[Ecrit] Fwd: Re: DISCUSS: draft-ietf-ecrit-lost

FYI

-------- Original-Nachricht --------
Datum: Tue, 4 Mar 2008 11:06:44 -0500
Von: Tim Polk <tim.polk@nist.gov>
An: Ted Hardie <hardie@qualcomm.com>
CC: "iesg@ietf.org" <iesg@ietf.org>, "ecrit-chairs@tools.ietf.org" <ecrit-chairs@tools.ietf.org>, "draft-ietf-ecrit-lost@tools.ietf.org" <draft-ietf-ecrit-lost@tools.ietf.org>
Betreff: Re: DISCUSS: draft-ietf-ecrit-lost

Ted,

Thanks for the quick response.  Yes, this text would work for me.

Tim Polk

On Mar 4, 2008, at 10:35 AM, Ted Hardie wrote:

> At 12:24 PM -0800 3/3/08, Tim Polk wrote:
>> Discuss:
>> The introduction suggests that LoST may be appropriate for non- 
>> emergency services
>> as well, but does not revisit that notion anywhere else in the  
>> document.  As noted in Joe
>> Salowey's secdir review, there may be different threats or  
>> motivations which could affect
>> the applicability of LoST to such applications.  From his review:
>>
>>   3) Use in non-ecrit cases - has much thought been given to the  
>> use of
>>   LoST in non-Ecrit cases?  There may be different threats or at  
>> least
>>   motivations than those covered in draft-ietf-ecrit-security- 
>> threats.
>>   For example, in non-ecrit cases an attacker may seek monetary  
>> benefit
>>   through attacking the LoST protocol to return inaccurate service  
>> mapping
>>   information.  The suggestion here is to either consider this  
>> case of
>>   non-ecrit in more detail or to state that threats outside ecrit  
>> cases
>>   may be different.
>>
>> At a minimum, the security considedrations section should note that
>> non-emergency services may face a different set of threats.  The  
>> requirements
>> for these services should be carefully reviewed to ensure that  
>> LoST can be
>> used to achieve the service's security requirements.
>
> Proposed RFC Editor note:
>
> OLD:
>
> A more detailed description of threats and security requirements  
> are provided in [17].
>
>
> NEW:
>
> A more detailed description of threats and security requirements  
> are provided in [17].
> The threats and security requirements in non-emergency service
> uses of LoST may be considerably different from those described here.
> For example,  an attacker might seek monetary benefit by returning
> service mapping information which directed users to specific service
> providers.  Before deploying LoST in new contexts, a thorough analysis
> of the threats and requirements specific to that context should
> be undertaken and decisions made on the appropriate mitigations.
>
>
> Please let me know if this works to satisfy your concerns,
> 				regards,
> 					Ted Hardie
>
>
>
_______________________________________________
Ecrit mailing list
Ecrit@ietf.org
https://www.ietf.org/mailman/listinfo/ecrit