Re: [Roll] formulating a plan to normalize secdir reviews of ROLL applicability statements

Michael Richardson <mcr+ietf@sandelman.ca> Sun, 02 March 2014 14:53 UTC

From: Michael Richardson <mcr+ietf@sandelman.ca>
to: roll@ietf.org
In-Reply-To: <14216.1391615181@sandelman.ca>
References: <14216.1391615181@sandelman.ca>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha1"; protocol="application/pgp-signature"
Date: Sun, 02 Mar 2014 09:53:04 -0500
Message-ID: <2994.1393771984@sandelman.ca>
Sender: mcr@sandelman.ca
Archived-At: http://mailarchive.ietf.org/arch/msg/roll/QDrRuBQf1BBHvdskLi5PxUyqh38
Subject: Re: [Roll] formulating a plan to normalize secdir reviews of ROLL applicability statements
Precedence: list
Reply-To: Routing Over Low power and Lossy networks <roll@ietf.org>

At my request there were early security reviews that occured for the
ROLL applicability statements.  These were done by:

   industrial:     Alexey Melnikov <alexey.melnikov@isode.com>
   ami:            Chris Lonvick <clonvick@cisco.com>
   home-building:  Catherine Meadows <meadows@itd.nrl.navy.mil>

   in addition Stephen Kent <kent@bbn.com> did the review of security-threats
   and Dan Harkins <dharkins@lounge.org> had previously done a review of
   the applicability template.

The result did not go as I intended, and there were some conversations that
Ines and I had with the security ADs and the SecDir secretary (Tero) about
how we went wrong.  On Thursday the 27th, I asked the reviewers to give me
some general feedback about how we could make things smoother.

The summary is that we simply have not been explicit enough about the
relationship between documents, and we need to insert some text into each
document explaining it's relationship to other documents.

I'm looking for someone to write that text: someone who has a fresh take on
this, and will hopefully make explicit the things that I perhaps now regard
as obvious.  I did a new slide,  number: 27 of
   http://tools.ietf.org/agenda/89/slides/slides-89-roll-1.pdf

The relationship is:
    RFC6550                - defines some (security) mechanisms.
      PANA/ZigBee/15.4/..  - defines some more (security) mechanisms.
    roll-security-threats  - details some attacks/threats, and
                             explains whether they depend upon the
                             deployment scenario.
    *-applicability        - needs to detail the deployment scenario,
                             ane explain what mechanisms are to be used
                             to deal with threats.
    applicability-template - has some spaces for fill in the blank
                             that references threats raised.


Some specific todo:
     1) applicability documents need to reference roll-security-threats,
        (some still reference security-framework document)

     2) some (common) text in the applicability document needs to explain how
        the applicability document relates to other documents.

This is what I have now, but I would certainly like improvements:

>1.1.  Relationship to other documents
>
>   This applicability statement profiles a number of deployment
>   parameters from other protocols.  It deals with base RPL trickle
>   parameters from RFC6550 [RFC6550], MPL trickle parameters from
>   RFC6206 [RFC6206], and addresses the security threats that
>   [I-D.ietf-roll-security-threats], details.


--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
IETF ROLL WG co-chair.    http://datatracker.ietf.org/wg/roll/charter/

Re: [Roll] formulating a plan to normalize secdir… Michael Richardson
[Roll] some small help needed. (was Re: formulati… Michael Richardson