Re: [Ecrit] Roman Danyliw's Discuss on draft-ietf-ecrit-data-only-ea-21: (with DISCUSS and COMMENT)

[Brian Rosen <[e-mail]>]

I’ll add Adam’s suggested language.

WRT the first issue: URIs to untrusted entities, I note that there is no discussion of untrusted entities in Section 7 of RFC 3986.  There is discussion of misleading URIs.  If I added text to the security section that read:

When the CAP message is passed by reference, the recipients of the MESSAGE may not have a trust relationship with the sender.  Recipients MUST take precautions in retrieving the CAP message because the URI may point to a malicious actor.  

Would that satisfy your concerns?

I will also fix the nits.

> On Mar 2, 2020, at 4:51 PM, Roman Danyliw <[e-mail]> wrote:
> 
> Hi Adam!
> 
>> -----Original Message-----
>> From: Adam Roach <[e-mail] <mailto:[e-mail]>>
>> Sent: Monday, March 02, 2020 4:45 PM
>> To: Roman Danyliw <[e-mail] <mailto:[e-mail]>>; The IESG <[e-mail] <mailto:[e-mail]>>
>> Cc: [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>; draft-
>> [e-mail] <mailto:[e-mail]>
>> Subject: Re: Roman Danyliw's Discuss on draft-ietf-ecrit-data-only-ea-21:
>> (with DISCUSS and COMMENT)
>> 
>> On 3/2/2020 3:35 PM, Roman Danyliw via Datatracker wrote:
>>> Section 9.  Per “To provide protection of the entire SIP message
>>> exchange between neighboring SIP entities, the usage of TLS is
>>> REQUIRED.”, can you please provide guidance on how to use TLS.
>> 
>> 
>> I think the strong implication here is that TLS is to be used in the same way
>> that TLS is used in other SIP applications (in the same way that an HTTP
>> document saying "MUST use TLS" is pretty clearly saying to use HTTPS as per
>> the existing HTTP RFCs).
>> 
>> Unfortunately, the TLS handling for SIP is mixed into RFC 3261 all _over_ the
>> place, so there's not anything particularly comprehensive to point to. The
>> best that I think could be said would be something along the lines of "...the
>> usage of TLS, as described in section 26 of [RFC3261], is REQUIRED."
>> 
>> Would that satisfy your concern?
> 
> I can appreciate this difficulty.  Sounds good to me. 
> 
> Roman