Re: [eman] Ben Campbell's Discuss on draft-ietf-eman-applicability-statement-10: (with DISCUSS)

["Thomas D. Nadeau" <[e-mail]>]

> On Apr 22, 2015:5:51 PM, at 5:51 PM, Ben Campbell <[e-mail]> wrote:
> 
> On 22 Apr 2015, at 16:20, Benoit Claise wrote:
> 
>> On 22/04/2015 21:20, Ben Campbell wrote:
>>> Ben Campbell has entered the following ballot position for
>>> draft-ietf-eman-applicability-statement-10: Discuss
>>> 
>>> When responding, please keep the subject line intact and reply to all
>>> email addresses included in the To and CC lines. (Feel free to cut this
>>> introductory paragraph, however.)
>>> 
>>> 
>>> Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
>>> for more information about IESG DISCUSS and COMMENT positions.
>>> 
>>> 
>>> The document, along with other ballot positions, can be found here:
>>> http://datatracker.ietf.org/doc/draft-ietf-eman-applicability-statement/
>>> 
>>> 
>>> 
>>> ----------------------------------------------------------------------
>>> DISCUSS:
>>> ----------------------------------------------------------------------
>>> 
>>> [edited to fix missing word]
>>> 
>>> I agree with Stephen's comments that the security considerations are
>>> sorely lacking. I understand his reasoning for not asking the group to do
>>> considerably more work at this point in the process. But I'd like to see
>>> at least an explicit mention that power management as described in some
>>> of the use cases in this draft may have significant privacy
>>> considerations--even if that mention takes the form of "We haven't fully
>>> analyzed privacy issues, and leave that work to a follow on effort."
>> The question is: can we rely on the security considerations of RFC 7326, RFC 7460, and RFC 7461?
>> For example:
>> 
>>    In certain situations, energy and power monitoring can reveal
>>    sensitive information about individuals' activities and habits.
>>    Implementors of this specification should use appropriate privacy
>>    protections as discussed in Section 9 of RFC 6988 and monitoring of
>>    individuals and homes should only occur with proper authorization.
> 
> It would help if the security considerations in the applicability statement referenced those docs :-) Even so, references scoped to the MIBs are not completely satisfying when the draft says it is equally applicable to things like YANG and NETCONF.
> 
> (By the way, it looks like the references to 7460 and 7461 elsewhere in the draft still point to outdated drafts.)
> 
>> 
>> Or asked differently: should an applicability statement document review and discuss the security considerations of each of the use cases mentioned?
> 
> That would be nice--really, each use case may have different privacy issues. But I agree with Stephen that it's kind of late to ask the WG to analyze those.
> 
> Would you consider adding something to the effect of the following to the security considerations?
> 
> NEW:
> 
> " [RFC7460] section X and [RFC7461] section Y mention that power monitoring and management MIBs may have certain privacy implications. Applications of this spec that use other mechanisms (e.g. YANG) may have similar implications, which are beyond this scope of this document. There may be additional privacy considerations specific to each use case; this document has not attempted to analyze these. “

	This is a (thankfully) simple, and reasonable approach. My only question is why are we mentioning Yang here? The WG only produced SNMP MIBs.

	Would this fix resolve Stephen’s comments as well?

	—Tom