Re: [eman] Ben Campbell's Discuss on draft-ietf-eman-applicability-statement-10: (with DISCUSS)

Benoit Claise <bclaise@cisco.com> Wed, 22 April 2015 21:20 UTC

Return-Path: <bclaise@cisco.com>
X-Original-To: eman@ietfa.amsl.com
Delivered-To: eman@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E113F1A8ACC; Wed, 22 Apr 2015 14:20:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.51
X-Spam-Level:
X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Httm-6XfG2wY; Wed, 22 Apr 2015 14:20:09 -0700 (PDT)
Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 116761A8AD0; Wed, 22 Apr 2015 14:19:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5541; q=dns/txt; s=iport; t=1429737594; x=1430947194; h=message-id:date:from:mime-version:to:cc:subject: references:in-reply-to; bh=caUzNz7g4vxPkD2ylv474lZXSEvWaDTiX7fsy0nzVnk=; b=lCwQ81vjePTXHkTLhZyV8WTB4JZlH40eFQDY8Hu4VxEbm//fZgsuEbZb vsWUHTWLuTrjbFTXJ6SZPVp5Z3XAXJ6Xfbqr7FxsVXgXxi+pZHtlT8/PN KWKs3Zs3wMvlV4wbS5Xpohr9oA1+BTnTqTH5jj5DlD4ZtCOB5TrPoFPo0 w=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0D9AwBoDzhV/xbLJq1bg15cgxi6W4gWCYFRhgICgXIUAQEBAQEBAYEKhCEBAQQjVQEQCwQUCRYLAgIJAwIBAgFFBgEMAQcBAQWIIg24B5UFAQEBAQEBAQEBAQEBAQEBAQEBAQEBF4s3gmSBPREBAk8HgmiBRQWGNI8IhimBIjuDAoJNjgUigjeBPjwxAYEKgTkBAQE
X-IronPort-AV: E=Sophos;i="5.11,626,1422921600"; d="scan'208,217";a="439423870"
Received: from aer-iport-nat.cisco.com (HELO aer-core-4.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP; 22 Apr 2015 21:19:52 +0000
Received: from [10.60.67.85] (ams-bclaise-8914.cisco.com [10.60.67.85]) by aer-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id t3MLJmNr010349; Wed, 22 Apr 2015 21:19:49 GMT
Message-ID: <5538109D.1070103@cisco.com>
Date: Wed, 22 Apr 2015 23:20:29 +0200
From: Benoit Claise <bclaise@cisco.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.6.0
MIME-Version: 1.0
To: Ben Campbell <ben@nostrum.com>, The IESG <iesg@ietf.org>
References: <20150422192021.30691.70336.idtracker@ietfa.amsl.com>
In-Reply-To: <20150422192021.30691.70336.idtracker@ietfa.amsl.com>
Content-Type: multipart/alternative; boundary="------------060503030000040407010304"
Archived-At: <http://mailarchive.ietf.org/arch/msg/eman/6ejYzNzqMyW6nK2AeRsmo9spOxQ>
Cc: eman-chairs@ietf.org, eman@ietf.org
Subject: Re: [eman] Ben Campbell's Discuss on draft-ietf-eman-applicability-statement-10: (with DISCUSS)
X-BeenThere: eman@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Discussions about the Energy Management Working Group <eman.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/eman>, <mailto:eman-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/eman/>
List-Post: <mailto:eman@ietf.org>
List-Help: <mailto:eman-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/eman>, <mailto:eman-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 22 Apr 2015 21:20:14 -0000

On 22/04/2015 21:20, Ben Campbell wrote:
> Ben Campbell has entered the following ballot position for
> draft-ietf-eman-applicability-statement-10: Discuss
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> http://datatracker.ietf.org/doc/draft-ietf-eman-applicability-statement/
>
>
>
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
>
> [edited to fix missing word]
>
> I agree with Stephen's comments that the security considerations are
> sorely lacking. I understand his reasoning for not asking the group to do
> considerably more work at this point in the process. But I'd like to see
> at least an explicit mention that power management as described in some
> of the use cases in this draft may have significant privacy
> considerations--even if that mention takes the form of "We haven't fully
> analyzed privacy issues, and leave that work to a follow on effort."
The question is: can we rely on the security considerations of RFC 7326, 
RFC 7460, and RFC 7461?
For example:

        In certain situations, energy and power monitoring can reveal
        sensitive information about individuals' activities and habits.
        Implementors of this specification should use appropriate privacy
        protections as discussed in Section 9 of RFC 6988 and monitoring of
        individuals and homes should only occur with proper authorization.

Or asked differently: should an applicability statement document review 
and discuss the security considerations of each of the use cases mentioned?

Regards, Benoit
>
> If, on the other hand, people think there aren't privacy issues, I'd like
> to see that assertion along with supporting arguments.
>
>
>
>
> .
>