Re: [Rats] draft-birkholz-rats-uccs

[Laurence Lundblade <[e-mail]>]

> On Mar 13, 2021, at 12:32 PM, Thomas Fossati <[e-mail]> wrote:
> 
> Hi Laurence, just a small note,
> 
> On Sat, Mar 13, 2021 at 7:06 PM Laurence Lundblade
> <[e-mail]> wrote:
>> To me putting all the security discussion in to the UCCS spec is like putting the TLS and IPsec standard into the HTML, JSON or XML standards. HTML, UCCS… just define data formats. The difference here is that CWT which has security built in and came first where as HTML, JSON and XML were invented first without security.
> 
> I see this in a slightly different way: we take a data format that has
> a "secure by default" label on it and we strip off the very thing that
> makes it secure.  Since we are changing its commonly understood
> semantics, it's probably wise that we simultaneously state why and
> when this is acceptable, along with the assumed threat model.

Agree that something must be said for this reason.

Just don’t think it should go into the full set of security considerations or describing a designed solution because both vary by use case and problem domain. It is not possible to anticipate all the use cases and problem domains. 

We don’t have any standard that says how you should securely transfer particular data formats like HTTP, XML or JSON. There is no “Secure transfer of HTML” standard. Instead we have security protocols like TLS, COSE, JOSE and such which can be used to secure data in general.

As I mentioned before, I think it would be good to split the document in two, something I hadn’t thought of before.

But, I’m still OK with it as is. This is just a fun discussion :-)

LL