[secdir] Secdir review of draft-ietf-geopriv-deref-protocol-03

[Charlie Kaufman <[e-mail]>]

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

This document specifies a protocol over http (and optionally over TLS) for dereferencing a Presence Information Data Format Location Object. This data is sensitive and there is likely to be an authorization policy saying who can get it. This spec is careful to enumerate the various ways that authorization decision might be made without specifying how one would specify any particular policy. I believe it therefore manages to evade any security scrutiny. (Use of TLS is recommended and is an appropriate way to secure the protocol itself).

I found one typo: page 11: specfies -> specifies

	--Charlie