[MMUSIC] Re: FW: Security requirements review

[Gonzalo Camarillo <[e-mail]>]

Hi,

a couple of comments:

I would clarify what you had in mind when you wrote the following 
requirement:

REQ DOS-3: It SHOULD be possible to avoid DoS attacks that exhaust
    resources of IMG entities by flooding them with IMG metadata.

What do you mean by "avoid"? Do you mean that the entity should be able 
to run in a stateless mode? Or that it should be able to identify evil 
packets and discard their data? or...?


You should clarify both requirements in Section 6.5 (Replay Attacks):

REQ REP-1: IMG metadata MUST be protected against partial or full
    replacement of newer ("current") versions by older ones.

REQ REP-2: Mechanisms MUST be provided to mitigate replay attacks on
    the IMG operations.


Do you mean that you have to bundle somehow the metadata with the 
delivery mechanism? Let's say I receive metadata and I send it to 
another user without knowing that a newer version of the metadata is 
available... should the other user be able to detect this "reply 
attack"? I guess that an explanatory paragraph would help understand 
what these requirements really mean.


Thanks,

Gonzalo


[e-mail] wrote:

> Hi
> 
> Because I found that you have somehow been active on security issues related to MMUSIC, it would be fantastic if you would have a look at the security requirements in:
> http://www.ietf.org/internet-drafts/draft-ietf-mmusic-img-req-03.txt
> ..and send comments back (CC MMUSIC email list too if possible).
> 
> The document concerns "Requirements for Internet Media Guides" (IMGs).
> 
> This document has completed WGLC and we are thinking about a final sanity check that nothing crazy slipped past the authors, reviewers and numerous editions before handing over to the IESG (as a kindness towards the IESG :)  If you spot any impossible, unnecessary or questionable requirements please highlight them. (Naturally we're happy that the document is flawless, but once by your expert eyes would be very reassuring).
> 
> The security sanity check concerns chapter 6 of the document (maybe I'm pushing my luck to say comments on other parts are always welcome too).
> 
> Thanks for any ideas you can offer.
> 
> Cheers, Rod Walsh.
> 
> 
> PS rather than filling your inbox with lots of background I hope you are happy to ask in case you haven't had chance to follow the IMG work so far.
> 

-- 
Gonzalo Camarillo         Phone :  [phone]
Oy L M Ericsson Ab        Mobile:  [phone]
Telecom R&D               Fax   :  [phone]
FIN-02420 Jorvas          Email :  [e-mail]
Finland                   http://www.hut.fi/~gonzalo


_______________________________________________
mmusic mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/mmusic