Re: [secdir] Review of draft-ietf-repute-query-http-09

[Shawn M Emery <[e-mail]>]

On 08/21/13 10:22 PM, Dave Crocker wrote:
> On 8/21/2013 9:00 PM, Shawn M Emery wrote:
>> However, none of the
>> referenced RFCs and draft directly talk about the various attacks and
>> how to mitigate against said attacks.
>
>
> Shawn, some clarification please:
>
>    This is a simple query protocol, ableit yes one where the data is
> making trust assertions.
>
>    A possible implication of your above comment is that all IETF
> protocols should carry a threat analysis.  Have I misunderstood?

Hi Dave,

Sorry for not being specific.  I will try to clarify my concerns:

This draft references the reputation considerations draft when providing 
or using reputation services, I assume in a security context given that 
it is referenced in the security considerations section.  When I looked 
at the referenced draft's security considerations section it stated that 
there are threats discussed in the operation text above.  I think that 
these types of discussions deserve a separate section.  If the topic is 
mostly security it would be helpful to have a summary of the various 
threats and how to mitigate.  In any case, when looking through the 
entire draft I do see some suggestions for clients and their RSPs.

Shawn.
--