Re: [secdir] Secdir review of draft-ietf-eman-requirements-10

[Magnus Nyström <[e-mail]>]

Thanks; yes this addresses my concern. Thank you!
/M


On Tue, Jan 29, 2013 at 8:40 AM, Juergen Quittek <[e-mail]> wrote:

> Hi Magnus,
>
> Many thanks for the review.
>
> As you suggested, I extended the paragraph in the Security
> Considerations section:
>
> OLD
>    Monitoring energy-related quantities of an entity addressed in
>    Sections 5 - 8 can be used to derive more information than just the
>    received and provided energy, so monitored data requires privacy
>    protection.  Monitored data may be used as input to control,
>    accounting, and other actions, so integrity of transmitted
>    information and authentication of the origin may be needed.
>
> NEW
>    Monitoring energy-related quantities of an entity addressed in
>    Sections 5 - 8 can be used to derive more information than just the
>    received and provided energy, so monitored data requires protection.
>    This protection includes authentication and authorization of entities
>    requesting access to monitored data as well as privacy protection
>    during transmission of monitored data.  Monitored data may be used as
>    input to control, accounting, and other actions, so integrity of
>    transmitted information and authentication of the origin may be
>    needed.
>
>
> Does this look OK for you?
>
> Thanks,
>     Juergen
>
>
> On 21.01.13 05:05, "Magnus Nyström" <[e-mail]> wrote:
>
> >I have reviewed this document as part of the security directorate's
> >ongoing effort to review all IETF documents being processed by the
> >IESG.  These comments were written primarily for the benefit of the
> >security area directors. Document editors and WG chairs should treat
> >these comments just like any other last call comments.
> >
> >This standards-track document describes requirements on standards for
> >managing power entities over networks.
> > As stated in the Security Considerations section, controlling power
> >state and power supply of networked energy entities are highly sensitive
> >actions and thus authorization, privacy etc. may be required. Similarly,
> >the date provided by those entities will often require integrity and
> >sometimes authenticity. The document may gain by also making clear the
> >potential need for the energy entities to identify, authenticate and
> >authorize the entities requesting access to power data. I would suggest
> >to add some text around this - because I assume some requirements on
> >standards will be present for that.
> >
> >
>
>


-- 
-- Magnus