Re: [secdir] review of draft-ietf-cdni-use-cases-08

["Francois Le Faucheur (flefauch)" <[e-mail]>]

(speaking as WG co-chair)

Hi Leif & use-cases co-authors,

Thanks for your review.

Regarding :
"The security considerations section
refers the reader to the CDNI problem statement which is fine if
all the security considerations from RFC3570 (which is obsoleted
by this document) are carried over to the CDNI problem statement."

I would say that the fundamental security considerations brought up in RFC3570 are indeed covered by the Problem Statement. But arguably, there are one or two interesting specific declinations of these fundamental security considerations that are more explicitely spelt out in RFC3570 (eg "Delivery of Bad CONTENT"). My proposal would be that we catch all these "specific declinations" in our CDNI Framework document, since this is the target document for discussing specific declinations of system-level security issues (and each individual CDNI interface document will discuss its interface-specific considerations). 
Does that work?
If yes, I'll drop a note to the CDNI Framework authors to make sure they exhaustively catch any specific declinations of security issues that was brought up in RFC3570 and is not yet discussed in the CDNI Framework.

Cheers

Francois




On 8 Jul 2012, at 22:12, Leif Johansson wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
> 
> 
> The document is well written. The security considerations section
> refers the reader to the CDNI problem statement which is fine if
> all the security considerations from RFC3570 (which is obsoleted
> by this document) are carried over to the CDNI problem statement.
> 
> 	Best R
> 	Leif
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAk/56bkACgkQ8Jx8FtbMZneEEACfSx3EDC8LjfxAVtjlG26U0yke
> A/4AniNhNV6H7bR5HCqfisT2mZ2lFgp0
> =UlPC
> -----END PGP SIGNATURE-----