Re: [Modern] Benoit Claise's No Objection on draft-ietf-modern-problem-framework-03: (with COMMENT)

["Peterson, Jon" <[e-mail]>]

Hey Benoit (and Linda),

I did want to make sure we addressed the review here.

To the first question, I think we are trying to tee up what the problem is
in the "problem statement" section. Broadly, there is a transition going
on, for various economic reasons, that is pushing the telephone network
off of its legacy infrastructure and on to the Internet. In so far as
people still want to use telephone numbers for those services - and they
do - we need a story about how to manage and resolve them. We've been
trying to figure this out for years, but the attempt in MODERN is the
first to kind of view this from a lifecycle perspective, where we use
common objects to provision and resolve telephone numbers, and to build in
the security lessons of STIR. Effectively we talk about ENUM and DRINKS in
the first paragraph of the problem statement to tee up our discussion of
why existing approaches aren't working.

To the second question, I think the use of mobile phones as a form of
two-factor auth isn't quite in the scope of this framework, except
indirectly, in so far as routing decisions to mobile phones could be made
through the retrieval interface in the document. I would say that more
broadly, we hope that the credentials that will be installed in devices
could take the place of those sorts of return-routability checks, but that
depends more on work happening in ACME and STIR than here in MODERN.
MODERN as a framework does draw the high-level picture of how those
credentials might be provisioned as a part of acquiring those numbers.

Does that make sense?

Thanks!

Jon Peterson
Neustar, Inc.

On 2/21/18, 7:06 PM, "Benoit Claise" <[e-mail]> wrote:

>Benoit Claise has entered the following ballot position for
>draft-ietf-modern-problem-framework-03: No Objection
>
>When responding, please keep the subject line intact and reply to all
>email addresses included in the To and CC lines. (Feel free to cut this
>introductory paragraph, however.)
>
>
>Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
>for more information about IESG DISCUSS and COMMENT positions.
>
>
>The document, along with other ballot positions, can be found here:
>https://datatracker.ietf.org/doc/draft-ietf-modern-problem-framework/
>
>
>
>----------------------------------------------------------------------
>COMMENT:
>----------------------------------------------------------------------
>
>>From Linda Dunbar, as OPS DIR reviewer:
>
>The draft brought up a very interesting aspect of Telephone Numbers (TNs),
>especially the mobile phone number which is widely used for getting
>"secure
>code" for secure access to very sensitive content, such as bank account.
>
>However, the draft only describes how today's TNs are acquired and managed
>(e.g. the Use cases in Section 4). Two issues with the draft: 1) The draft
>didn't have the content to describe what is the problems with the current
>practices. (I was expecting to read the "problems" when I started to read
>the
>draft) 2) The draft didn't describe the problems of using mobile phone
>number
>for authenticating the access to sensitive data content.
>
>