Re: [secdir] Review of draft-ietf-repute-query-http-09

And if every protocol description did carry a threat analysis, IMHO it would be a GOOD thing. 

Sent from my iPad

On Aug 25, 2013, at 0:56, Shawn M Emery <shawn.emery@oracle.com> wrote:

> On 08/21/13 10:22 PM, Dave Crocker wrote:
>> On 8/21/2013 9:00 PM, Shawn M Emery wrote:
>>> However, none of the
>>> referenced RFCs and draft directly talk about the various attacks and
>>> how to mitigate against said attacks.
>> 
>> 
>> Shawn, some clarification please:
>> 
>>   This is a simple query protocol, ableit yes one where the data is
>> making trust assertions.
>> 
>>   A possible implication of your above comment is that all IETF
>> protocols should carry a threat analysis.  Have I misunderstood?
> 
> Hi Dave,
> 
> Sorry for not being specific.  I will try to clarify my concerns:
> 
> This draft references the reputation considerations draft when providing or using reputation services, I assume in a security context given that it is referenced in the security considerations section.  When I looked at the referenced draft's security considerations section it stated that there are threats discussed in the operation text above.  I think that these types of discussions deserve a separate section.  If the topic is mostly security it would be helpful to have a summary of the various threats and how to mitigate.  In any case, when looking through the entire draft I do see some suggestions for clients and their RSPs.
> 
> Shawn.
> --
> _______________________________________________
> secdir mailing list
> secdir@ietf.org
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview