 150 units as the quantity for price
quoting, despite 176 developers being listed as active in LDAP. There
are multiple factors here:
- The Foundation did not want to commit to buying more keys than needed
- This may be an impetus for inactive developers to retire
- 151 developers have access to repo/gentoo.git
- 140 unique developers committed to any gentoo.org Git/CVS in the last
  6 months (123 in the last 3 months).

2. Location of developers, shipping costs:
Of the 176 developers in LDAP, here's an approximate breakdown by
location:
 89 Europe (includes EU, UK, CH, Nordics & others)
 62 USA
  7 Far-East (China, Japan, Singapore)
  7 Russia
  5 Canada
  3 Middle-East
  2 South-America
  1 Unknown

2.1 Question (from Treasurer): Based on the above, please update the
proposal to include a fair estimate of shipping as part of the approval
process. Using worst-case for those outside of Europe/USA is acceptable.
I can provide a breakdown by country for this purpose.

3. Shipping restrictions.
Yubico notes the following countries they cannot ship to:
> China, Afghanistan, Russia, Ukraine, North Korea, Iran, Sudan or Syria
Of that list, we presently, recently had or in the near future will have
(recruitment pipeline) 12 developers in: China, Russia, Ukraine, Iran

3.1 Question (from Treasurer): Does Nitrokey have by-country shipping
restrictions?

3.2 Question (from Treasurer, from Infra): If the vendor chosen of the Board
will not or cannot ship to the countries in question, what options do we
provide for developers in those countries?

4. Functionality:
Infra discussions about a potential single-sign-on system for
authentication (not commit signing) seems to be converging around OATH &
U2F systems, or the upcoming FIDO2 standard [expect new keys to be
available later this year or early next year]. The Nitrokey Pro will
offer OpenPGP only, while the YubiKey FIPS will offer both OpenPGP &
U2F. 

4.1 Question (from Infra): If the Foundation choses the Nitrokey offer,
could future provision be made to ALSO offer separate U2F/FIDO2 keys to
developers? Subject to comments by the security team, the Nitrokey U2F
would be acceptable.

5. Ownership:
As Treasurer, I would like to point out that this hardware will remain
the property of the Foundation for 6 years. This is the relevant
depreciation lifespan permitted by IRS regulations. The shipping cost
however to return an individual unit will exceed the remaining value
after 2 years (depending on the purchasing quarter, by the end of the
second financial year, 43-61% of the unit value will be depreciated).

5.1 Question (as Treasurer): As part of accepting the motions to purchase,
the Board must implement written requirements for developers to return
the keys, at their own cost, if the developer retires within 2.5 years
of ordering the unit.

(snip parts of quotes)
> All, this email will serve as a comparison between the two vendors which
> have provided quotes to the Foundation. This does not include Alice's
> proposal as U2FZero is currently out of stock in the United States and
> does not seem to offer any availability in Asia.
6. Question: Other Vendors
Are there other vendors we wish to consider or specifically exclude,
such as Feitan? Not saying we should include them, just cover that
people are aware of them.

> Alice did suggest that we split vendors across geographical markets,
> but I find this will make the situation become very difficult to
> handle. It would also put the burden on individuals to receive and
> disperse the tokens and increase shipping costs, burden the treasurer
> for reimbursements to be processed, and possibly cause delays.
As Treasurer, I would greatly prefer to paying fewer large bills rather
than many small reimbursements, or individually handling small shipping.

> Yubikey:
...
(Infra-hat) This has my preference as better product, but worse
conditions.

> Nitrokey:
>
> Quote received based on (150) Nitrokey Pro tokens.
7. Question, as Infra: product clarification
Is this the 'Nitrokey Pro 2' as listed on the Nitrokey website, or the
older 'Nitrokey Pro'?

> All prices are already inclusive of VAT.
8. As noted on IRC, please include VAT in the estimation for Yubikey.
For Nitrokey it's covered in their FAQ:
https://www.nitrokey.com/documentation/frequently-asked-questions#pricing-and-vat

> Shipping times can be found here [2]. Shipping costs can be found here
> [3]. The most expensive shipping is worldwide starting at 7,40 €
> ($8.47 USD at the the time of this email).
>
> Nitrokey has also offered several unique options for Gentoo. They will
> provide a custom portal which allows each developer to request their
> security token. This is done via a Foundation (infra really) provided
> list of valid gentoo.org email addresses. Additionally, they will
> provide monthly billing of all purchased devices and the Foundation is
> not obligated to purchase all (150) tokens. This can be a standing
> agreement until the Foundation decides to remove financial support.
As Treasurer, the shipping portal & monthly billing gets a big thumbs up
from me.

> Considering both vendors, we can estimate shipping at the highest cost
> in order to best prepare for potential expenses.
As noted above, please put an amount on the shipping estimate.

> Motion: I move that the board vote to accept the offer from Yubico or
> Nitrokey and begin our agreement with the accepted vendor beginning 1
> September 2018. This motion will provide security tokens to all current
> developers listed in Gentoo's LDAP infrastructure as of 31 August 2018.
>
> Motion: I move that the board vote to maintain the aforementioned
> agreement in order to support future Gentoo developers with security
> tokens. This motion includes the right to terminate future purchases
> based on the Foundation's financials.

Please see remarks above about:
A. Treasurer: Keys to remain the property of the Foundation, and need to
   be returned if devs leave before 2.5 years.
B. Infra: Planning for U2F keys as well (I do consider it acceptable if we
   issue every developer both a NitroKey Pro & a Nitrokey U2F).

-- 
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Treasurer
E-Mail   : robbat2@g.o
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136