Re: [secdir] Secdir review of draft-ietf-eman-requirements-10

[Juergen Quittek <[e-mail]>]

Hi Magnus,

Many thanks for the review.

As you suggested, I extended the paragraph in the Security
Considerations section:

OLD
   Monitoring energy-related quantities of an entity addressed in
   Sections 5 - 8 can be used to derive more information than just the
   received and provided energy, so monitored data requires privacy
   protection.  Monitored data may be used as input to control,
   accounting, and other actions, so integrity of transmitted
   information and authentication of the origin may be needed.

NEW
   Monitoring energy-related quantities of an entity addressed in
   Sections 5 - 8 can be used to derive more information than just the
   received and provided energy, so monitored data requires protection.
   This protection includes authentication and authorization of entities
   requesting access to monitored data as well as privacy protection
   during transmission of monitored data.  Monitored data may be used as
   input to control, accounting, and other actions, so integrity of
   transmitted information and authentication of the origin may be
   needed.


Does this look OK for you?

Thanks,
    Juergen


On 21.01.13 05:05, "Magnus Nyström" <[e-mail]> wrote:

>I have reviewed this document as part of the security directorate's
>ongoing effort to review all IETF documents being processed by the
>IESG.  These comments were written primarily for the benefit of the
>security area directors. Document editors and WG chairs should treat
>these comments just like any other last call comments.
>
>This standards-track document describes requirements on standards for
>managing power entities over networks.
> As stated in the Security Considerations section, controlling power
>state and power supply of networked energy entities are highly sensitive
>actions and thus authorization, privacy etc. may be required. Similarly,
>the date provided by those entities will often require integrity and
>sometimes authenticity. The document may gain by also making clear the
>potential need for the energy entities to identify, authenticate and
>authorize the entities requesting access to power data. I would suggest
>to add some text around this - because I assume some requirements on
>standards will be present for that.
>
>