Re: [secdir] Review of draft-ietf-repute-query-http-09

["Murray S. Kucherawy" <[e-mail]>]

Hi Shawn, thanks for the review.

On Sat, Aug 24, 2013 at 9:56 PM, Shawn M Emery <[e-mail]>wrote:

> On 08/21/13 10:22 PM, Dave Crocker wrote:
>
>> On 8/21/2013 9:00 PM, Shawn M Emery wrote:
>>
>>> However, none of the
>>> referenced RFCs and draft directly talk about the various attacks and
>>> how to mitigate against said attacks.
>>>
>>
>>
>> Shawn, some clarification please:
>>
>>    This is a simple query protocol, ableit yes one where the data is
>> making trust assertions.
>>
>>    A possible implication of your above comment is that all IETF
>> protocols should carry a threat analysis.  Have I misunderstood?
>>
>
> Hi Dave,
>
> Sorry for not being specific.  I will try to clarify my concerns:
>
> This draft references the reputation considerations draft when providing
> or using reputation services, I assume in a security context given that it
> is referenced in the security considerations section.  When I looked at the
> referenced draft's security considerations section it stated that there are
> threats discussed in the operation text above.  I think that these types of
> discussions deserve a separate section.  If the topic is mostly security it
> would be helpful to have a summary of the various threats and how to
> mitigate.  In any case, when looking through the entire draft I do see some
> suggestions for clients and their RSPs.
>
>
>
I'm still a little unclear about what the suggestion is here.  Since this
review is specific to query-http, I take your feedback to mean that
query-http itself is fine, but it's desirable that the considerations
document go into more detail about what it's discussing.  I think that's
fine and probably true, and I'll do so for that document, but I don't think
there's anything outstanding for this one.  Do you agree?

-MSK