Re: [secdir] secdir review of draft-ietf-decade-problem-statement-05

[David Harrington <[e-mail]>]

Hi,

I think the problem is "security issues are part of the problem", not just
part of the solution.

The threats associated with in-network storage should be identified as
part of the problem.
The need to mitigate the threats is part of the requirements.
How to mitigate those threats is part of the solution.

--
David Harrington
Director, Transport Area
Internet Engineering Task Force (IETF)
[e-mail]
[phone]





On 3/22/12 7:40 AM, "Songhaibin" <[e-mail]> wrote:

>Hi Leif,
>
>I do not say your suggestion is wrong. Instead, I think your comment is
>very reasonable. I say this is the problem statement draft, I admit we
>are going to dig a little deeper with the potential threats in our
>context (without an architecture as the basis), but these threats are not
>going to be solved here, they will be considered when designing the
>architecture document.
>
>BR,
>-Haibin
>
>> -----Original Message-----
>> From: Leif Johansson [mailto:[e-mail]]
>> Sent: Thursday, March 22, 2012 6:37 PM
>> To: Songhaibin
>> Cc: [e-mail];
>>[e-mail];
>> [e-mail]
>> Subject: Re: secdir review of draft-ietf-decade-problem-statement-05
>> 
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>> 
>> On 03/22/2012 08:44 AM, Songhaibin wrote:
>> > Thank you Leif,
>> >
>> >> My main problem with the draft is that the Security
>> >> Considerations Section is weak. I would have liked a more
>> >> in-depth analysis of the enumerated threats in the context of
>> >> decade. For instance the privacy aspects of using in-network
>> >> storage for P2P networks is only covered briefly as part of a
>> >> discussion on traffic analysis.
>> >
>> > Because many of the security threats are not very special compared
>> > to other client-server interactions, so we did not give much
>> > analysis there, but only quote the potential threats here. But we
>> > will try to think a little more deeper.
>> >
>> 
>> I think thats where we disagree. My argument is that since some of
>> the architecture is invalidated by common solutions to the usual
>> threat vectors (eg e2e encryption).
>> 
>> 	Cheers Leif
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1.4.11 (GNU/Linux)
>> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>> 
>> iEYEARECAAYFAk9rAMYACgkQ8Jx8FtbMZndKTQCfRPosiDyR8qVxzVv5mxOCZybE
>> 7ggAnjrKN/BC5ZL5F5I/5griYLcwnTa/
>> =dAdC
>> -----END PGP SIGNATURE-----