Re: [secdir] secdir review of draft-ietf-decade-problem-statement-05

[Songhaibin <[e-mail]>]

Thank you Leif,

> My main problem with the draft is that the Security Considerations
> Section is weak. I would have liked a more in-depth analysis of the
> enumerated threats in the context of decade. For instance the privacy
> aspects of using in-network storage for P2P networks is only covered
> briefly as part of a discussion on traffic analysis.

Because many of the security threats are not very special compared to other client-server interactions, so we did not give much analysis there, but only quote the potential threats here. But we will try to think a little more deeper.

> Also in section 3.2 it is noted that E2E encryption may render P2P
> caches ineffective. This speaks to a fundamental flaw (imo) in the
> architecture: the standard way to protect against many of the stated
> attacks also leads to inefficiency of decade. At the very least the
> document needs to call this issue out clearly.

You are right. But this issue seems to be better covered in the architecture document than this one.

BR,
-Haibin

> -----Original Message-----
> From: Leif Johansson [mailto:[e-mail]]
> Sent: Monday, March 12, 2012 4:39 AM
> To: [e-mail]; [e-mail];
> [e-mail]
> Subject: secdir review of draft-ietf-decade-problem-statement-05
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
> 
> 
> Also in section 3.2 it is noted that E2E encryption may render P2P
> caches ineffective. This speaks to a fundamental flaw (imo) in the
> architecture: the standard way to protect against many of the stated
> attacks also leads to inefficiency of decade. At the very least the
> document needs to call this issue out clearly.
> 
> 	Cheers Leif
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAk9dDXQACgkQ8Jx8FtbMZndzfQCdGlV5Vun5Khv9doeYdcjebALX
> ++EAn0VVTjtEMsDlFFM86NlWC+pRlr7X
> =Ob4+
> -----END PGP SIGNATURE-----