Re: [Id-event] AD review of draft-ietf-secevent-http-poll-06

[Benjamin Kaduk <[e-mail]>]

Hi Mike,

Thanks for the updates, and I continue to be sorry for the long response
times.

Poll is in quite good shape (well, I guess it's mostly just that -push is
taking the brunt of the work for harmonizing the differences in text); just
a couple more changes to make and we should be good to start the IETF LCs
in parallel.  I'll again trim the resolved bits.

In Section 3 we have a note about DoS protections embedded in a larger
block of text:

   Authorization for the eligibility to provide actionable SETs can be
   determined by using the identity of the SET Issuer, validating the
   polling endpoint URL, perhaps using TLS, or via other employed
   authentication methods.  Among other benefits, authentication can
   help prevent denial-of-service attacks.  Because SETs are not
   commands, SET Recipients are free to ignore SETs that are not of
   interest after acknowledging their receipt.

I am not 100% sure, but I think this may have been text that originates
before the split of documents, and in push got extracted and made into a
separate section.  Does it still make sense here?  The DoS risk would
typically be for a server getting lots of inbound connections, but there's
not quite as clear a case for (client) authentication helping with that for
poll, since the client is not sending huge amounts of stuff that would need
to be dropped.  Am I misunderstanding the intent here, or should the
sentence just get dropped?

On Fri, Feb 07, 2020 at 05:18:04PM +0000, Mike Jones wrote:
> draft-ietf-secevent-http-poll-07<https://tools.ietf.org/html/draft-ietf-secevent-http-poll-07> was published to address these review comments.  (-08<https://tools.ietf.org/html/draft-ietf-secevent-http-poll-08> addressed additional editorial nits.)  Descriptions of the changes made for these comments are inline, prefixed by "Mike>".
> 
> 
> 
> -----Original Message-----
> From: Id-event <[e-mail]> On Behalf Of Benjamin Kaduk
> Sent: Tuesday, December 10, 2019 4:37 PM
> To: [e-mail]
> Cc: [e-mail]
> Subject: [Id-event] AD review of draft-ietf-secevent-http-poll-06
> 
> 
> Section 3
> 
> 
> Since poll has the TLS server as the SET Transmitter, we could potentially pull in RFC 6125 and talk about validating DNS-IDs to authenticate the Transmitter.  Given that the name to be authenticated would be part of the information conveyed out-of-band, though, it's not entirely clear how much value there would be in doing so.
> 
> 
> Mike> As in Push, this section was formerly poorly worded, and has largely been rewritten.

As for -push, I'd really like to be able to say something about the other
half of the name comparison.  In this case would it be something like
"discovery of SET Transmitters (and the names used to authenticate them) is
out of scope for this document"?

Thanks for the updates,

Ben