Re: [Raw] Roman Danyliw's Discuss on draft-ietf-raw-use-cases-08: (with DISCUSS and COMMENT)

[John Scudder <[e-mail]>]

Hi All,

> On Nov 29, 2022, at 5:46 PM, CARLOS JESUS BERNARDOS CANO <[e-mail]> wrote:
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> Section 12 states the situation accurately – “Each of the potential RAW
> use-cases will have security considerations from both the use-specific
> perspective.”  Where are these security and privacy considerations for these
> uses cases discussed?  Are these in scope to solve for RAW?  A select list to
> review would be:
> 
> ** Section 3.*. Per the amusement park use case, what are the physical location
> tracking and surveillance considerations?
> 
> ** Section 7.*.  Per the vehicle platooning use case, what are the physical
> location tracking privacy considerations?
> 
> ** Section 8.*. Per the edge robotics use case, what are the privacy
> considerations of the video surveillance?
> 
> ** Section 9.*.  Per the ambulance use case, what are the security
> considerations around exchanging health care information over a wireless WAN?
> 
> A clearer distinction of what is to be addressed at the protocol level, and
> what seems like an application consideration is needed.
> 
> [Carlos] This is a good point to clarify. We have followed the same approach as in the DETNET use cases document (RFC 8578). The RAW use cases document aims at documenting different use cases of interest for RAW, and documenting their demands in terms of rea liability and availability. The document does not go into the per-use case privacy and security considerations of potential future RAW solutions. As of today, the RAW WG is not chartered to work on solutions (it might be done in RAW or DETNET). We believe that the specific privacy and security considerations for the solutions would belong to a different document. Do you think we should be specific about this in the document? We borrowed some text from RFC 8578 to be consistent with the approach that DETNET followed.

We talked about this at today’s IESG telechat. I thought I would take a stab at summarizing the points Roman made; I’m sure he will correct me if I get anything wrong. It was something like this:

- Agreed that this document is use cases and not solutions.
- The document presents use cases, described in prose in a fairly abstract way.
- It is appropriate to talk about security+privacy *at the same level of abstraction* relative to the cases presented.
- Meaning, just a sentence or two per use case probably.
- Take the amusement park with armband doing human tracking case. It would be appropriate to briefly acknowledge this creates a consideration that will need to be worked out as part of a solution.

I would add in my own words, that in the same way use cases exist to provide context for working on and evaluating a solution, it’s also helpful to identify (though not solve) any security and privacy considerations that a solution will foreseeably need to address.

I hope this helps,

—John