Re: [hrpc] I-D Action: draft-irtf-hrpc-guidelines-02.txt

[Joseph Lorenzo Hall <[e-mail]>]

On Tue, Mar 19, 2019 at 3:00 AM Gurshabad Grover <gurshabad=
[e-mail]> wrote:

> On 11/03/19 5:16 PM, [e-mail] wrote:
> >
> > A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> > This draft is a work item of the Human Rights Protocol Considerations RG
> of the IRTF.
>
> (Thanks to the chairs for scheduling time to discuss this draft at
> IETF104.)
>
>
>
Not sure if this is the best thread for feedback on this document, but here
is my most recent review:


   - draft-irtf-hrpc-guidelines-02
   -
      - 3.2: "Currently three five methods"
      - 3.2.2, could be clearer: "seeking to understand how it might
      provide a different ordering of the network or society."
      - 3.3.5, internet doesn't want anything: "If the Internet wants to be
      a global network of networks, the protocols should work with languages
      apart from English and character sets apart from Latin characters."
      - 3.3.6, double reference: "[RFC4941] This is why Privacy Extensions
      for Stateless Address Autoconfiguration in IPv6 have been introduced.
      [RFC4941]"
      - 3.3.6, I would reorder those questions
      - 3.3.8, the example seems unfinished?
      - 3.3.10, talks about "the internet" like "hip hop" (throughout the
      document, but especially apparent here)
      - 3.3.14, is this referring to encrypted intermediate storage? "or
      the implementation uses an encrypted store"
      - 3.3.15, how is the difference here between accuracy and consistency
      being thought out? Does consistency have a temporal/stateful
aspect? "Does
      your protocol maintain, assure and/or verify the accuracy of
payload data?
      Does your protocol maintain and assure the consistency of data?"
      - 3.3.15, the MITM description should probably be improved and
      bulleted? Should it hint at inactive MITM and should we call it something
      other than "man"?
      - 3.3.16, "man-in-the-middle-attacks" -> "man-in-the-middle attacks"
      - 3.3.16, "Bob can see the data did not come from Alice but from
      Corinne." remove "but by Corinne" as that may not be true.
      - 3.3.16, what about non-authenticity or knowing when to not ask for
      evidence of authenticity? E.g., attestation of hardware security devices
      like yubikeys may lock out people who use a different brand (Vanguard or
      Fidelity does this now).
      - 3.3.18, impacts bullet list broken
      - 3.3.19, typo "Does you protocol"
      - 5, looks like this should be a bullet list?


-- 
Joseph Lorenzo Hall
Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE 200, Washington DC 20005-3497
e: [e-mail], p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871

Don't miss out! CDT's Tech Prom is April 10, 2019, at The
Anthem. Please join us: https://cdt.org/annual-dinner/