Re: [mile] AD review of draft-ietf-mile-xmpp-grid-08

[Peter Saint-Andre <[e-mail]>]

Thanks, Nancy, that all looks good to me.

On 12/29/18 7:28 PM, Nancy Cam-Winget (ncamwing) wrote:
> Hi Alexey,
> Thank you for your careful review (and Happy Holidays!).  Please see comments below (and the updates have been made to now version -09 draft
> https://datatracker.ietf.org/doc/draft-ietf-mile-xmpp-grid/):
> 
> 
> On 12/6/18, 04:21, "mile on behalf of Alexey Melnikov" <[e-mail] on behalf of [e-mail]> wrote:
> 
>     Hi,
>     
>     This document reads well and I am grateful for the extensive Security 
>     Considerations section!
>     
>     Some specific comments, most of which are nits/minor things:
>     
>     The following references need to be Normative, as they describe 
>     documents that need to be read and understood in order to implement 
>     various requirements specified in this draft:
>     
>       [XEP-0060]
>     
>       [XEP-0030] (used in a SHOULD)
>     
>       [XEP-0004] (used in a SHOULD)
> [NCW] Updated in version -09
>     
>     
>     The following need to have References:
>     
>     SASL EXTERNAL - Normative reference to RFC 4422
>     
>     DHCP - Informative reference
> [NCW] Updated in version -09
>     
>     
>     8.2.1.  Network Attacks
>     
>         A variety of attacks can be mounted using the network.  For the
>         purposes of this subsection the phrase "network traffic" can be taken
>         to mean messages and/or parts of messages.  Any of these attacks can
>         be mounted by network elements, by parties who control network
>         elements, and (in many cases) by parties who control network-attached
>         devices.
>     
>         o  Network traffic can be passively monitored to glean information
>            from any unencrypted traffic
>     
>       [snip]
>     
>         o  A "Man In The Middle" (MITM) attack can be mounted where an
>            attacker interposes itself between two communicating parties and
>            poses as the other end to either party or impersonates the other
>            end to either or both parties
>     
>         o  Resist attacks (including denial of service and other attacks from
>            XMPP-Grid Platforms)
>     
>     This seems out of place or not worded quite right. All other items 
>     describe various attacks. What exactly does this item mean?
> [NCW] It was meant to be a general statement that other attacks could be there, but as you note,
> It seemed out of place and didn't really add to the considerations so I've removed it.
>     
>         o  Undesired network traffic can be sent in an effort to overload an
>            architectural component, thus mounting a denial of service attack
>     
>     
>     8.3.6.  Securing the Certification Authority
>     
>         As noted above, compromise of a Certification Authority (CA) trusted
>         to issue certificates for the XMPP-Grid Controller and/or XMPP-Grid
>         Platforms is a major security breach.  Many guidelines for proper CA
>         security have been developed: the CA/Browser Forum's Baseline
>         Requirements, the AICPA/CICA Trust Service Principles, etc. The CA
>         operator and relying parties should agree on an appropriately
>         rigorous security practices to be used.
>     
>         Even with the most rigorous security practices, a CA can be
>         compromised.
>     
>     I think it might be good to reference Certificate Transparency WG work 
>     here (informatively), see <https://datatracker.ietf.org/wg/trans/documents/
> [NCW] As I was trying to figure out how to work it in, I added a reference to RFC6962
> (the base draft from the trans WG) as another guideline....hopefully that satisfies your request?
>     
>     Best Regards,
>     
>     Alexey
>     
>     
>     
>     _______________________________________________
>     mile mailing list
>     [e-mail]
>     https://www.ietf.org/mailman/listinfo/mile
>     
> 
> _______________________________________________
> mile mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/mile
>