Re: [secdir] secdir review of draft-ietf-tsvwg-admitted-realtime-dscp-05

[Fred Baker <[e-mail]>]

On Nov 21, 2008, at 11:44 PM, Alexey Melnikov wrote:

> I found the Security Consideration section to be insufficiently  
> detailed
> about threats. While the list of threats seems to be adequate,
> it would be useful to have some pointers to documents describing  
> possible
> remedies (for example how to achieve adequately strong proof of  
> identity),
> or a clear statement that the protocol doesn't provide such facility.

Would a reference to 4542 be sufficient?

My sense is that the threat model on a AAA service is likely to be  
documented in something related to AAA services, and frankly you are  
more likely to have a pointer to the document than I. Similarly, the  
threat model regarding people getting capacity allocated to them that  
shouldn't have been seems implicit in RFC 1633, the documentation of  
RSVP, and the documentation of NSIS - protocols designed explicitly to  
prevent that from happening. There is of course a threat model for  
implementing such a protocol as well, which is mentioned in RFC 4230.

if I'm missing something and you want more, some idea of what kind of  
threat model you are looking for would be helpful.
_______________________________________________
secdir mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/secdir