Re: [eman] Ben Campbell's Discuss on draft-ietf-eman-applicability-statement-10: (with DISCUSS)

["Ben Campbell" <[e-mail]>]

On 22 Apr 2015, at 16:20, Benoit Claise wrote:

> On 22/04/2015 21:20, Ben Campbell wrote:
>> Ben Campbell has entered the following ballot position for
>> draft-ietf-eman-applicability-statement-10: Discuss
>>
>> When responding, please keep the subject line intact and reply to all
>> email addresses included in the To and CC lines. (Feel free to cut 
>> this
>> introductory paragraph, however.)
>>
>>
>> Please refer to 
>> http://www.ietf.org/iesg/statement/discuss-criteria.html
>> for more information about IESG DISCUSS and COMMENT positions.
>>
>>
>> The document, along with other ballot positions, can be found here:
>> http://datatracker.ietf.org/doc/draft-ietf-eman-applicability-statement/
>>
>>
>>
>> ----------------------------------------------------------------------
>> DISCUSS:
>> ----------------------------------------------------------------------
>>
>> [edited to fix missing word]
>>
>> I agree with Stephen's comments that the security considerations are
>> sorely lacking. I understand his reasoning for not asking the group 
>> to do
>> considerably more work at this point in the process. But I'd like to 
>> see
>> at least an explicit mention that power management as described in 
>> some
>> of the use cases in this draft may have significant privacy
>> considerations--even if that mention takes the form of "We haven't 
>> fully
>> analyzed privacy issues, and leave that work to a follow on effort."
> The question is: can we rely on the security considerations of RFC 
> 7326, RFC 7460, and RFC 7461?
> For example:
>
>     In certain situations, energy and power monitoring can reveal
>     sensitive information about individuals' activities and habits.
>     Implementors of this specification should use appropriate privacy
>     protections as discussed in Section 9 of RFC 6988 and monitoring 
> of
>     individuals and homes should only occur with proper authorization.

It would help if the security considerations in the applicability 
statement referenced those docs :-) Even so, references scoped to the 
MIBs are not completely satisfying when the draft says it is equally 
applicable to things like YANG and NETCONF.

(By the way, it looks like the references to 7460 and 7461 elsewhere in 
the draft still point to outdated drafts.)

>
> Or asked differently: should an applicability statement document 
> review and discuss the security considerations of each of the use 
> cases mentioned?

That would be nice--really, each use case may have different privacy 
issues. But I agree with Stephen that it's kind of late to ask the WG to 
analyze those.

Would you consider adding something to the effect of the following to 
the security considerations?

NEW:

" [RFC7460] section X and [RFC7461] section Y mention that power 
monitoring and management MIBs may have certain privacy implications. 
Applications of this spec that use other mechanisms (e.g. YANG) may have 
similar implications, which are beyond this scope of this document. 
There may be additional privacy considerations specific to each use 
case; this document has not attempted to analyze these. "