Re: [secdir] secdir review of draft-sparks-genarea-imaparch

[Robert Sparks <[e-mail]>]

Thanks Carl -

The details of how this authentication will be managed is probably 
diving a little deep
for the conversations this draft is hoping to inform. Pointing to 
integrating with the datatracker
should be enough, but if there is something _specific_ (in particular 
specific to IMAP) that we
want to constrain the design discussions with, let me know.

RjS

On 5/5/13 9:00 AM, Carl Wallace wrote:
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
> These comments were written primarily for the benefit of the security area
> directors.  Document editors and WG chairs should treat these comments
> just like any other last call comments.
>
> This draft describes the requirements for providing an IMAP interface for
> IETF mail archives.  The first item in the security considerations is
> correct, but in general the security considerations seem too narrowly
> focused on searching and storage.  Some discussion of the following may be
> worthwhile: how the server is authenticated to users, how users are
> authenticated to the server (unless the reference to the datatracker
> system is viewed as sufficient), details of the interface with the
> datatracker authentication system, (maybe) how archive integrity is
> maintained, identification of what should or should not be logged.
>
>