Re: [secdir] Secdir review of draft-ietf-i2rs-protocol-security-requirements-10

[Radia Perlman <[e-mail]>]

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.

These comments were written primarily for the benefit of the security area
directors.

Document editors and WG chairs should treat these comments just like any
other last call comments.


I previously reviewed version 6, and they addressed my concerns, so I don't
have too much to say, but here are some comments that are just editorial,
and so fine to ignore.


---------


Section 3.2 is called "New Security Features", though I'm not sure all the
features specified in the section are really secure features, such as
priority.   Or "an insecure protocol for read-only data constrained to
specific standard usages". Is that a security feature? Perhaps "New
features related to security"


------------


In section 4.6 " The I2RS Architecture [RFC7921] defines a role or security
role as specifying read, write, or notification access by a I2RS client to data
within an agent's data model."


I'm not sure I'd say that the definition of a role is "specifying type of
access". Perhaps a definition of a role might be "a method of making access
control more manageable by creating a grouping of users, so that the access
controls can be specified for the role rather than for each of the
individuals." Though perhaps it's the word "defines" that's troubling me,
and instead it could be "RFC7921 specifies access control for a group as
being read, write, or notification...."


Radia