Re: [secdir] Review of draft-ietf-repute-query-http-09

Uri Blumenthal <uri@MIT.EDU> Sun, 25 August 2013 10:38 UTC

Return-Path: <uri@mit.edu>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B83621F9A4C for <secdir@ietfa.amsl.com>; Sun, 25 Aug 2013 03:38:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.203
X-Spam-Level:
X-Spam-Status: No, score=-2.203 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nNJ0YE0gVCHJ for <secdir@ietfa.amsl.com>; Sun, 25 Aug 2013 03:38:25 -0700 (PDT)
Received: from dmz-mailsec-scanner-6.mit.edu (dmz-mailsec-scanner-6.mit.edu [18.7.68.35]) by ietfa.amsl.com (Postfix) with ESMTP id 9646921F93D4 for <secdir@ietf.org>; Sun, 25 Aug 2013 03:38:24 -0700 (PDT)
X-AuditID: 12074423-b7f168e00000095a-94-5219dea07d6e
Received: from mailhub-auth-3.mit.edu ( [18.9.21.43]) by dmz-mailsec-scanner-6.mit.edu (Symantec Messaging Gateway) with SMTP id 61.76.02394.0AED9125; Sun, 25 Aug 2013 06:38:24 -0400 (EDT)
Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-3.mit.edu (8.13.8/8.9.2) with ESMTP id r7PAcLUa010473; Sun, 25 Aug 2013 06:38:21 -0400
Received: from [192.168.1.106] (chostler.hsd1.ma.comcast.net [24.62.227.134]) (authenticated bits=0) (User authenticated as uri@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id r7PAcInB027896 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Sun, 25 Aug 2013 06:38:19 -0400
References: <51CAA254.6040303@oracle.com> <52158CF5.4050001@oracle.com> <521591FA.20601@dcrocker.net> <52198E83.7050406@oracle.com>
Mime-Version: 1.0 (1.0)
In-Reply-To: <52198E83.7050406@oracle.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Message-Id: <48C75C3D-6DCB-448F-AA82-FAC7DCAF1710@mit.edu>
X-Mailer: iPad Mail (10B329)
From: Uri Blumenthal <uri@MIT.EDU>
Date: Sun, 25 Aug 2013 06:38:20 -0400
To: Shawn M Emery <shawn.emery@oracle.com>
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprLKsWRmVeSWpSXmKPExsUixCmqrbvgnmSQwfWbHBa/P31gszi17jyz xYtz0RYfFj5kseh7fYjdgdXj0s6TbB7/Z79m91iy5CeTx8ent1g8vlz+zBbAGsVlk5Kak1mW WqRvl8CVcfqlQ8EB3oo9J+8zNjD+4Opi5OSQEDCRuDDxHDOELSZx4d56ti5GLg4hgX2MEg/e PGWEcDYySrxf/Z0FKsMk8WTZDSinmVFi0p4jQGUcHLwC4hJXD/qAmJwCWhKzXxmDmMwCOhKT FzKCLGAW0JZYtvA12DJeASuJDYe+M4NMYRZ4wSgxeeYVqCtkJDZvf8wOYrMJKEk0N29hBbGF Bewlem9tYAOZySKgKtE1wxokLAK06UZDB9MERsFZCDfMQlg8C8niBYzMqxhlU3KrdHMTM3OK U5N1i5MT8/JSi3TN9HIzS/RSU0o3MYJCnt1FeQfjn4NKhxgFOBiVeHglhCWDhFgTy4orcw8x SnIwKYnyxt8CCvEl5adUZiQWZ8QXleakFh9ilOBgVhLhdXUAyvGmJFZWpRblw6SkOViUxHmf PT0bKCSQnliSmp2aWpBaBJOV4eBQkuANuAvUKFiUmp5akZaZU4KQZuLgBBnOAzS8CaSGt7gg Mbc4Mx0if4pRl2PS3PmfGIVY8vLzUqXEedNBigRAijJK8+DmwFLVK0ZxoLeEee/cAariAaY5 uEmvgJYwAS05uBxsSUkiQkqqgfEcI98X7qcuS9clCdvmLXd9xeDB5VvUyl0wlcv1U/f392IF yudaFSpOFfBmueUfKG/LeXV0bqgLc7zT4gkhPDNW5yewGSU6ny0U1jrHz3YiIvXi32rZ42u2 a++smtiyan386uk7TYQmSJxQqAzrn+dwKo8tNuW53vSY6klrP9/cZJb9tz9RWomlOCPRUIu5 qDgRAOoQ8AUwAwAA
Cc: Dave Crocker <dhc@dcrocker.net>, "draft-ietf-repute-query-http.all@tools.ietf.org" <draft-ietf-repute-query-http.all@tools.ietf.org>, "dcrocker@bbiw.net" <dcrocker@bbiw.net>, "secdir@ietf.org" <secdir@ietf.org>
Subject: Re: [secdir] Review of draft-ietf-repute-query-http-09
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 25 Aug 2013 10:38:32 -0000

And if every protocol description did carry a threat analysis, IMHO it would be a GOOD thing. 

Sent from my iPad

On Aug 25, 2013, at 0:56, Shawn M Emery <shawn.emery@oracle.com>; wrote:

> On 08/21/13 10:22 PM, Dave Crocker wrote:
>> On 8/21/2013 9:00 PM, Shawn M Emery wrote:
>>> However, none of the
>>> referenced RFCs and draft directly talk about the various attacks and
>>> how to mitigate against said attacks.
>> 
>> 
>> Shawn, some clarification please:
>> 
>>   This is a simple query protocol, ableit yes one where the data is
>> making trust assertions.
>> 
>>   A possible implication of your above comment is that all IETF
>> protocols should carry a threat analysis.  Have I misunderstood?
> 
> Hi Dave,
> 
> Sorry for not being specific.  I will try to clarify my concerns:
> 
> This draft references the reputation considerations draft when providing or using reputation services, I assume in a security context given that it is referenced in the security considerations section.  When I looked at the referenced draft's security considerations section it stated that there are threats discussed in the operation text above.  I think that these types of discussions deserve a separate section.  If the topic is mostly security it would be helpful to have a summary of the various threats and how to mitigate.  In any case, when looking through the entire draft I do see some suggestions for clients and their RSPs.
> 
> Shawn.
> --
> _______________________________________________
> secdir mailing list
> secdir@ietf.org
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview