Re: [secdir] Review of draft-ietf-repute-query-http-09

[Shawn M Emery <[e-mail]>]

On 08/26/13 11:10 PM, Murray S. Kucherawy wrote:
> Hi Shawn, thanks for the review.
>
> On Sat, Aug 24, 2013 at 9:56 PM, Shawn M Emery <[e-mail] 
> <mailto:[e-mail]>> wrote:
>
>     On 08/21/13 10:22 PM, Dave Crocker wrote:
>
>         On 8/21/2013 9:00 PM, Shawn M Emery wrote:
>
>             However, none of the
>             referenced RFCs and draft directly talk about the various
>             attacks and
>             how to mitigate against said attacks.
>
>
>
>         Shawn, some clarification please:
>
>            This is a simple query protocol, ableit yes one where the
>         data is
>         making trust assertions.
>
>            A possible implication of your above comment is that all IETF
>         protocols should carry a threat analysis.  Have I misunderstood?
>
>
>     Hi Dave,
>
>     Sorry for not being specific.  I will try to clarify my concerns:
>
>     This draft references the reputation considerations draft when
>     providing or using reputation services, I assume in a security
>     context given that it is referenced in the security considerations
>     section.  When I looked at the referenced draft's security
>     considerations section it stated that there are threats discussed
>     in the operation text above.  I think that these types of
>     discussions deserve a separate section.  If the topic is mostly
>     security it would be helpful to have a summary of the various
>     threats and how to mitigate.  In any case, when looking through
>     the entire draft I do see some suggestions for clients and their RSPs.
>
>
>
> I'm still a little unclear about what the suggestion is here.  Since 
> this review is specific to query-http, I take your feedback to mean 
> that query-http itself is fine, but it's desirable that the 
> considerations document go into more detail about what it's 
> discussing.  I think that's fine and probably true, and I'll do so for 
> that document, but I don't think there's anything outstanding for this 
> one.  Do you agree?

Yes, that's pretty much it; that this draft or the referenced draft 
should have a consolidated list of the various security issues and 
guidance to counter them.

Thanks,

Shawn.
--