Re: [Ace] Stephen Farrell's Yes on draft-ietf-ace-usecases-09: (with COMMENT)

[Kathleen Moriarty <[e-mail]>]

Sent from my iPhone

> On Oct 23, 2015, at 10:58 AM, Stefanie Gerdes <[e-mail]> wrote:
> 
> Hi all,
> 
>>>> 1. Software update is really needed and often missing and
>>>> usually hard. There's at least a need to authenticate and
>>>> authorize new firmware, when there is any update. That may not
>>>> be the same as authorizing a new config.
>> 
>> 
>> Isn't this covered in section 2.4.1.3. ?
>> 
>> "At some point the facility management company wants to update the
>> firmware of lighting devices in order to eliminate software bugs.
>> Before accepting the new firmware, each device checks the
>> authorization of the facility management company to perform this
>> update."
>> 
>> There is simply not a specific authorization problem listed for this, I
>> could argue that it is subsumed under U4.4 but if you think it deserves
>> specific mention under the problems section I can live with adding a point.
> 
> I think adding a point in 2.4.3 is a good idea. We could also add an
> item to 3.3 that emphasizes the problem.
> 

Great, I think adding a point would be helpful.  You'd be authenticating the device to receive the update preventing fraud, which is different from the existing point referenced.

Thanks,
Kathleen 

> Thanks,
> Steffi