[Roll] Security threat analysis for applicability draft

peter van der Stok <stokcons@xs4all.nl> Thu, 13 March 2014 10:25 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Date: Thu, 13 Mar 2014 11:25:39 +0100
From: peter van der Stok <stokcons@xs4all.nl>
To: roll@ietf.org
Organization: vanderstok consultancy
Mail-Reply-To: consultancy@vanderstok.org
Message-ID: <9f0193e6f3e91387bbc90a10774d2260@xs4all.nl>
User-Agent: XS4ALL Webmail
Archived-At: http://mailarchive.ietf.org/arch/msg/roll/D0emrHf5W8QOkMQ46hfnLxo-RA8
Subject: [Roll] Security threat analysis for applicability draft
Precedence: list
Reply-To: consultancy@vanderstok.org, Routing Over Low power and Lossy networks <roll@ietf.org>

Hi Richard,


Thanks for the security threats draft. It certainly provides a large 
part of the text needed in the applicability drafts.
However, I am not sure I interpreted the text according to your 
intentions.

Looking at section 7 in more detail, I tried to establish where the 
applicability draft can be complementary to the text of the security 
draft.

 From section 7.1 I understand that key length, encryption algorithm and 
key life time need to be specified. Unfortunately, much of this is still 
in progress and can change with DICE and ACE recommendations.

Complementing section 7.2, link-layer security will probably be used 
today, but in 2 years time?

Complementing section 7.3. Do I understand that using multiple paths for 
reliability reasons should be mentioned as increasing routing security?

Complementing section 7.4. Writing down choices, as already provided by 
the threats draft, will be more realistic than writing down 
recommendations.

Complementing section 7.5. Is this the place one should write down 
physical access constraints or recommend to provide filtering edge 
routers at the border of the system?

In conclusion, I am very happy with the threats document and its 
recommendations, but I see little opportunity to improve on it in the 
applicability draft.

Thanks for a reaction,

Peter




-- 
Peter van der Stok
mailto: consultancy@vanderstok.org
www: www.vanderstok.org
tel NL: +31(0)492474673     F: +33(0)966015248

[Roll] Security threat analysis for applicability… peter van der Stok
Re: [Roll] Security threat analysis for applicabi… Michael Richardson