Re: [secdir] Secdir review of draft-johansson-loa-registry-04

[Vincent Roca <[e-mail]>]

Hi Leif,

>> 2/ The rest of the sentence is confusing IMHO: "An implementor
>> [...] MUST NOT make any assumptions about the properties of any of
>> the listed level of assurance URIs or their associated trust 
>> frameworks or federations based on their presense in the IANA
>> registry."
>> 
>> Do you mean that the fact an IANA registry exists, by itself, does
>> not garranty the trust framework actually provides the expected
>> security features (i.e. the IANA registry is merely a definition
>> record)?
> 
> Yes thats the intent!
> 
>> I don't like the term "any assumption". If a LOA tells me I can
>> achieve some security level by using it, I'll first **assume** it's
>> true and in a second step I'll verify it's indeed the case.
>> 
> 
> What I want to say is that the fact that the entry exists doesn't
> imply any quality of the underlying trust framework.

So it's just a matter of presentation. I prefer your sentence ("does not imply any
quality...") to what is said in the I-D ("must not make any assumptions...").

> Thanks for a great review!

You're welcome.

Cheers,

   Vincent