Re: [Ecrit] Roman Danyliw's Discuss on draft-ietf-ecrit-data-only-ea-21: (with DISCUSS and COMMENT)

[Brian Rosen <[e-mail]>]

I hope I got all your comments fixed in -22
https://tools.ietf.org/html/draft-ietf-ecrit-data-only-ea-22

Brian

> On Mar 2, 2020, at 5:24 PM, Brian Rosen <[e-mail]> wrote:
> 
> I’ll add Adam’s suggested language.
> 
> WRT the first issue: URIs to untrusted entities, I note that there is no discussion of untrusted entities in Section 7 of RFC 3986.  There is discussion of misleading URIs.  If I added text to the security section that read:
> 
> When the CAP message is passed by reference, the recipients of the MESSAGE may not have a trust relationship with the sender.  Recipients MUST take precautions in retrieving the CAP message because the URI may point to a malicious actor.  
> 
> Would that satisfy your concerns?
> 
> I will also fix the nits.
> 
>> On Mar 2, 2020, at 4:51 PM, Roman Danyliw <[e-mail] <mailto:[e-mail]>> wrote:
>> 
>> Hi Adam!
>> 
>>> -----Original Message-----
>>> From: Adam Roach <[e-mail] <mailto:[e-mail]>>
>>> Sent: Monday, March 02, 2020 4:45 PM
>>> To: Roman Danyliw <[e-mail] <mailto:[e-mail]>>; The IESG <[e-mail] <mailto:[e-mail]>>
>>> Cc: [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>; draft-
>>> [e-mail] <mailto:[e-mail]>
>>> Subject: Re: Roman Danyliw's Discuss on draft-ietf-ecrit-data-only-ea-21:
>>> (with DISCUSS and COMMENT)
>>> 
>>> On 3/2/2020 3:35 PM, Roman Danyliw via Datatracker wrote:
>>>> Section 9.  Per “To provide protection of the entire SIP message
>>>> exchange between neighboring SIP entities, the usage of TLS is
>>>> REQUIRED.”, can you please provide guidance on how to use TLS.
>>> 
>>> 
>>> I think the strong implication here is that TLS is to be used in the same way
>>> that TLS is used in other SIP applications (in the same way that an HTTP
>>> document saying "MUST use TLS" is pretty clearly saying to use HTTPS as per
>>> the existing HTTP RFCs).
>>> 
>>> Unfortunately, the TLS handling for SIP is mixed into RFC 3261 all _over_ the
>>> place, so there's not anything particularly comprehensive to point to. The
>>> best that I think could be said would be something along the lines of "...the
>>> usage of TLS, as described in section 26 of [RFC3261], is REQUIRED."
>>> 
>>> Would that satisfy your concern?
>> 
>> I can appreciate this difficulty.  Sounds good to me. 
>> 
>> Roman
>