Re: [apps-discuss] Stephen Farrell's No Objection on draft-ietf-appsawg-authres-ptypes-registry-04: (with COMMENT)

[Stephen Farrell <[e-mail]>]

On 15/10/14 19:19, Murray S. Kucherawy wrote:
> On Mon, Oct 13, 2014 at 2:04 AM, Stephen Farrell <[e-mail]>
> wrote:
> 
>>
>> I wondered if it'd be worthwhile asking that the
>> designated expert try ensure that the security and privacy
>> consequences of new entries also be documented?  That's
>> assuming there are cases where the header field is likely
>> to transit between ADMDs. I'm not sure if that's really
>> needed though, but 7001 does have a fairly significant set
>> of security considerations, so presumably new entries
>> might also deserve a similar level of documentation. OTOH,
>> I could buy that experience with 7001 means that this
>> isn't really needed or that demanding that level of
>> documentation might be counterproductive.
>>
>>
> Actually, RFC7001 doesn't talk about the risks (if any) of this header
> field "leaking" outside of ADMDs that will consume it.  They should ignore
> it by the rules in RFC7001, but it doesn't say how they could leak
> interesting details.  That would be a useful thing to add if we ever do an
> RFC7001bis.
> 
> Unfortunately, I think this is the kind of thing RFC7001 itself should talk
> about, because it's a general thing to be considered and not something
> specific to new ptypes.  Things referenced by this new registry are
> probably the wrong place to put that responsibility.

Fair 'nuff.
Cheers,
S.


> 
> -MSK
>