Re: [core] Secdir telechat review of draft-ietf-core-resource-directory-25

[Christian Amsüss <[e-mail]>]

(This is one of the point-to-point follow-up mails on the RD -25
reviews; for the preface, please see the preceding mail on "The various
positions on draft-ietf-core-resource-directory-25" at
<https://mailarchive.ietf.org/arch/msg/core/xWLomwwhovkU-CPGNxnvs40BhaM/>).

> The -24 version of this draft was reviewed by Adam Montville. I looked over
> his review and I think that the issue he raised about possible  mitigation of
> DDoS amplification attacks has been addressed in this version. I personally
> think that sentences describing how DNS and NTP are vulnerable to
> amplification attacks are redundant in this document, but that's a matter of
> taste and doesn't hurt.

response:

We've taken the comment as an opportunity to cut back on the history lesson
(change in https://github.com/core-wg/resource-directory/pull/249).

> It is my impression, that Security Considerations were mostly written having
> in mind that (D)TLS is always used, however it is only "SHOULD" in this draft
> (or even "MAY" if we look at RFC6690 which Security Considerations this draft
> refers to). I think that adding a few words describing which consequences for
> security not using (D)TLS would have and in which cases it is allowed will
> make the Security Considerations more consistent. 

response:

Which level of protection is adaequate depends on the security policies. The
text you refer to was missed in updates, and now reflects that some security
mechanism ((D)TLS or OSCORE) SHOULD be used where the policies in place
indicate sensitive data. (See
https://github.com/core-wg/resource-directory/pull/250 for the full change).