[regext] Intdir telechat review of draft-ietf-regext-data-escrow-05

[Carlos Bernardos via Datatracker <[e-mail]>]

Reviewer: Carlos Bernardos
Review result: Ready with Nits

Reviewer: Carlos J. Bernardos
Review result: Ready with nits

I am an assigned INT directorate reviewer for draft-ietf-regext-data-escrow 
These comments were written primarily for the benefit of the Internet Area
Directors. Document editors and shepherd(s) should treat these comments just
like they would treat comments from any other IETF contributors and resolve
them along with any other Last Call comments that have been received. For more
details on the INT Directorate, see http://www.ietf.org/iesg/directorate.html.

I hope these comments are clear and useful.

>From an INT directorate point of view the document is ready, as it does not
deal with the mechanisms used to actually transfer the data escrow deposits. I
have some comments regarding the security and privacy sections. - In section 10
(Security considerations):

"Depending on local policies, some elements or, most likely, the whole deposit
will be considered confidential. As such, the registry transmitting the data to
the escrow agent should take all the necessary precautions such as encrypting
the data itself and/or the transport channel to avoid inadvertent disclosure of
private data."

I'd assume the should in "escrow agent should take" should be UPPER case, right?

"Authentication of the parties passing data escrow deposit files is also of the
utmost importance. The escrow agent SHOULD properly authenticate the identity
of the registry before accepting data escrow deposits. In a similar manner, the
registry SHOULD authenticate the identity of the escrow agent before submitting
any data.

Additionally, the registry and the escrow agent SHOULD use integrity checking
mechanisms to ensure the data transmitted is what the source intended.
Validation of the contents by the escrow agent is RECOMMENDED to ensure not
only that the file was transmitted correctly from the registry, but also that
the contents are "meaningful"."

In general, I wonder why not all the SHOULDs in this section are not MUST. But
this should be probably better assessed by the SECDIR.

- In section 11 (Privacy considerations):

"This specification defines a format that may be used to escrow personal data.
The process of data escrow is governed by a legal document agreed by the
parties, and such legal document must regulate the particularities regarding
the protection of personal data."

I'd assume the must should be in UPPER case, no?

Thanks,

Carlos